Xygeni Logo White
Start Free
Book a demo

Xygeni Blog

Must-Read Posts

AI security threats

Top 10 AI security threats and how to map them

Two things get filed under the same heading and they are not the same problem. Attacks on AI systems and attacks powered by AI need different controls, different owners and different evidence. Ten threats, split into the two halves, and the one step that precedes all of them.
10 min read
Software Development Security

Software Development Security: A Requirements Checklist With 12 Lines You Can Verify

Most software development security requirements describe a desired state, which means nobody can pass or fail them. Here are 12 written as checks, each with the artifact that proves it.
10 min read
AI Red Team Tools

AI Red Team Tools Test What Your Model Says. They Don’t Test What Your Agent Does Next

Uncover the details of The 24712-pl Campaign and the zero-dependency packages exploited during a security incident.
9 min read
npm Package Vulnerabilities

npm Package Vulnerabilities: How to Find and Fix Them Before They Ship

Uncover the details of The 24712-pl Campaign and the zero-dependency packages exploited during a security incident.
9 min read
AI Pentesting Tools

AI Pentesting Tools: What to Look For, and What Agentic Pentesting Actually Changes

AI pentesting tools are four different product shapes. What agentic pentesting changes, seven evaluation criteria, and what it cannot do.
8 min read
Malicious npm Packages

Malicious npm Packages: The Live List Nobody’s Watching Closely Enough

Malicious npm packages are published faster than registries remove them. What eight weeks of confirmed findings show & what stops them.
8 min read
What Is the Agentic SDLC

What Is the Agentic SDLC? How AI Agents Are Reshaping Every Phase

Agents now plan, code, review, ship and operate. What the agentic SDLC changes in every phase, and which controls quietly stop working.
9 min read
AI Pentesting

AI Pentesting: Testing AI Systems Like an Attacker Would

Your last pentest tested code. AI pentesting tests behaviour: hijacked prompts, abused tools, leaked data. What to test, and how often.
9 min read
The CWE Top 25

The CWE Top 25: What It Is and Why It’s Not the Same as the OWASP Top 10

One ranks weaknesses, the other ranks risks. What the CWE Top 25 measures, how it differs from OWASP Top 10, and when to use each.
10 min read
Agentic Coding

Agentic Coding: The Risks, the Best Practices, and 8 Lessons from Early Adopters

Agents now write, install and ship code. The real risks of agentic coding, the practices that contain them & 8 lessons learned the hard way.
10 min read
What Is AI Coding

What Is AI Coding? A Developer’s Guide to Working With, and Securing, AI-Generated Code

What is AI coding, how do AI tools work, and how do you keep AI-generated code secure? A practical guide for developers and teams.
10 min read
AI Governance Framework

Building an AI Governance Framework: A Practical Structure

A policy document alone isn't an AI governance framework. Here's the practical structure, inventory, evidence, and controls, that works.
10 min read
Load More