UK NCSC Official Warns AI May Give Cyberattackers an Advantage
Summary
An NCSC official says AI is easier to automate for offensive cyber operations than defense, where mistakes can disrupt live systems. The agency advises low-risk uses and traditional security measures while researching safer agentic defense.
Key points
- NCSC CTO Dave Chismon says offensive tasks have clearer success measures and are easier to automate than defensive work.
- Automated defensive actions can disrupt live systems, for example by taking down a VPN or breaking a business function.
- Chismon says defenders should begin with low-risk uses such as summarizing threat intelligence for human analysts.
- The NCSC is developing Cyber Shield to find and fix weaknesses across government networks and critical national infrastructure.
- The agency plans to publish an AI for Cyber Defence research agenda; Chismon says autonomous defense is not yet ready to rely on.
- The article notes that a comparable rise in cyberattacks had not yet been observed following a period of record-rate software patching.
Article Details
- Event Type
- NCSC warning about AI-enabled cyber operations and the challenges of automating cyber defense
- Impact
- The NCSC warns that offensive cyber tasks are easier to automate and measure than defensive actions, which can disrupt live systems if they fail. It says agentic defense is not ready to rely on and recommends cautious, low-risk AI use alongside traditional security improvements.