Sometimes your players will bring a character that is almost immune to the attacks of average NPCs and monsters. For example, in one game I played in, one player had a crane style using Magus that could hit truly ridiculous levels of AC. Even worse, this was before the crane style Errata/Nerf and he could negate an attack every round if an enemy got lucky and hit him. Likewise, I am currently playing a Stalker that forces attackers to roll their attacks twice and take the lower result for several rounds per day. Combined with a moderate AC this basically makes mooks pretty useless against me.
When my DM complained that my AC was obnoxious I set out to help him build a little toolbox for dealing with me. Fortunately, Pathfinder has many options for changing which defenses you attack. The goal here will be to provide options that are not so specific and contrived so that they feel like you are singling out one player, breaking the verisimilitude of the world, or adding too much work to running adventures.
Also, most of my advice will focus on low-level adventures since that is generally where I play.
Low-hanging fruit
Targeting Touch AC or CMD and using aid another it really straight forward so I am not really going to harp on that.
Area of effect attacks
If someone has a really high AC, you can stop trying to hit them and just attack in their general direction. Breath Weapons are really good for this, as creatures that have them generally bring a few uses and they still deal damage on a successful save. Of particular interest is the half-dragon template. Drop it on a useful animal, like a wolf, and you have a boss for young parties and a minion for higher level NPCs. Also check out the kobold feat draconic breath. With it you can add a CR 1 kobold warrior that brings a toughish body and a 2d6 breath weapon.
Another useful source of damage is death-throes style of abilities. Basically, some monsters explode when they die. The poster child for this ability is the exploding skeleton they are the same CR as regular skeletons but when they die they deal 1d6 damage in a 10 ft radius. Sure the save DC is laughable, but they still deal half damage even on a successful save. It does not give a damage type, but I assume that the explosion is not bludgeoning, so all your skeletons should not chain-react when one dies. When you mix these skeletons in with stronger threats, they can provide flanking bonuses and aid-another attacks for their master until they die and deliver their final 1 to 3 damage.
It does not really talk about how to make other skeletons exploding on the SRD, but I think it is reasonable to have the damage and DC scale with hit dice.
The MVP for low-CR area of affect attacks has to be the Robot Arachnid. Weighing in at 1/2 CR, the little guys has a cone attack for harassing foes, a climb speed to stay out of range, and it explodes when the PCs catch it. If your campaign does not have robots, you can reflavor the arachnid to be an aetheric construct.
Finally, for those that have no access to dragons, exploding minions or the like, there is always alchemists fire or acid flask. Even if you miss touch ac, the splash damage is always something. Never underestimate 8 kobolds (that’s CR 4) that are all dealing 1 damage every turn to two or more players.
But my players have evasion
Evasion limits the utility of many simpler area of effect attacks. You would need to focus on more unavoidable sources of damage. In this, like in all things, the undead have your back. Burning skeletons deal 1d6 fire damage to everyone near them, no questions asked. They explode too!
You can also diversify what save you target. Inhaled poisons can be pretty useful, consider Confabulation Powder. Staggering someone for a minute for 80gp is pretty good. Also take a look at the fungle creature template. Its spore cloud creates a deadly constitution damaging cloud for a minute.
Attacking Flat-Footed AC
Flatfooted AC is pretty hard to boost while also raising touch ac. Usually somethings gotta give. And the best way to attack flat-footed AC is to be invisible. For this we will turn to the fey. Consider the humble tooth fairy (it explodes too.) It can approach a hapless traveler undetected under invisibility, or just under its frankly absurd +19 stealth modifier. In the surprise round it can tear out a tooth. With a +7 modifier against flat-footed CMD it will likely succeed. Next round, with its prize in-hand, it can fly away at 60ft per round cackling madly. Bonus points if this happens while the PCs are fighting something else. Extra bonus points if the same little critter does this multiple times.
And if they do catch the little fairy, it will probably be pretty cathartic. Just, for the love of Sarenrae, don’t force the PCs to buy a regeneration effect to grow new teeth in. A lesser restoration should be sufficient to restore the teeth. No one wants to play a toothless hero.
If you are willing to go a little farther afield, you can dip into Dreamscarred Press’ path of war for maneuvers that target flat-footed AC. You can give a level 3 warrior Martial Training and Dimensional Strike.
But my players have uncanny dodge!
Uncanny dodge is pretty cool. If you can’t flat-foot them, try a different approach.
When all else fails, use spellcasters
Adding NPC spellcasters is a good way to spice up combat. Just remember that a spellcaster can be good minion material. Take a level 1 Cleric for example. He costs 1/2 CR and brings a nice area damaging ability that targets will saves. Throw in the shatter resolve feat for a useful debuff.
A level 1 sorcerer or wizard brings the humble magic missile to the table. And magic missile says “you take 1d4+1 damage.” No fuss no muss. Grease is pretty deadly if you cast it on a character’s weapon. And most bad-guys would be happy to have a minion that could cast protection from good or bless on them.
A level of alchemist on an npc not only adds bombs but makes it so that the alchemist’s fire he throws has a minimum damage of 3 or more.
Putting it all together
Dragon-mooks
Say you are running Crown of the Kobold King and you decide that the kobolds are wimpy and that the PCs will have too easy a time of it. With reasonably little effort, you can change some of the warriors to have the draconic breath feat and give the kobolds a stockpile of acid or alchemist’s fire in the main chamber. The warriors will give low-level PCs pause with their breath weapon and once the alarm is raised the rank and file can rush to pick-up their grenades. Maybe have little stockpiles of splash weapons throughout the warren to foreshadow this.
The undead just want a hug
I want to run an epic confrontation with a necromancer cleric. The cleric is level 5 and has a level 1 apprentice and a couple of zombies. Except, the necromancer has set up in a large room when he is performing a profane rite, and the ground is littered with bodies and skeletal remains. Perceptive characters may notice that many of the bodies have onyx in their eye sockets and mouths, and that the whole area has had desecrate cast on it. When the characters rush to engage the necromancer, he will cast Animate Dead to raise up 10 exploding or flaming skeletons. The apprentice will give his master buffs, channel energy to harm and then join the the zombies in being a speed-bump to buy the necromancer time.
In combat the skeletons will focus on low AC characters or they will use aid-another to build up the attack of one of their number.
Since the animated skeletons and zombies are created by the necromancer’s spells, they are included in his CR and don’t raise the CR of the encounter. However, this degree of preparation is probably worth a bump of a CR or two.
Parting thoughts
The main thing to keep in mind is that you are not trying to “win” at Pathfinder. You don’t want to turn the game into who can build the correct resistance. You should mix these techniques in with more mundane threats to keep your players on their toes and to keep things fresh.
Also be careful of pulling out all the stops if your campaign has been mostly straightforward melee attacks and stock monsters. Changing up expectations too quickly is a good way of having all your PCs dead and your players feeling like you pulled a “Rocks fall. Everyone dies.”