Xygeni Logo White
Start Free
Book a demo

Xygeni Blog

Must-Read Posts

Xygeni at ENISE 2026 AI coding agent security

Who Decided That Release Could Ship? AI Coding Agent Security Lessons from ENISE 2026

At ENISE 2026, Xygeni CEO Jesús Cuadrado showed how one sentence in a GitHub issue led to an unauthorized release, and left CISOs with four questions about AI coding agents.
8 min read
OWASP Agentic AI Top 10

OWASP Agentic AI Top 10 Explained: ASI01–ASI10

The OWASP Agentic AI Top 10 names the ten ways AI agents fail. Here is what ASI01 to ASI10 actually mean in a real pipeline, where each risk gets in, and which ones you can stop before deploy.
11 min read
Model Extraction Attack

Model Extraction Attack: Why Inventory Comes First

A model extraction attack lets an attacker copy your model one query at a time, with no breach and no stolen file. Here is how model stealing works, and why the first defense is knowing every inference endpoint you expose.
8 min read
Agentic AI risk and blast radius

Agentic AI risk and blast radius: limit the agent, or recover faster?

Constrain the agent, recover faster, or contain it from below? Three practitioners, three answers, and one minimum they all agreed on.
13 min read
npm Supply Chain Security

npm Supply Chain Security: your vulnerability scanner is looking for the wrong thing

Your npm vulnerability scanner checks for known flaws. Malicious packages have none. Here's what npm supply chain security needs in 2026.
6 min read
Agent harness engineering

Agent harness engineering: the model isn’t the attack surface, the harness is

Agent harness engineering turns models into useful agents. It also hands attackers a new target: the files that tell your agent what it can do.
7 min read
NIST risk management framework

NIST Risk Management Framework: Where Your AppSec Program Fits In

The NIST risk management framework is a process, not a checklist. Where AppSec fits in it, which NIST frameworks plug in, and how to feed it evidence.
6 min read
OWASP ASVS

OWASP ASVS: How to Benchmark Your AppSec Program Against It

OWASP ASVS turns 18. How teams really use it, where adoption breaks, and how to benchmark your AppSec program against it, level by level.
7 min read
Privilege Escalation Vulnerability

Privilege Escalation Vulnerability in CI/CD pipelines

A privilege escalation vulnerability in CI/CD pipelines needs no exploit. How attackers abuse tokens, triggers, and containers, and how to close each path.
10 min read
AI Application Security

AI Application Security: What we heard at OWASP Porto & Karlsruhe

AI application security dominated OWASP Porto and Karlsruhe. What ASPM really is, how it differs from SAST, and where AI triage and remediation help.
8 min read
AI risk management

AI risk management: two disciplines, one inventory

Four search terms, two completely different jobs. Managing the risk of AI is not the same discipline as using AI for risk management, and most organisations are staffing one while being sold the other. The interesting part is what happens when you realise they are the same programme.
9 min read
AI Risk Metrics

AI Risk: The Metrics That Tell You Whether Your Agentic AI Strategy Is Working

Every board now asks the same question: what is our AI risk? Most teams answer with adjectives. Here are the AI risk metrics that produce a number, where each one comes from, and what an agentic AI strategy has to cover before any of them mean anything.
9 min read
Load More