Beyond the standard refusal benchmarks, we needed evals for our actual risk surface — PII leakage in our domain, hallucinating policy details, jailbreaks via multi-turn conversations. Built a custom suite but coverage feels thin. What does your safety eval suite cover, and what attack did your standard benchmarks miss?