Unit 42's two-week figure is an estimate of what human operators would have needed for comparable work [2], and how much it tells a defender depends on what the two weeks counts. Read as continuous wall-clock time, fourteen days is 336 hours, and against an intrusion that finished inside ten, that is a compression of at least 34 to one [1]. Read as ten business days of eight hours, the same estimate is 80 hours and the multiple falls to about eight [2]. Both readings sit comfortably inside what was published, so the number is directional. It is not a coefficient to multiply an existing target by.
A skeptic would point out that the clearest statement about AI came from the attacker, during ransom negotiation, where sounding formidable is worth money [6]. The answer is partial: Unit 42 says it independently observed several indicators consistent with AI use during the investigation [5], and the technique set itself was largely familiar, with the difference being agents that read the result of one action and chose the next [3][4]. Sanchit Vir Gogia of Greyhound Research reads the evidence as a human-directed intrusion in which AI handled delegated tactical work [12]. The defensible claim is narrower than autonomy, and it is enough: the tactical middle of an intrusion now runs at machine pace under human direction.
That is why the operative question is authority rather than tooling. Sakshi Grover of IDC Asia Pacific put it as needing a new clock rather than a new threat model [14], and Jonathan Ong of Omdia argues playbooks should let providers automate containment without in-house approval where it is feasible [17], with the concrete example being a provider empowered to disable a compromised account and invalidate its live credentials [16]. The trade is uncomfortable in a specific way. A provider that disables a production identity at the wrong moment owns a self-inflicted outage, so contract language drifts conservative unless the customer prices the mistaken shutdown itself. Ong's mechanism for that pricing is unglamorous: responsibilities agreed in advance, then rehearsed in tabletop exercises [17].
The path in this incident also crossed boundaries that most entitlement reviews respect. Entry was through a public-facing API endpoint, after which a reconnaissance agent mapped internal microservices and other agents mined source-code repositories for credentials that opened a secrets-management system [7][8]. Grover's reading is that each platform may have had controls, and the relationships between them created the exploitable path [19]. Gogia calls this transitive authority, where a repository account with no cloud administrator rights can still alter a workflow that assumes a more powerful cloud role [20]. A review that stops at each platform's edge cannot see that.
Note what held. Existing branch protections blocked the attempt to plant backdoors in Terraform configurations [9][10]. That control knew nothing about agents; it was a policy on a merge, and it is the only defence in the published record with a demonstrated outcome. The account also carries no detection-to-containment interval for this victim and no service-level figures [21], so it cannot recalibrate anyone's target. It can only put the question of whether that target was ever set against an adversary moving at this speed. The credential inventory Grover asks for [15] and the pre-agreed containment authority are both finishable this quarter; the cross-system telemetry correlation Ong describes, tuned to an organisation's own baseline [18], is a multi-year engineering commitment, and doing the first two does not buy time on the third.
