In September 2026, Palo Alto Networks Unit 42 published a case involving
an AI-assisted intrusion into an enterprise network. The article includes
figures like "less than 10 hours," "more than 50 MITRE ATT&CK techniques,"
and "around two weeks" for what a human operator would normally need.
It's tempting to divide those numbers and conclude "AI made this 30x faster."
I don't think the source material supports that.
"Less than 10 hours" is a reported duration of activity.
"Around two weeks" is Unit 42's comparative assessment of what a human
operator would typically require for impact of that scale.
The public article doesn't include a same-conditions human-only comparison,
team size, skill composition, tools used, or a detailed calculation method.
So "AI turned two weeks into 10 hours" isn't a measured speedup ratio —
it's two different types of numbers sitting next to each other.
I checked the Wayback Machine capture from the publication date against
the current version. Two things changed:
The second change isn't explained in the page's own changelog. I can't
establish when it happened or why — so I don't speculate. I just note
that the wording changed.
Two separate evidence paths exist:
Both matter. Neither, alone or together, establishes that AI autonomously
ran every stage of the intrusion. Unit 42's own Figure 1 shows a human
actor setting objectives and making key decisions while agents execute —
closer to human-directed / agent-executed than fully autonomous.
Here's where I'll go beyond what Unit 42 states. The public material
can't tell us how many times faster any single task became. But it does
describe multiple agents, parallel LLM calls, and state handed off across
sessions — which suggests a different question:
Maybe the effect of AI-assisted intrusion isn't mainly per-task speedup.
Maybe it's lower coordination cost and handoff latency when running
multiple workstreams in parallel.
If that's right, the interesting metrics aren't total elapsed time — they're things like: how many agents/sessions ran concurrently, how much
independent tasks overlapped in time, how long from observation to next
action, what share of time went to human-approval waits.
This hypothesis also has a clear failure mode: if a detailed timeline
showed activity was mostly sequential, with few concurrent agents and
long approval waits, the parallelization story falls apart.
I go through the source comparison, the evidence paths, and the
full list of what remains unknown in more detail here:
https://osiix.com/en/library/unit42-ai-assisted-intrusion.html This article independently reviews public material and does not
indicate any approval, supervision, or affiliation by Palo Alto
Networks or Unit 42.