Most organizations can tell you, within a reasonable margin, how many servers they run, which ones are exposed to the internet, and when they were last patched. Ask the same organization how many AI models and agents are running in production, what data each one can touch, which ones have had their system prompts changed in the last month, or whether any of them are currently vulnerable to prompt injection — and the answer, more often than not, is silence.