NCSC's Chismon puts the limit on agentic cyber defence at the damage a wrong action does
Dave Chismon argues that offence gets a pass/fail signal and defence does not, so every automated remediation still needs a person to weigh it and answer for it, even as his agency builds Cyber Shield.
The Watch · Security desk
What happened
- Dave Chismon, the NCSC's chief technology officer for architecture, wrote in a blog post Monday that defenders cannot yet put AI to work as freely as attackers can.
- He expects AI-enabled cyberattacks to grow on that imbalance, with automated defences struggling to keep pace.
- The NCSC is building Cyber Shield, a capability meant to deploy agentic AI systems to discover and fix weaknesses across government networks and critical national infrastructure.
- Chismon called making autonomous defensive actions safe enough to deploy an unsolved problem, and said the agency will soon publish an "AI for Cyber Defence" research agenda.
- Software makers have patched at record rates since the June Five Eyes warning, and a comparable rise in cyberattacks has not yet been observed.
Why it matters
- What it limits constraint What caps automated defence is the cost of a wrong action on a production network, so a more capable model does not raise the ceiling; the sign-off stays with a person who can be held to it.
- Who has to decide decision Buyers weighing agentic remediation now have a five-part state test to hold a vendor pitch against, and the jobs that clear it today are read-only ones such as summarizing threat intelligence.
- What doesn't add up contradiction Operators are told autonomous defensive action is not yet safe while the same agency aims agentic fixes at the networks least able to absorb a bad one, and the research meant to close that gap is not out.
Next story · Leadership · yesterday
Nandy says she is minded to intervene in Sky's £1.6bn ITV dealConfirmed3 publishers
Chismon's case turns on what an automated system can be told it achieved. An exploit works, or malware "calls home", which gives automated tooling an unambiguous signal [4]. He opened with a maxim he credited to security researcher Halvar Flake: "All offensive problems are technical problems, and all defensive problems are political problems." [3]
Defence has no equivalent signal. Defensive work "doesn't always have a clear success state" to tell an automated system whether it worked, Chismon wrote [5]. Defensive actions also land on the live systems they are meant to protect, and his examples of a wrong move are a patch that takes down the VPN and a firewall rule that breaks a business function [6]. Because the downside is that steep and success that hard to measure, he wrote, a human has to weigh each action and answer for it [7]. Some board members, he added, would see little difference between an attack that takes down a company's IT and a botched defensive action that does the same, "except that the board can't shout at an attacker over the phone" [8]. Defenders "simply cannot put AI to work in the same way attackers can," he wrote, calling it "an inconvenient truth" [9].
The offensive advantage he describes is a forecast. In June the Five Eyes alliance, which includes GCHQ, the agency NCSC sits inside, warned that frontier AI could transform offensive and defensive cyber operations within months rather than years [16]. Over the summer, models from Google, Anthropic, OpenAI and Meta reached real-world systems during security evaluations, and in most of those cases they got in through basic means including reusing exposed credentials [17]. The chair of the G20's financial stability board and the Chinese Communist Party's top intelligence official have raised similar concerns, and what the "fundamental transformation" actually consists of is still unclear [18].
So the practical advice is about scope, not capability. Start with low-risk uses such as having AI summarize threat intelligence for human analysts, Chismon said, and judge automation by its reach, impact, criticality, predictability and reversibility [12]. Those five criteria are the framework the NCSC blog publishes [20]. He also wrote that there is much defenders can do to unlock the potential of agentic cyber defence [15].
For the interval, he told defenders to keep doing the slow work. Agentic defence is not ready to be relied on and building it "will take time, effort, and research", Chismon cautioned [13]. Organizations "cannot risk just waiting for agentic defence to roll in and protect them" and should keep improving their security "the traditional way," he wrote [14].
What to watch
- The "AI for Cyber Defence" research agenda the NCSC says it will publish soon, and whether it sets a testable safety bar for autonomous action.
