Prompt injection is now OWASP’s top LLM risk with reported success rates of 50–84%. Organisations are shipping agents into production well ahead of their controls.
Regulation (EU) 2026/1744 pushed Annex III high-risk obligations to December 2027, but Article 12 logging, Article 14 oversight and Article 15 hardening are engineering work you cannot start late.
Gravitee says 88% of organisations had a confirmed or suspected AI agent incident, while 82% of executives trust their policy. Both figures, one population.