The UK’s National Cyber Security Centre (NCSC) wants to deploy autonomous AI agents capable of finding and neutralizing cyberattacks on national networks in real time, marking Britain’s push toward a sovereign, machine-speed cyber defense system.
The blueprint, called Cyber Shield, was developed jointly with the Department for Science, Innovation and Technology (DSIT).
“The objective of Cyber Shield is to build a national-scale, collaborative approach to agentic cyber defence, using frontier AI to identify, reduce and resolve our national cyber risk,” the NCSC said in a blog post.
The proposal comes as the NCSC warns that AI is already helping attackers perform activities such as vulnerability discovery and reconnaissance “at a much greater scale and faster pace,” reducing the time available for defenders to respond.
While the agency said it has not yet observed fully autonomous attacks across the complete intrusion lifecycle, it expects frontier AI models to eventually operate from initial access through actions on objectives. According to the blueprint, Cyber Shield would rely on AI-powered “red” and “blue” agents to identify weaknesses in systems, detect threats, and progressively automate cyber defense activities.
“In the near future, we envisage a world where cyber defence is supported by ‘red’ and ‘blue’ agents which identify weaknesses in systems (‘red’) and defend against threats in real time (‘blue’),” the NCSC said in the blog.
Initially, the AI agents would identify vulnerabilities and threats at machine speed before progressing toward automated remediation. They would also generate and share security insights, detect and contain breaches, collaborate across organizational boundaries, and operate under the control of participating organizations.
The NCSC said it plans to begin by partnering with network defenders across government and critical UK sectors before transitioning to commercially scalable deployments.
“Our aim is to transition to commercially scalable solutions to deliver a level of national resilience which is ready for the future threat,” the agency said.
“The UK faces a cyber threat that is growing in scale, speed and sophistication,” the NCSC said. “Frontier AI is accelerating this trend, with the potential to shift the balance in favour of attackers – and with serious implications for defenders.”
According to the agency, AI is already helping attackers conduct offensive cyber activities, including vulnerability discovery and reconnaissance, “at a much greater scale and faster pace.”
“As a result, activities that once took weeks can now take minutes, reducing the time available for defenders to respond, detect, and contain them,” the blog post added.
The Cyber Shield framework also prioritizes explainable AI, federated AI agents, automated vulnerability discovery and mitigation, coordinated detection and response, and national-scale scanning and mitigation capabilities. Among its longer-term objectives is the development of “fully automated vulnerability mitigation workflows” that would allow defenders to operate “beyond human scale,” initially across critical networks.
Sanchit Vir Gogia, chief analyst at Greyhound Research, said the blueprint reflects a broader shift toward operational AI in cybersecurity but also highlights governance challenges.
“Once an agent can alter a live environment, it stops being an assistant and joins the control plane,” Gogia said. “Every automated action must answer for its authority, its change and its reversal, and an agent that cannot explain itself has no business touching production.”
Gogia said the NCSC itself distinguishes between AI-assisted exposure identification and threat detection, which organizations can begin adopting today, and fully automated mitigation, which the blueprint identifies as an open research challenge.
The NCSC said Cyber Shield cannot be delivered by the government alone and will require collaboration with industry, academia, frontier AI developers, and operators of critical national infrastructure.
“The Cyber Shield vision is ambitious and wide-reaching, and faces significant delivery challenges. It cannot be developed and operated by the NCSC or government alone,” the agency said.
According to the blog post, the NCSC and DSIT are establishing pathways for partners to contribute research, technologies, and operational expertise as the blueprint evolves.
The NCSC did not immediately respond to a request for comment on when Cyber Shield is expected to move beyond the blueprint stage.
Gogia said the blueprint is unlikely to immediately change enterprise technology procurement because it does not yet define an operational standard.
“Nobody will demand Cyber Shield-compatible products, because there is no operating standard to buy against,” he said. “What changes first is the criteria vocabulary. Serious buyers no longer ask whether a tool has agentic AI. They ask what it is permitted to change.”