- Whether Cyber Shield's agentic systems are allowed to fix weaknesses on live government and CNI networks or stay advisory.
- Whether the record patch rate since June is eventually followed by a measured rise in AI-enabled intrusions.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence55
- Adoption
- Not scored
- Hype gap+20
- Incentives30
- Confidence60
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
Dave Chismon, the NCSC's chief technology officer for architecture, said in a blog post Monday that defenders cannot yet put artificial intelligence to work as freely as attackers can.
- [2]
Chismon said the imbalance means AI-enabled cyberattacks would likely grow as automated defenses struggle to keep pace.
- [3]
Chismon opened his argument with a maxim he cited from security researcher Halvar Flake: "All offensive problems are technical problems, and all defensive problems are political problems."
- [4]
Chismon wrote that attackers' work has a clear measure of success, an exploit works or malware "calls home", providing the kind of unambiguous signal of success that automated tools handle well.
- [5]
Chismon wrote that defensive work "doesn't always have a clear success state" to tell an automated system whether it worked.
- [6]
Unlike attacks, defensive actions are taken on the live systems they are trying to protect, and a wrong move such as a patch that takes down the VPN or a firewall rule that breaks a business function can cause the very disruption the defender was trying to prevent.
- [7]
Chismon wrote that because the downside is so steep and success so hard to measure, a human has to weigh each defensive action and answer for it.
- [8]
Chismon wrote that some board members would see little difference between an attack that takes down a company's IT and a botched defensive action that does the same, "except that the board can't shout at an attacker over the phone".
- [9]
Chismon wrote that defenders "simply cannot put AI to work in the same way attackers can," calling it "an inconvenient truth."
- [10]
The NCSC is building a cyber defence capability called Cyber Shield that intends to deploy agentic AI systems to discover and fix cybersecurity weaknesses across government networks and critical national infrastructure.
- [11]
Chismon acknowledged that making autonomous defensive actions safe enough to deploy remains an unsolved problem, and said that as part of Cyber Shield the agency will soon publish an "AI for Cyber Defence" research agenda.
- [12]
Chismon said organizations should start with low-risk uses such as having AI summarize threat intelligence for human analysts, and the NCSC blog provides a framework helping defenders judge the risk of automation by its reach, impact, criticality, predictability and reversibility.
- [13]
Chismon cautioned that at the moment agentic defence is not ready to be relied on and that building it "will take time, effort, and research".
- [14]
Chismon wrote that organizations "cannot risk just waiting for agentic defence to roll in and protect them" and should keep improving their security "the traditional way."
- [15]
Chismon wrote that "there's much [defenders] can do to unlock the potential of agentic cyber defence."
- [16]
In June the Five Eyes intelligence alliance, which includes GCHQ, the agency NCSC is part of, warned that frontier AI could transform offensive and defensive cyber operations within months rather than years.
- [17]
Over the summer, models from Google, Anthropic, OpenAI and Meta reached real-world systems during security evaluations, and in most of these cases the models got in through basic means, including reusing exposed credentials.
- [18]
Similar concerns have been expressed by other authorities, from the chair of the G20's financial stability board to the Chinese Communist Party's top intelligence official, but the nature of the "fundamental transformation" remains unclear.
- [19]
In the months since the Five Eyes warning, software makers have issued patches at record rates, but a comparable rise in cyberattacks has not yet been observed.
- [20]
The NCSC framework rates the risk of automating a defensive action on five criteria.
Sources
2 independent publishers whose own reporting we read for this story.
- thecyberexpress.comAI Gives Hackers an Edge Defenders Still Can’t Match, NCSC Warns
1 article · September 22, 2026
- therecord.mediaAI is set to help cyber attackers much more than defenders, says UK official
1 article · September 22, 2026
Topics and entities
Topics
- AI in Cybersecurity
- Agentic cyber defence
Entities
- Department for Culture, Media and Sport
- Five Eyes cybersecurity agencies
- National Cyber Security Centre
- GCHQ