Cogent says enterprises add 34 AI viable attack paths a month

Cogent Security said in a press release that the average enterprise added 45 attack paths to critical assets in August 2026, including 34 classified as viable for AI agents and 11 viable for human attackers. The number of new machine viable paths increased 386% from a year earlier, while human viable paths increased 38%.

The median machine viable path crossed eight assets and five trust boundaries, compared with four assets and two boundaries for human viable paths. Cogent found that 83% of machine viable paths remained present for more than 30 days, while 55% of human viable paths persisted that long.

Seven percent of critical paths consisted entirely of linked vulnerabilities with low or medium severity ratings. Cogent also found that 64% of paths crossed areas such as endpoint systems, identity, networks and cloud infrastructure, with the median critical path requiring data from five security tools.

The study analyzed 43 million assets and 1.2 billion vulnerability, configuration and identity findings across more than 50 Fortune 1000 organizations. Cogent classified a path as machine viable when it exceeded at least one threshold based on path depth, yield at each step or the range of techniques required.