What must be tested before AI agents defend real networks?
The UK's NCSC has set seven research questions for AI-enabled cyber defence, including live-like evaluation, lifecycle security and human oversight. It is a five-year agenda, not an assurance that autonomous defenders are ready.
The short version
- What happened
- The NCSC has published seven research questions covering autonomous defence, attack-surface reduction, threat detection, AI-system security and national-scale resilience.
- Who it affects
- Security analysts need evidence that an agent reduces workload or improves response without concealing mistakes or taking disproportionate action.
- What remains unproven
- The NCSC chapter is an official research agenda, not an empirical study, incident disclosure, standard or procurement requirement.
Keep in mind
The NCSC chapter is an official research agenda, not an empirical study, incident disclosure, standard or procurement requirement.
It gives no denominator, benchmark result, effect size, deployment outcome or comparative cost.
The priorities reflect the UK cyber-security context; other jurisdictions and sectors may face different legal and operational constraints.
Source analysis · 1 linked source. Primary analysed source date: 20 October 2026.
Read the full report · 3 min The evidence, methods, implications and limitations
The agenda moves the test from a model to the whole defence team
The UK National Cyber Security Centre has added an AI chapter to its research problem book, setting seven questions for work over the next five years. They span agent-assisted attack-surface reduction, threat detection and incident response, assurance of autonomous defence, lifecycle security, AI supply chains and national-scale resilience. Human-AI collaboration runs through the chapter rather than appearing as a final safety check.
For security teams, the most practical shift is the comparator. The NCSC says autonomous systems should be tested in simulation, emulation, cyber ranges or controlled real settings against human-only and human-AI teams. It also asks when a system should defer, how operators can see what it did, and how logging and monitoring can reveal action outside authorised bounds.[1]
A useful agenda is not deployment evidence
The chapter treats an AI deployment as an ecosystem of models, data, code, APIs, plugins, infrastructure and people. It calls for provenance across those dependencies, AI-specific vulnerability management and containment for multi-agent failures that can spread through delegated tasks, shared memory and connected tools. It also recognises trade-offs: a control that improves robustness or privacy may reduce performance, usability or explainability.
No experiment, denominator or outcome measure accompanies the agenda. It does not show that agentic defence is safer, faster or cheaper than a staffed security operation, and it creates no binding standard. Evidence that would change the assessment includes published red-team protocols, baseline comparisons, failure and override rates, post-deployment incident data and independent replication across critical services.[1]
The distinction that matters
Three evidence layers the NCSC says are still missing
A capable model is only one part of a defensible cyber-security system.
Task
Compare AI, human and combined teams
Measure real defensive value
System
Test supply chains, tools and multi-agent links
Find ecosystem failures
Operation
Log, monitor, defer and contain
Maintain human control