NCSC publishes guidance on the practical limits of AI in cyber defence

The National Cyber Security Centre has published guidance addressing the realistic capabilities and constraints of AI in defensive security operations. In a blog post titled 'One does not simply defend agentically', the NCSC explains that while AI offers potential benefits for defenders, it cannot be deployed in the same autonomous or agentic way that attackers might use it. The guidance emphasises that defenders operate under constraints including legal accountability, the need for explainability, and the requirement to avoid unintended consequences in live production environments. The NCSC outlines practical areas where AI can support defensive work, such as threat intelligence analysis, log review, and pattern recognition, but makes clear that human oversight, governance, and decision-making remain essential.

Why this matters for UK organisations

For UK organisations evaluating AI tools for security operations, this guidance provides important context at a time when many vendors are promoting AI-driven security products with claims of autonomous threat response or self-healing systems. The NCSC's position reinforces that mature security practice depends on clear ownership, explainable decisions, and the ability to justify actions taken in response to incidents. AI can assist with analysis, prioritisation, and detection, but it cannot replace the judgement, accountability, and governance that security teams provide. This matters particularly for organisations in regulated sectors, where the ability to explain security decisions and demonstrate due diligence is a legal and operational requirement. The guidance also helps organisations distinguish between realistic AI capabilities and vendor marketing claims, supporting more informed procurement and deployment decisions.

What to review

Organisations should review any AI security tools currently in use or under consideration to ensure they include clear human oversight, explainable outputs, and defined accountability for decisions and actions. Security teams should evaluate whether AI tools are being used to support human decision-making or whether they are being relied upon to make autonomous decisions without appropriate governance. For organisations in regulated sectors, this is also a prompt to review whether AI-driven security tools meet regulatory expectations around explainability, auditability, and accountability. The NCSC's guidance reinforces that effective defence comes from disciplined practice and clear ownership, not from outsourcing decision-making to autonomous systems.

Source: NCSC UK