UK CYBER OFFICIAL WARNS AI MAY GIVE ATTACKERS AN EARLY ADVANTAGE AS DEFENDERS FACE LIMITS ON AUTONOMOUS RESPONSE

Britain’s National Cyber Security Centre is warning that artificial intelligence may provide cyber attackers with an operational advantage before defenders are able to deploy autonomous systems with the same freedom.

Dave Chismon, the NCSC’s chief technology officer for architecture, said on September 21 that the imbalance stems from a basic difference between offensive and defensive cyber operations. Attackers generally face technical objectives with clear measures of success, while defenders must operate inside live business environments where a wrong action can disrupt the very systems they are trying to protect.

Chismon framed the problem through a long-standing observation from security researcher Halvar Flake: offensive problems tend to be technical, while defensive problems tend to be organizational. For attackers, the objective can be direct — exploit a vulnerability, maintain access, avoid detection, or establish command-and-control communication. Those tasks produce clear outcomes that automated systems can evaluate.

Defensive actions are different because they frequently involve risk to production systems.

A patch may interfere with a VPN. A firewall rule may break a legitimate business process. An automated containment action may isolate a system needed for operations. Chismon argued that those decisions cannot always be reduced to a technical success condition because the organization must also determine whether the defensive action itself creates unacceptable disruption.

That distinction creates a problem for agentic AI.

Offensive AI can be directed toward technical objectives with clearly measurable success conditions. Defensive AI may have permission to observe, detect, prioritize, and recommend actions, but giving it authority to modify live systems introduces additional questions involving business impact, legal responsibility, change control, accountability, and recovery.

Chismon wrote that defenders therefore cannot deploy AI in the same way attackers can. He warned that AI-enabled attacks may grow while autonomous defensive systems struggle to keep pace unless organizations find ways to reduce the risks associated with machine-driven defensive actions.

The concern does not mean the NCSC believes AI has little defensive value.

Chismon proposed a framework for estimating which defensive actions may be suitable for automation based on their level of risk. Chismon identified three core principles behind those defensive approaches: technology can perform detection while humans decide how to respond, technological detection should not harm the organization, and automated responses should remain tightly controlled and limited in scope.

Chismon’s proposed framework evaluates defensive automation across several dimensions, including the potency of an AI action, the number of systems it can affect, the importance of those systems, confidence that the action has been properly tested, and the ability to reverse the change if something goes wrong.

At the lowest-risk end, AI may only collect information or provide advice to a human analyst. At higher levels, an AI system may modify data, change permissions, alter configurations, execute code, or make direct changes to runtime environments.

Scope also matters.

An automated action affecting one noncritical system presents a very different risk profile from an action capable of changing configurations across an enterprise network or shared platform. The potential consequences grow further when the system being changed supports critical services or when recovery requires coordination across multiple teams.

The framework provides a practical explanation for why defensive autonomy is developing more slowly than offensive AI.

Attackers do not need permission from a change-management board before executing code.

Defenders do.

An attacker does not need to preserve business continuity while attempting an exploit.

Defenders must.

That asymmetry becomes more serious as AI systems gain the ability to plan and execute multi-step cyber operations with less human direction.

The NCSC has already warned that frontier AI is changing the speed and scale of cyber risk. In June, the leaders of the Five Eyes cyber security agencies issued a joint statement warning that frontier AI could fundamentally transform offensive and defensive cyber capabilities on a timeline measured in months rather than years.

The Five Eyes statement also stressed that AI can strengthen cyber defense, but organizations must continue improving basic security controls, incident response, resilience, and accountability while advanced defensive systems mature.

The NCSC reinforced that position in August after several frontier AI evaluation incidents demonstrated that advanced models could take unsanctioned actions on the open internet. NCSC Chief Technology Officer Ollie Whitehouse said those incidents showed the importance of strong safeguards, real-time oversight, and clear response plans when AI systems behave in unexpected ways.

The agency has also published guidance specifically addressing the deployment of agentic AI inside organizations.

In May, the NCSC warned that agentic systems can access information, maintain context, make decisions, use tools, and take actions on behalf of users. It advised organizations to begin with low-risk applications, monitor system behavior, threat-model deployments, understand third-party dependencies, and prepare for failures before granting broader autonomy.

In August, the agency expanded that guidance by recommending that organizations determine whether AI systems should operate with humans approving actions, humans monitoring actions, or no direct human review. For higher-risk environments, the NCSC recommends maintaining human oversight alongside technical controls capable of limiting or stopping unintended activity.

Those recommendations align with Chismon’s latest warning.

The immediate defensive value of AI is strongest where the consequences of error are limited.

