{"slug": "10-hours-and-around-two-weeks-are-not-the-same-kind-of-number", "title": "\"10 hours\" and \"around two weeks\" are not the same kind of number", "summary": "An independent analysis of Palo Alto Networks Unit 42's September 2026 case study on an AI-assisted enterprise intrusion argues that widely cited figures such as \"less than 10 hours\" and \"around two weeks\" are not comparable measurements and do not support claims of a 30x AI-driven speedup. The review notes that Unit 42's public material lacks a same-conditions human-only baseline, team size, tooling details, or a calculation method, and that Figure 1 depicts a human actor setting objectives with agents executing rather than a fully autonomous intrusion. The analyst hypothesizes that AI's main effect may be lower coordination cost and handoff latency across parallel agent sessions rather than per-task speedup, and flags a Wayback Machine wording change on the page that its changelog does not explain.", "body_md": "In September 2026, Palo Alto Networks Unit 42 published a case involving\n\nan AI-assisted intrusion into an enterprise network. The article includes\n\nfigures like \"less than 10 hours,\" \"more than 50 MITRE ATT&CK techniques,\"\n\nand \"around two weeks\" for what a human operator would normally need.\n\nIt's tempting to divide those numbers and conclude \"AI made this 30x faster.\"\n\nI don't think the source material supports that.\n\n\"Less than 10 hours\" is a reported duration of activity.\n\n\"Around two weeks\" is Unit 42's comparative assessment of what a human\n\noperator would typically require for impact of that scale.\n\nThe public article doesn't include a same-conditions human-only comparison,\n\nteam size, skill composition, tools used, or a detailed calculation method.\n\nSo \"AI turned two weeks into 10 hours\" isn't a measured speedup ratio —\n\nit's two different types of numbers sitting next to each other.\n\nI checked the Wayback Machine capture from the publication date against\n\nthe current version. Two things changed:\n\nThe second change isn't explained in the page's own changelog. I can't\n\nestablish when it happened or why — so I don't speculate. I just note\n\nthat the wording changed.\n\nTwo separate evidence paths exist:\n\nBoth matter. Neither, alone or together, establishes that AI autonomously\n\nran every stage of the intrusion. Unit 42's own Figure 1 shows a human\n\nactor setting objectives and making key decisions while agents execute —\n\ncloser to human-directed / agent-executed than fully autonomous.\n\nHere's where I'll go beyond what Unit 42 states. The public material\n\ncan't tell us how many times faster any single task became. But it does\n\ndescribe multiple agents, parallel LLM calls, and state handed off across\n\nsessions — which suggests a different question:\n\nMaybe the effect of AI-assisted intrusion isn't mainly per-task speedup.\n\nMaybe it's lower coordination cost and handoff latency when running\n\nmultiple workstreams in parallel.\n\nIf that's right, the interesting metrics aren't total elapsed time —\n\nthey're things like: how many agents/sessions ran concurrently, how much\n\nindependent tasks overlapped in time, how long from observation to next\n\naction, what share of time went to human-approval waits.\n\nThis hypothesis also has a clear failure mode: if a detailed timeline\n\nshowed activity was mostly sequential, with few concurrent agents and\n\nlong approval waits, the parallelization story falls apart.\n\nI go through the source comparison, the evidence paths, and the\n\nfull list of what remains unknown in more detail here:\n\n[https://osiix.com/en/library/unit42-ai-assisted-intrusion.html](https://osiix.com/en/library/unit42-ai-assisted-intrusion.html)\n\nThis article independently reviews public material and does not\n\nindicate any approval, supervision, or affiliation by Palo Alto\n\nNetworks or Unit 42.", "url": "https://wpnews.pro/news/10-hours-and-around-two-weeks-are-not-the-same-kind-of-number", "canonical_source": "https://dev.to/mars70s/10-hours-and-around-two-weeks-are-not-the-same-kind-of-number-5123", "published_at": "2026-09-20 16:44:27+00:00", "updated_at": "2026-09-20 17:24:38.831564+00:00", "lang": "en", "topics": ["ai-safety", "ai-agents", "artificial-intelligence"], "entities": ["Palo Alto Networks", "Unit 42", "MITRE ATT&CK", "Wayback Machine"], "alternates": {"html": "https://wpnews.pro/news/10-hours-and-around-two-weeks-are-not-the-same-kind-of-number", "markdown": "https://wpnews.pro/news/10-hours-and-around-two-weeks-are-not-the-same-kind-of-number.md", "text": "https://wpnews.pro/news/10-hours-and-around-two-weeks-are-not-the-same-kind-of-number.txt", "jsonld": "https://wpnews.pro/news/10-hours-and-around-two-weeks-are-not-the-same-kind-of-number.jsonld"}}