Report by Cogent Security
Beyond the Human Horizon
Key Findings
Machine-viable path formation increased 386% year over year, while human-viable path formation increased 38% year over year.
64% of machine-viable attack paths span four or more distinct technique domains.
83% of machine-viable attack paths persist for more than 30 days.
55% of human-viable attack paths persist for more than 30 days.
7% of critical attack paths are created entirely by chaining low- and medium-severity vulnerabilities.
64% of attack paths cross security domains that no single tool can see.
In August 2026, the average enterprise picked up 45 new attack paths to crown-jewel assets, including 11 viable for human attackers and 34 viable only for AI agents.
Machine-viable attack paths run at least twice as deep as human-viable paths.
The median machine-viable attack path crosses eight assets compared with four assets for human-viable paths.
The median machine-viable attack path crosses five trust boundaries compared with two trust boundaries for human-viable paths.
The median machine-viable attack path spans five distinct technique domains.