Image source: iStock.com/MF3d
Defenders cannot use AI agents in the same way as attackers because cyber defence is constrained less by technology than by organisational politics, says the National Cyber Security Centre
Dave Chismon, CTO for architecture at the agency, said the threat from AI-enabled cyber attacks is likely to grow while autonomous cyber defence struggles to keep pace unless organisations take a different approach.
Chismon drew on cyber security researcher Halvar Flake’s maxim that “all offensive problems are technical problems, and all defensive problems are political problems”. Attackers face largely technical questions such as whether they have an exploit for a vulnerability or how to avoid detection, while defenders wrestle with organisational issues such as securing budget to replace end-of-life systems, finding time for patching and getting firewall rule changes approved.
He said the difference stems from the core purposes of attackers and defenders. Cyber offence is an attacker’s raison d’être, while for defenders cyber defence is “a cost of doing business” that competes with an organisation’s other priorities. Some board members, he noted, may see little difference between a denial of service attack taking down IT and a poorly implemented action by the cyber defence team doing the same thing.
AI works well for attackers because offensive problems are mostly technical and have a clear success state, such as a target program crashing or malware calling home. Defensive problems are not mostly technical and do not always have a clear success state, so using AI automation for defence quickly becomes a matter of organisational politics, with someone needing to be responsible for the action taken.
“Defenders simply cannot put AI to work in the same way attackers can,” Chismon wrote. “This is an inconvenient truth, as it suggests that the threat from AI-enabled cyber attacks will grow, whilst autonomous/agentic cyber defence might struggle to keep up unless we approach things differently.”
Rather than mimicking attackers’ use of agentic tooling, he said defenders should explicitly consider the constraints. He pointed to work on autonomous cyber defence by CETAS, commissioned by the NCSC, which identified that defenders have different levels of appetite for where they would apply AI.
Chismon set out three core principles for safe automation: technology detects, but humans respond with actions; technological detection must not harm the organisation; and any technological response must be tightly controlled and scoped. He proposed a framework for assessing the riskiness of defensive actions across five dimensions – potency, scope, criticality, rollout confidence and recoverability – to identify the lowest-risk tasks to automate first.
Easy wins include tasks of low potency, where AI advises a human rather than directly affecting a system. AI is already useful to defenders in summarising the huge volumes of reports and threat intelligence they face and helping prioritise actions, he said, adding that areas which can already be largely automated, such as detection, are good candidates for extending with agentic processing.
He also said work to reduce the risk of automating less comfortable tasks, such as focusing on systems that are easy to recover under the “cattle, not pets” model, and government work using agentic tooling to rewrite legacy systems in more re-deployable technology stacks, including the Defra AI Legacy Modernisation Playbook and AI code-remediation pilots.
The NCSC and the Department for Science, Innovation and Technology are jointly developing Cyber Shield, a national-scale agentic cyber defence ecosystem, which Chismon said will require making autonomous defensive actions possible in a way they currently are not. The NCSC will publish an “AI for Cyber Defence” problem book setting out areas where research is needed.
He identified one priority as finding ways to prove deterministically that “low risk” actions really are low risk, such as using AI to analyse traffic logs or assess systems to show exactly which network calls they could ever make. This would give organisations confidence to take automated defensive actions and open up the possibility of automating system hardening to reduce attack surfaces.
Chismon cautioned that these efforts will take time, effort and research, adding: “Organisations cannot risk just waiting for agentic defence to roll in and protect them; they also need to be focussing on improving their security the traditional way.”