Summary
- NCSC CTO for Architecture Dave Chismon argues that offensive cyber tasks often have clearer success conditions than defensive actions.
- Autonomous defence can itself create outages when automated changes affect production systems, permissions, or network configuration.
- The NCSC proposes assessing automated defensive actions through potency, scope, criticality, rollout confidence, and recoverability.
Britain’s National Cyber Security Centre says artificial intelligence currently gives attackers greater freedom to automate cyber operations than defenders, because defensive systems act inside live organisations where an incorrect decision can itself create business disruption.
Dave Chismon, the NCSC’s CTO for Architecture, set out the distinction in an analysis of agentic cyber defence published on 21 September. His argument is based less on the comparative capability of individual AI models than on the consequences attached to the actions they take.
Offensive tasks frequently have relatively clear success conditions. An exploit works or it does not; malware establishes communication or it does not; a vulnerability can or cannot be reached. An attacker can tolerate unsuccessful attempts without having responsibility for preserving the target organisation’s services.
Defensive work takes place under different constraints. A firewall change, software patch, account action, or configuration update can be technically defensible while still interrupting a business process. An automated system that removes an exposure but also takes down a VPN has created an operational incident of its own.
That creates an accountability problem alongside the engineering challenge. Organisations have to determine how much authority an autonomous defensive system should receive, which systems it can alter, how confidently a proposed action can be tested, and how easily the resulting change can be reversed.
The NCSC proposes examining automated actions across five dimensions: potency, scope, criticality, rollout confidence, and recoverability. The model separates comparatively low-risk analytical activity from actions capable of directly changing state across critical production environments.
A read-only system that produces recommendations for a human carries a different operating risk from an agent allowed to execute code, alter identity controls, change routing, or modify production configuration. Scope also matters: an action that is tolerable on a single endpoint may become much more consequential if applied autonomously across thousands of systems.
The analysis helps explain why some AI-enabled defensive functions can be adopted earlier than others. Threat-intelligence analysis, vulnerability discovery, event correlation, and prioritisation can create useful outputs without necessarily granting the model direct control over production technology.
Automated remediation crosses that boundary. Existing security orchestration tools already perform actions such as isolating endpoints or forcing reauthentication, but those workflows are usually tightly scoped around predetermined conditions. Agentic systems potentially have more discretion over the sequence of actions they choose.
The NCSC is also exploring wider agentic cyber-defence capabilities through Cyber Shield and related research. The technical problem is therefore not whether autonomous systems can perform defensive work at all, but which classes of action can be shown to remain acceptably bounded when applied to live environments.
Architecture becomes central to that decision. Organisations that can establish dependencies, isolate systems, test changes, contain permissions, and recover cleanly from mistakes have more room to automate than environments where the effect of a configuration change cannot be predicted confidently.
The asymmetry is likely to grow as frontier models improve. Attackers can use automation repeatedly and accept failure as part of the process. Defenders have to preserve availability, safety, compliance, and business continuity while deciding how much autonomy to grant the same class of technology.
That leaves human oversight only part of the answer. A human approval step can slow down an unsafe action without fixing an architecture in which an agent has excessive privileges or an unclear blast radius. Reliable autonomous defence ultimately depends on the controls surrounding the model as much as the model’s own reasoning.
