Ten Hours to Breach, Ninety Days to Noticing

14 September 2026 — There is a number in this week's reporting that should stop a small business owner mid-sentence: ten hours.

That is how long Unit 42 measured from initial access to full enterprise compromise in an intrusion conducted with AI agents, using more than fifty distinct attack techniques drawn from the standard adversarial playbook. A second group compromised thousands of credentials in six hours. A distributed agent swarm hit more than 440 PaperCut instances across 395 organisations concurrently.

For eighteen months, agentic security incidents were demonstrations — a researcher breaking a browser agent, a paper showing a tool chain misused in a lab. What landed in this reporting cycle is different in kind: autonomous systems attacking production environments, at speed, with measured dwell times that leave no room for weekly review meetings.

The regulatory clock is at 79 days to the December 2 Article 50(2) marking deadline, with the Digital Omnibus prohibitions arriving the same day. But the more uncomfortable finding is about measurement. Organisations report sustained breach rates around 88 to 89 percent, while the tooling to know whether controls actually work remains rare.

What this means if you run an SME. You do not need agents to be affected by them. PaperCut is print-management software; the 395 organisations hit did not all run AI. But if you do run agents, the blast radius is your own permission graph — every credential, every share, every integration they can reach.

Two questions worth answering this week. Which of your systems would an automated attacker find, and how quickly would you know? Most small businesses genuinely do not know the second answer, and that is the one that determines the cost.

Fifteenth in a weekly series on the developments that matter to small and mid-sized organisations.