NCSC Publishes Guidance on the Practical Realities of Agentic AI in Cyber Defence

The National Cyber Security Centre has published a blog post titled "One does not simply defend agentically", addressing how defenders can realistically use AI in cyber security operations. The NCSC explains that while attackers may be able to deploy AI agents with fewer constraints, defenders face significant practical, ethical and operational limitations that shape how AI can be used in defensive contexts. The guidance acknowledges the potential of agentic AI, where systems can act with a degree of autonomy, but emphasises that defenders cannot simply mirror attacker tactics and must work within legal, governance and risk management frameworks that do not apply to adversaries.

Why this matters for UK organisations

For UK organisations exploring AI-assisted security operations, this is an important framing from the national technical authority. Many organisations are being pitched AI-driven security tools with promises of autonomous threat hunting, automated response and agentic behaviour. The NCSC's guidance helps set realistic expectations about what AI can and cannot do in a defensive context, particularly where decisions involve legal risk, business impact or the potential for unintended consequences. Understanding these constraints is essential for making informed decisions about where AI can add value and where human oversight, governance and accountability remain non-negotiable. The guidance also reflects a broader truth about defensive security: defenders operate within rules, responsibilities and risk tolerances that attackers do not. This asymmetry shapes every technology decision, including how AI can be deployed. Organisations that understand this are better positioned to evaluate vendor claims critically, to design AI-assisted workflows that respect governance boundaries, and to ensure that automation enhances rather than replaces human judgement in contexts where accountability matters.

What to review

Review how AI security tools are being evaluated within your organisation and ensure that vendor claims are assessed against the practical governance and operational constraints the NCSC describes. Consider where AI can support analysts by handling repetitive tasks, surfacing patterns or accelerating triage, and where human decision-making, clear escalation paths and accountability must remain in place. Ensure that procurement, security and legal teams are aligned on the boundaries within which AI tools can operate, particularly where automated actions could affect live systems, customer data or business operations. This is also a prompt to revisit how AI governance is structured, who is responsible for overseeing AI use in security operations, and how decisions about automation are documented and reviewed. The NCSC's guidance provides a useful reference point for these conversations, helping organisations move beyond marketing hype and focus on what AI can realistically deliver within a defensive context.

Source: NCSC UK