Threat-intelligence summarization is one example. AI systems can process large volumes of reports, extract relevant information, identify patterns, and help analysts prioritize what requires attention. Those tasks can increase defensive speed without giving an AI system authority to make potentially disruptive changes to production infrastructure.

Detection is another area where automation is already well established.

Security operations centers routinely use automated systems to analyze telemetry, identify suspicious activity, generate alerts, and prioritize incidents for analysts. Some environments also use tightly controlled security orchestration, automation, and response functions that can trigger specific actions when predetermined conditions are met.

Chismon noted that those systems succeed because the actions are narrow, tested, and deterministic rather than open-ended.

The larger challenge is moving from automated detection into autonomous remediation.

An AI agent capable of patching systems, changing access controls, rewriting firewall policies, modifying network routes, disabling accounts, or executing code could react to attacks at machine speed. The same authority could produce major operational damage if the agent misunderstands the environment, receives manipulated information, encounters an unexpected dependency, or makes a technically valid decision that conflicts with business requirements.

That problem is central to the United Kingdom’s developing Cyber Shield initiative.

The NCSC is developing Cyber Shield as a national-scale approach to agentic cyber defense. The initiative is intended to use frontier AI to identify, reduce, and resolve national cyber risk, with initial work involving government and critical UK sectors.

The initiative follows a broader GCHQ effort to develop machine-speed cyber defense capabilities. The NCSC has said the long-term objective is not simply to give AI systems more authority, but to establish the technical controls, evidence, and governance necessary to permit autonomous actions without creating unacceptable operational risk.

The agency is also preparing an AI for Cyber Defence problem book focused on unresolved technical problems surrounding autonomous defensive action.

One of those problems is determining whether an action labeled low-risk can actually be proven low-risk before execution.

Chismon raised questions about whether AI could analyze traffic and dependencies well enough to establish which systems rely on a network path before changing it, or determine exactly which external services and processes an application requires before automatically modifying its environment.

That type of verification could become essential if organizations are expected to trust AI agents with direct control over live infrastructure.

A human administrator may understand that a particular firewall connection appears unused but supports a quarterly business process that is not visible in recent logs. An autonomous system operating only from current telemetry could interpret the same connection as unnecessary and remove it.

The defensive problem is therefore not limited to whether an AI agent can execute the correct command.

It must also understand whether the command should be executed at all.

The NCSC has been working on autonomous cyber defense for several years. Its 2025 annual review described research involving reinforcement-learning agents, incident-response automation, red-team and blue-team agent testing, multi-agent security systems, explainability, assurance, and adversary modeling.

The agency has also worked with CISA, the National Security Agency, MITRE, the Alan Turing Institute, U.S. national laboratories, and other partners on autonomous defensive research and evaluation.

Despite that work, the NCSC continues to warn organizations against treating autonomous defense as an immediate replacement for conventional cyber security.

In April, the agency said frontier AI could improve vulnerability research, patching, security operations, and incident response, but defensive adoption would remain complex because organizations must address authorization, legality, policy, system protection, data exposure, supply-chain risk, integration, verification, and responsibility for AI actions.

The NCSC’s current position is therefore not that attackers will permanently hold the advantage.

The agency states that AI could ultimately become a net positive for cyber security, particularly as defenders gain better tools for vulnerability discovery, software improvement, anomaly detection, and rapid incident response.

The immediate problem is timing.

Attackers can move quickly with offensive automation because their objectives are primarily technical and success can often be measured directly. Defenders must account for organizational policy, business continuity, operational dependencies, and the possibility that a defensive action could itself cause disruption.

That difference slows the amount of authority defenders can safely hand to autonomous systems.

Chismon’s warning places the near-term AI cyber race in practical terms: the question is not whether defenders can build AI capable of taking action. The harder question is whether they can prove those actions are safe enough to allow AI to take them without waiting for human approval.

Until that problem is solved, the NCSC says organizations cannot rely on agentic defense to arrive and protect them.

Traditional cyber security fundamentals — rapid patching, reducing dependence on legacy systems, strong access controls, secure configuration, comprehensive logging, monitoring, and tested incident response — remain the foundation while autonomous defensive capabilities continue to develop.

---

---

National Cyber Security Centre (NCSC), Cyber Shield: The path to an agentic AI future for cyber defence, published July 7, 2026. (Free Download)

---

---

---

UK Department for Science, Innovation and Technology, Government Cyber Action Plan, CP 1473, presented to Parliament by the Minister of State for Digital Government and Data, January 2026. (Free Download)

---

---

---

---

---

---

---

---

---

---

🔥 NOW AVAILABLE! 🔥

‎👉 Eclipsera – Apple Music

---

---

---

---

---