The UK Government’s national online security agency is to harness agentic AI to defend against autonomously generated cyber attacks targeting national infrastructure.
Experts at the National Cyber Security Centre are launching a ‘Cyber Shield’ to build national AI-powered defensive capabilities that can operate at ‘speed and scale’.
The initiative, developed jointly with the Department for Science, Innovation and Technology (DSIT), will use powerful ‘frontier AI’ capabilities on a national basis to identify and respond to cyber risks across the UK.
“Attacks from hostile states, organised crime and others are increasingly disrupting services, harming businesses and exposing sensitive data,” the NCSC said in a blog post.
It follows a warning from GCHQ boss Dame Anne Keast-Butler in May that AI algorithms are being “weaponised often just below the threshold of traditional warfare”.
The NCSC warns frontier AI is “accelerating” that trend, with the potential to shift the balance in favour of attackers – and with serious implications for defenders.
It thus sets out a ‘vision’ for how agentic AI could be used to defend against such threats. In future, cyber defence will be supported by AI agents, with ‘red’ agents used to find system weaknesses and ‘blue’ agents that defend against threats in real time, working at machine speed to spot vulnerabilities, detect and contain breaches, share insight, and fix problems automatically.
The agency points to the need to work collaboratively with partners including industry and academia to offer national-level, sovereign AI protections.
It will require six core capabilities, some of which need further research, including reliable, explainable AI that owners can trust to make safe real-time changes at scale, federated agents that operate under individual organisations’ control but co-operate through shared trust infrastructure to run national-level operations and automated red/blue-team discovery and mitigation of vulnerabilities, letting defenders operate beyond human scale on critical networks.
In addition, there is a requirement for coordinated detection and response through real-time insight-sharing across organisational boundaries, national-level scanning of critical UK network and web domain ranges to understand exposure, and national-scale automated mitigation, such as rapidly blocking known malicious domains.