"10 hours" and "around two weeks" are not the same kind of number

An independent analysis of Palo Alto Networks Unit 42's September 2026 case study on an AI-assisted enterprise intrusion argues that widely cited figures such as "less than 10 hours" and "around two weeks" are not comparable measurements and do not support claims of a 30x AI-driven speedup. The review notes that Unit 42's public material lacks a same-conditions human-only baseline, team size, tooling details, or a calculation method, and that Figure 1 depicts a human actor setting objectives with agents executing rather than a fully autonomous intrusion. The analyst hypothesizes that AI's main effect may be lower coordination cost and handoff latency across parallel agent sessions rather than per-task speedup, and flags a Wayback Machine wording change on the page that its changelog does not explain.

In September 2026, Palo Alto Networks Unit 42 published a case involving an AI-assisted intrusion into an enterprise network. The article includes figures like "less than 10 hours," "more than 50 MITRE ATT&CK techniques," and "around two weeks" for what a human operator would normally need. It's tempting to divide those numbers and conclude "AI made this 30x faster." I don't think the source material supports that. "Less than 10 hours" is a reported duration of activity. "Around two weeks" is Unit 42's comparative assessment of what a human operator would typically require for impact of that scale. The public article doesn't include a same-conditions human-only comparison, team size, skill composition, tools used, or a detailed calculation method. So "AI turned two weeks into 10 hours" isn't a measured speedup ratio — it's two different types of numbers sitting next to each other. I checked the Wayback Machine capture from the publication date against the current version. Two things changed: The second change isn't explained in the page's own changelog. I can't establish when it happened or why — so I don't speculate. I just note that the wording changed. Two separate evidence paths exist: Both matter. Neither, alone or together, establishes that AI autonomously ran every stage of the intrusion. Unit 42's own Figure 1 shows a human actor setting objectives and making key decisions while agents execute — closer to human-directed / agent-executed than fully autonomous. Here's where I'll go beyond what Unit 42 states. The public material can't tell us how many times faster any single task became. But it does describe multiple agents, parallel LLM calls, and state handed off across sessions — which suggests a different question: Maybe the effect of AI-assisted intrusion isn't mainly per-task speedup. Maybe it's lower coordination cost and handoff latency when running multiple workstreams in parallel. If that's right, the interesting metrics aren't total elapsed time — they're things like: how many agents/sessions ran concurrently, how much independent tasks overlapped in time, how long from observation to next action, what share of time went to human-approval waits. This hypothesis also has a clear failure mode: if a detailed timeline showed activity was mostly sequential, with few concurrent agents and long approval waits, the parallelization story falls apart. I go through the source comparison, the evidence paths, and the full list of what remains unknown in more detail here: https://osiix.com/en/library/unit42-ai-assisted-intrusion.html https://osiix.com/en/library/unit42-ai-assisted-intrusion.html This article independently reviews public material and does not indicate any approval, supervision, or affiliation by Palo Alto Networks or Unit 42.