AI swarms turn low-yield attack paths into enterprise risk

At a glance

What this is: Cogent maps how AI swarms can exploit attack paths that human teams usually ignore, showing that machine-viable routes now outnumber human-viable ones by three to one.

Why it matters: This matters because IAM, cloud, endpoint, and security teams have to prioritise path-based exposure, not isolated findings, when automated attackers can traverse low-yield chains that human operators would abandon.

By the numbers:

• The average enterprise gained 45 new attack paths to crown jewel assets in August 2026.
• 34 of those paths were viable only for AI agents, while 11 were viable for human attackers.
• Machine-viable paths were 386% more common year over year, rising from 7 to 34 per month.

Context

Attack paths are the chains of weaknesses that let an attacker move from initial exposure to a crown jewel asset. The problem in this research is not the existence of individual vulnerabilities, but the way many small findings join into routes that become practical only when an attacker can keep working without tiring or reprioritising.

Cogent's analysis frames a governance gap that most remediation models miss: organisations still score findings one by one, while AI swarms can exploit the path those findings create. That makes exposure a graph problem, not a ticket queue problem, and it puts identity, cloud and endpoint controls into the same attack surface. attack paths

Key questions

Q: What breaks when security teams keep using severity-first remediation against AI attack paths?

A: Severity-first remediation breaks when individual findings look tolerable but form a route that an automated attacker can chain together. The control failure is not lack of alerts, but lack of path context. Teams end up fixing isolated issues while leaving a traversable sequence intact, which is exactly the condition AI swarms can exploit.

Q: Why do AI swarms make low-severity findings more dangerous?

A: AI swarms can persist through low-yield steps, repeat attempts in parallel, and continue long after a human operator would stop. That makes weak configurations, modest vulnerabilities, and stale entitlements dangerous when they combine into a path. The risk lies in the chain, not any single issue.

Q: What are the signs that an attack path is becoming machine-viable?

A: Look for long routes, multiple trust-boundary crossings, and paths that connect identity, cloud, endpoint, and network findings. If a route remains open for more than 30 days, is assembled from low and medium severity issues, or requires several tools to see end to end, it is already behaving like machine-viable exposure.

Q: How should teams reduce crown-jewel exposure when paths span several security tools?

A: Build a shared path model that joins scanner, EDR, identity, and cloud data, then remove the chokepoints that make the route traversable. The right question is not which console owns the issue, but whether the route to the asset still exists after remediation.

Technical breakdown

Why machine-viable attack paths are deeper than human attack paths

Machine-viable attack paths are not defined by exotic techniques. They are defined by economics: continuous operation, parallel attempts, and tolerance for low per-step yield. A human intrusion team usually stops when a line of attack produces little value or raises too much detection risk. An AI swarm can keep going through repeated actions, more hops, and more trust-boundary crossings until a path becomes useful. That is why depth matters. The relevant unit is not a single weakness, but the sequence of asset hops, privilege changes, and boundary crossings that creates access to a crown jewel.

Practical implication: Measure exposure by path depth and trust-boundary crossings, not by severity alone.

How low-severity findings become critical when chained together

A low or medium severity issue is often rational to defer in isolation. The research shows that machine-viable paths commonly combine exactly those findings into an exploitable route. That changes the meaning of remediation thresholds: a weak configuration, a stale entitlement, and a moderate vulnerability can form a critical path even when no single item justifies urgent action. This is especially relevant where identity conditions, cloud permissions, and endpoint weaknesses sit in separate queues. The path exists before any one owner sees a problem worth escalating. See the AI Agent Authorisation Guide.

Practical implication: Review combinations of findings across queues, because individually defensible deferrals can still create exploitable routes.

Why cross-domain joins matter in path analysis

The research found that most critical paths span more domains than any single tool observes. That is a correlation problem, not just a detection problem. Endpoint, identity, network, and cloud findings may all be present, but without a shared graph they remain disconnected signals. Attackers do not need one platform to own the whole chain. Defenders do. Path analysis therefore depends on joining telemetry, identities, entitlements, and configuration state into one view of traversability, so that the security team can see where a route starts, crosses, and ends.

Practical implication: Correlate identity, cloud, endpoint, and network data before deciding whether a finding is truly isolated.

Threat narrative

Attacker objective: Reach crown jewel assets through low-yield but persistent attack paths that automated agents can exploit at scale.

1. Entry occurs through newly formed weaknesses in cloud, endpoint, identity, or application layers that are individually low risk but chainable.
2. Escalation follows when the attacker uses repeated actions and parallel attempts to cross trust boundaries, gain privileges, and reach higher-value systems.
3. Impact arrives when a machine-viable path reaches a crown jewel asset that human teams would likely have stopped short of pursuing.

Breaches seen in the wild

• CoPhish OAuth phishing via Copilot Studio: Datadog showed Copilot Studio agents on a Microsoft domain can front OAuth consent phishing and forward stolen tokens; no victims reported.
• AI agent retail card theft campaign 2026: AI agents breached 27+ retailers for about $25 each, used cloud keys and a Secrets Manager dump, and stole 600,000+ payment cards.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

AI swarms change the economics of attack path risk: the decisive issue is no longer whether a route looks attractive to a human intruder, but whether an automated adversary can keep traversing it until the yield becomes worthwhile. That shifts governance from detective urgency to structural exposure reduction. Security teams should treat low-yield paths as live risk when they are machine-traversable.

