Cogent Security

In August 2026, the average enterprise picked up 45 new attack paths to crown-jewel assets, including 11 viable for human attackers and 34 viable only for AI agents.

64% of machine-viable attack paths span four or more distinct technique domains.

Machine-viable path formation increased 386% year over year, while human-viable path formation increased 38% year over year.

Median detection lag from vulnerability disclosure was 0.1 days for Tenable, 2.9 days for Qualys, and 5.1 days for Rapid7.

55.7% of critical CVEs never received scanner coverage at all.

62.0% of critical vulnerabilities with known exploits had a working exploit available before scanner detection signatures shipped.

83% of machine-viable attack paths persist for more than 30 days.

55% of human-viable attack paths persist for more than 30 days.

7% of critical attack paths are created entirely by chaining low- and medium-severity vulnerabilities.

Machine-viable attack paths run at least twice as deep as human-viable paths.

The median machine-viable attack path crosses five trust boundaries compared with two trust boundaries for human-viable paths.

The median machine-viable attack path spans five distinct technique domains.

64% of attack paths cross security domains that no single tool can see.

The median machine-viable attack path crosses eight assets compared with four assets for human-viable paths.

54.0% of CVEs published since January 2025 had no detection signature from Tenable, Qualys, or Rapid7.

AI-assisted exploit development compressed the average time from vulnerability disclosure to a working exploit from 125.3 days in January 2025 to 0.5 days by April 2026.

Exploits appeared before scanner detection for 62.5% of critical CVEs at Tenable, 64.5% at Qualys, and 73.5% at Rapid7.

44.3% of critical CVEs received scanner coverage.

83.2% of critical vulnerabilities either lacked scanner coverage entirely or had exploits appear before detection ships.