In this ROCon 2025 session, Asma Zubair, Director of Product Management at Qualys, explores how enterprises can safely embrace the promise of Generative and Agentic AI without becoming the next security headline. Zubair breaks down the expanding AI attack surface — from data collection and model training to deployment, memory, and user interaction — revealing how vulnerabilities can arise at every stage of the AI lifecycle. She shares real-world incidents where AI agents went rogue, models leaked sensitive data, and supply chain components were exploited, underscoring the urgent need for AI risk governance. This session introduces Qualys TotalAI, a groundbreaking extension of the Risk Operations Center (ROC) framework designed to unify visibility, testing, and compliance across AI systems. Built on existing Qualys sensors and TruRisk analytics, TotalAI enables teams to: •Discover AI workloads, models, and MCP servers across hybrid environments •Assess vulnerabilities like prompt injection, data poisoning, model hijacking, and insecure output •Test for bias, hallucinations, and unsafe behavior across 16+ categories •Map findings to frameworks such as OWASP Top 10 for LLMs and MITRE ATLAS •Generate audit-ready reports to communicate AI risk and compliance posture to executives Zubair concludes with a live demo showing how Qualys TotalAI detects model vulnerabilities, tests for jailbreak resilience, and delivers actionable reporting — empowering organizations to harness AI innovation while eliminating the risk. Recorded live at ROCon 2025 – The Risk Operations Conference, presented by Qualys.

 123      1