Attack-path governance is now an identity problem as much as a vulnerability problem: the research explicitly ties machine-viable paths to identity conditions, cloud permissions, and trust-boundary crossings. That means access scope, entitlements, and delegated privileges can no longer sit outside path analysis. AI agent authorisation becomes a practical lens for any programme trying to stop automated traversal before it reaches crown jewels.

Severity-first remediation creates a blind spot for agentic attackers: the article shows that many machine-viable paths are assembled from issues below normal SLA thresholds. This is the governance failure mode, not a tooling gap. When teams score findings in isolation, they preserve routes that an AI swarm can chain into compromise.

Path-based exposure is the right named concept here: the real control objective is to understand how separate findings combine into a traversable route, then remove the route rather than debating the worth of each component in isolation. This aligns security ownership across cloud, identity, and endpoint teams and gives practitioners a defensible way to prioritise what to break first.

Machine-viable depth should reset what 'material risk' means: a path that is too deep, too distributed, or too low-yield for a person may still be trivial for a swarm. That makes risk appetite statements incomplete unless they account for automated persistence and parallelism. The practitioner conclusion is simple: if a route is machine-traversable, it is already in scope.

From our research library:

• 19% of organisations give AI systems dramatically more access than human employees, nearly one in five granting unrestricted privilege, according to the 2026 Infrastructure Identity Survey.
• Systems with least-privileged AI access had a 17% incident rate vs 76% for over-privileged systems. Organisations failing to scope AI access properly are 4.5x more likely to experience a security incident, according to the 2026 Infrastructure Identity Survey.
• Read next: Identity Attack Paths Guide

What this signals

Path-based exposure is becoming the more useful governance unit: when automated attackers can keep moving after a human would have stopped, the question is not whether a finding is low severity, but whether it participates in a route to a crown jewel. That shifts programme design toward graph-based prioritisation and away from isolated ticket handling.

The most practical response is to treat identity conditions, cloud misconfigurations, and endpoint weaknesses as components of a shared exposure graph. If the programme cannot answer which routes remain traversable after remediation, then it has not actually reduced attack surface.

AI-driven traversal also changes how boards should interpret remediation progress. According to the 2026 Infrastructure Identity Survey, 70% of organisations grant AI systems more access than they would give a human employee performing the exact same job, which is the kind of access asymmetry that makes path analysis more urgent.

For practitioners

• Prioritise attack-path remediation over severity queues Rank findings by the crown-jewel paths they create, not just by CVSS or individual ticket urgency. Focus first on routes with multiple hops, repeated low-yield steps, and trust-boundary crossings.
• Join identity and infrastructure telemetry into one path view Correlate cloud, endpoint, identity, and network findings so that entitlement changes, misconfigurations, and vulnerabilities can be evaluated as one traversable graph.
• Reassess identity conditions that no SLA currently covers Look for stale access, overbroad permissions, and other identity states that remain open because they are individually low severity but path-enabling in combination.
• Test for machine-traversable routes with parallelised simulations Use controlled exercises that mimic persistent, coordinated automation rather than single-operator intrusion logic, then measure whether the environment resists repeated attempts across domains.

Key takeaways

• AI swarms exploit the connective tissue between findings, so the primary risk is a traversable path to a crown jewel rather than any single weakness in isolation.
• Cogent's research found 45 new attack paths per average enterprise in August 2026, with 34 viable only for AI agents, showing that machine-traversable exposure is already outpacing human-viable risk.
• The most defensible control response is to prioritise path removal across identity, cloud, and endpoint data rather than relying on severity queues alone.

Related NHI Mgmt Group resources: Identity Attack Paths Guide · AI Agent Authorisation Guide · Agentic AI Identity Guide · AI Agent Observability, Audit and Incident Response Guide

Key terms

• Machine-Viable Attack Path: A machine-viable attack path is a route through an environment that is difficult or uneconomical for a human intruder but still practical for automated attackers. It usually combines many small weaknesses into a deeper chain that can be traversed repeatedly and in parallel until a crown jewel asset is reached.
• Human Horizon: The human horizon is the set of practical limits that usually stop a person-operated intrusion, such as limited time, detection pressure, and the need for immediate yield. When an attacker can ignore those constraints, routes that looked unimportant to defenders can become exploitable at machine speed.
• Trust-Boundary Crossing: A trust-boundary crossing is any move from one security zone, identity context, or administrative domain into another. Each crossing increases the complexity and risk of an attack path because it often requires new privileges, different controls, or a change in how the environment is monitored.
• Path-Based Exposure: Path-based exposure is the risk created when separate findings connect into a traversable route to valuable assets. It shifts attention away from isolated severities and toward whether the environment still contains an end-to-end path an attacker can actually use.

Deepen your knowledge

NHI Mgmt Group covers identity security, NHI governance, and agentic AI through independent research, practitioner guides, and the NHI Foundation Level course, the industry's only accredited NHI security programme. It is designed for practitioners who need to connect identity controls to broader security architecture and operational risk.