Cyber attackers are gaining an advantage from artificial intelligence that defenders cannot yet match, according to a senior official at the UK’s National Cyber Security Centre (NCSC). Dave Chismon, the NCSC’s chief technology officer for architecture, warned that AI-enabled cyber attacks could grow as organisations struggle to use automated systems for defensive actions without putting their own operations at risk.
The problem is not simply whether AI can perform a cybersecurity task. For defenders, an automated action can affect live systems, business operations and critical services. That means security teams have to consider what could go wrong before allowing AI to act on its own.
Why Defenders Cannot Use AI Like Attackers
Chismon draws a clear distinction between offensive and defensive cybersecurity.
For attackers, many of the problems are technical. They may need to find an exploit or work out how to avoid detection. The objective is often clear: compromise a system, make malware communicate with its controller or steal information.
Defenders face a different set of obstacles. Getting an outdated system replaced may require budget approval. Applying a patch could affect another service. A firewall change may need to go through a formal approval process.
As Chismon explains, defenders are often restricted by organisational policies, while attackers are more likely to be restricted by technical problems. Cybersecurity is also a cost for most organisations rather than their primary business function, making security decisions subject to competing priorities.
That difference matters for agentic cyber defence. AI systems can work well when they are given a technical problem and a measurable result. Defensive actions are harder because there may not be a single clear success state, and someone still has to take responsibility for what the system does.
AI-Enabled Cyber Attacks: NCSC on AI Automation
The NCSC is not arguing that defenders should avoid AI. Instead, Chismon says organisations need to account for the constraints around defensive actions.
Some security tasks are already suitable for greater automation. Penetration testing, vulnerability research and vulnerability discovery can be carried out in controlled environments, with findings passed to development teams for remediation. Vulnerability scanning can also become a routine process once an organisation is satisfied that the activity will not disrupt its systems.
Security operations centres offer another example. Establishing a SOC involves policies, legal considerations and moving data from live systems into platforms where suspicious activity can be detected and investigated. The resulting alerts can then be handed to human teams for action.
Chismon identifies three principles for this model: technology handles detection while humans take action, detection must not damage the organisation, and automated responses should remain tightly controlled and limited in scope.
Measuring the Risk Before AI Acts
The NCSC framework looks at five areas when assessing whether a defensive action is suitable for automation: potency, scope, criticality, rollout confidence and recoverability.
Potency considers what an AI system is actually allowed to do. At the lowest level, it may only provide information and advice to a human. At higher levels, it could collect information autonomously, change system data or configuration, or execute code.
Scope considers how many systems could be affected, while criticality looks at whether those systems support important business or mission functions. Rollout confidence examines how well the action can be tested before deployment. Recoverability considers how easily an incorrect action can be reversed.
For now, Chismon suggests starting with lower-risk actions. AI can already help defenders process large amounts of security information, summarise reports and threat intelligence, and help teams prioritise what requires attention.
Research Could Expand Autonomous Defence
The NCSC and the UK Department for Culture, Media and Sport are working on Cyber Shield, described as a national-scale agentic cyber defence ecosystem. The NCSC also plans to publish an “AI for Cyber Defence” problem book covering areas where further research is required.
One key question is whether organisations can prove that an automated defensive action is genuinely low risk. Chismon points to areas such as analysing traffic logs and understanding the network connections or processes a system may require.
That evidence could eventually allow organisations to automate more defensive actions, harden systems and reduce their attack surfaces. But Chismon cautions that this will require further research and that organisations should continue strengthening their security through conventional measures while autonomous cyber defence develops.
