Xygeni

Secure your Software Development and Delivery.
#Cybersecurity #ASPM #OSS #DevSecOps #AppSec

[Xygeni @xygeni]

Thank you @cyberdefensemag! 🏆🏆

Xygeni wins 2 Top InfoSec Innovator Awards 2026: GenAI Agentic AppSec and Software Supply Chain Security.

Full story ➡️ https://t.co/cc459nHo2G

#AppSec #AgenticAI

[Xygeni @xygeni]

Happy Friday! ☕ Our CEO Jesús Cuadrado took the Hot Seat on @cyberdefensemag’s CyberDefense TV: securing code when AI agents write it and malware arrives before any signature. 🎥

Watch the short interview ➡️https://t.co/agiLgkEVLO

#AppSec #AgenticAI

[Xygeni @xygeni]

Four awards in 2026, one direction. 🏆 Two new Top InfoSec Innovator Awards from @CyberDefenseMag: Agentic AI Security and Software Supply Chain Security. From securing AI-generated code to securing the agents that write it: https://t.co/JuBaHuZKpr

#CDMAwards

[Xygeni @xygeni]

The problem wasn't detection. It was triage.
How @bancoserfinanza cut the time spent identifying, prioritizing and assigning security findings by around 90% with AI ➡️https://t.co/v1fthTw8YK

#AppSec #DevSecOps

[Xygeni @xygeni]

An LLM that says something wrong is a content problem. An agent that does something wrong is a security incident. 🤖 The OWASP Agentic AI Top 10, explained with real pipeline examples⬇️ https://t.co/2SisJjVhPW

#AgenticAI #OWASP

[Xygeni @xygeni]

Your AI model can be stolen without anyone touching your servers. 🕵️ Model extraction attacks clone it through its own API, and shadow AI endpoints have no rate limits. You can't protect endpoints you haven't inventoried ➡️ https://t.co/ArOgZbGtkU

#AISecurity #ShadowAI

[Xygeni @xygeni]

AI coding agents invent repo names 92.4% of the time for new projects, and repeat the same wrong ones. Attackers just register them and wait. Luis Rodríguez on what still protects the developer's laptop, in @cyberdefensemag 👇
https://t.co/GJaCGP8EE5

#AppSec #AgenticAI

[Xygeni @xygeni]

One malicious package, six new versions in two days. 🚨 pyyi returned on PyPI, five versions in 22 minutes. Blocking one version doesn't stop the package. 10 malicious npm and PyPI versions confirmed this week: https://t.co/phuHDt55aB

#SupplyChainSecurity #Malware #PyPI

[Xygeni @xygeni]

Three days at #20ENISE, great conversations at our stand 🧡

One question kept coming up: how do you secure software when AI is writing and shipping the code?

Thanks @INCIBE and everyone who stopped by!

#AppSec #Cybersecurity

[Xygeni @xygeni]

Happy Friday! An agent does its job, touches what nobody asked it to, never leaves its permissions. Three experts disagree on what to do.

https://t.co/TgdSv3klnL

#AgenticAI #AppSec

[Xygeni @xygeni]

Typosquatting waits for a human to mistype.
HalluSquatting waits for an AI to imagine.
For 2025 repos, agents invent the name 92.4% of the time. Attackers register those names first, and the agent runs what’s inside.

Dive in ➡️https://t.co/cRLRnxIjlk

#AppSec #AgenticAI

[Xygeni @xygeni]

Nothing was breached. The agent did its job, touched a service nobody asked it to touch, and never left its permissions. Nothing fired.

The question isn’t whether the agent fails. It’s how far the damage travels when it does.

https://t.co/3TTvWoHj7s

#AgenticAI #AppSec

[Xygeni @xygeni]

27 malicious package versions confirmed last week on npm and PyPI.

Ten shared one library name across six packages. Six landed on PyPI in a single minute.

Full list 👇
https://t.co/golrR8f7rh

#SupplyChainSecurity #npm

[Xygeni @xygeni]

In a CI/CD pipeline, the attacker doesn't need to escalate privileges. The pipeline already has them.

Broad tokens, pull_request_target, root containers: 6 escalation paths and how to close each one 👇

https://t.co/CmfWmWmBGs

#DevSecOps #GitHubActions

[Xygeni @xygeni]

Your app meets OWASP ASVS Level 2. Can you prove it?

There's no official certification, and ASVS 5.0 moved requirements between levels. Here's how to benchmark your AppSec program so the claim holds up 👇

https://t.co/7FY8bxJNpZ

#OWASP #AppSec

[Xygeni @xygeni]

Last call 🔴 AI wrote the fix. AI reviewed it. Did anyone prove it works?

Bright Security x Xygeni, live tomorrow, 18:00 UK 👇
https://t.co/iYAUcOw4hw

#AppSec #AISecurity

[Xygeni @xygeni]

Bogotá, ¡nos vemos la próxima semana! 🇨🇴

El viernes 23 estaremos en @DevopsdaysB con AdviceGroup LATAM.

¿Quién revisa el código que escribe su IA? 🤖 Vengan a conversarlo con Ana María Fernández de Xygeni ☕

#DevOpsDaysBogota

[Xygeni @xygeni]

An ATO can take 6 to 12 months and stay valid for 3 years. Your team deploys daily.

The NIST RMF already has the fix: continuous monitoring, fed by AppSec evidence.

Where your AppSec program fits 👇

https://t.co/pPNj27tIwB

#NIST #AppSec

[Xygeni @xygeni]

⏳ 2 weeks to #20ENISE!

Your AI writes code. We secure it. Come talk AI security, grab some swag and say hi at Booth 63 👋

📅 Oct 21-23 · León

Want a set time? 👉 https://t.co/VyGjB9o6TG

@INCIBE #AppSec

[Xygeni @xygeni]

Support ticket → retriever → system prompt → tool call.

Four hops, no guardrail. Find the path before an attacker does ⬇️
https://t.co/mIBuhskvuf

#PromptInjection #AISecurity