The National Cyber Security Centre and DSIT want federated AI agents defending government and critical systems at machine speed, and they are asking frontier labs, industry and academia to help build it.
The UK has published its most ambitious cyber defence plan of the AI era. In a blog post released July 7, 2026, the National Cyber Security Centre (NCSC) and the Department for Science, Innovation and Technology (DSIT) set out the blueprint for Cyber Shield, a national-scale, sovereign capability that would use agentic AI to identify, reduce and resolve cyber risk across government and critical national infrastructure.
The initiative traces back to GCHQ Director Anne Keast-Butler's inaugural GCHQ Annual Lecture at Bletchley Park on May 27, 2026, where she said the agency had developed a blueprint to "hardwire cutting-edge agentic AI into machine speed cyber defence." The NCSC post, authored by Deputy Chief Technology Officer Peter Haigh and Deputy Director Capability Harry G, is the first detailed public description of what that blueprint contains.
Agents #
The NCSC envisions cyber defence supported by paired AI agents. "Red" agents would probe systems for weaknesses, while "blue" agents would detect and contain threats in real time. The agents would be federated, running under the control and authority of the organisations that own them, but able to identify, trust and communicate with one another across organisational boundaries.
The blog lists six core capability areas: reliable and explainable AI that system owners can authorise to make real-time changes safely, federated agents with underpinning trust infrastructure, automated vulnerability discovery and mitigation, coordinated detection and response with real-time insight sharing, national-level scanning of critical UK IP ranges, and national-level mitigation such as automated blocking of known malicious domains and networks.
The NCSC acknowledges that some of these areas require significant research progress before they are viable.
AI is here #
The rationale rests on two problems. The first is old: the NCSC says a large proportion of critical systems still fall short of the aims in its Cyber Assessment Framework, and many successful attacks exploit basic, preventable weaknesses such as unpatched software and legacy systems.
The second is new. According to the NCSC, AI is already letting attackers run reconnaissance and vulnerability discovery at far greater scale and speed, turning activity that once took weeks into minutes. The agency notes that fully autonomous attacks spanning the complete intrusion lifecycle have not yet been observed in real-world systems, but assesses that frontier models are likely to become capable of operating from initial access through to actions on objectives. That would overwhelm traditional defences and shift the advantage toward attackers.
The blog also flags a dual-use problem of its own making. Advanced defensive capabilities of this kind could be repurposed for offensive activity, and the NCSC says organisations developing them must act responsibly.
How it would be built #
The approach is test, iterate, scale. The NCSC and DSIT plan to partner first with network defenders across government and critical UK sectors to trial newly researched capabilities, then transition to commercially scalable solutions. The blog frames the UK as a case study for the world on active cyber defence in the AI era, and explicitly invites academia, critical infrastructure operators, frontier AI labs and the cyber defence industry to get involved.
Get the ICD Newsletter
Subscribe for source-forward cyber news, OSINT notes, breach updates, and analysis. Have evidence or a lead? Send it to ICD.