NCSC Annual Review 2026

Cyber Shield will be delivered in key stages. Initial operational capability will focus on enabling detection and blocking use cases. Research conducted by the NCSC and others suggests that these defensive tasks are currently more amenable to automation than more complex activities such as autonomous remediation. Focusing first on areas where automation is already practical allows organisations to realise tangible benefits while building confidence, trust and operational experience.

However, the long-term ambition is not simply to improve reactive defence. To provide more proactive protection, the cyber security community must enable the automation of defensive actions that today remain outside many organisations' risk tolerances. The challenge is not only technological but operational. Defenders need confidence that automated actions will be safe, predictable and proportionate before they can be deployed at scale.

Through a series of challenges, trialled by the NCSC's recently published AI in cyber security problem book, the Cyber Shield initiative will lay out the key areas of innovation required to deliver on the full vision and address the challenges that currently prevent agentic cyber defence operating at national scale. Key questions remain around how organisations can gain sufficient assurance to trust increasingly autonomous defensive actions. For example, how can defenders demonstrate that an automated remedial action will not cause unintended disruption? How can systems be analysed, from source code or binaries through to configuration, to specific hardening actions that reduce attack surface while minimising impact on users and services?

Solving challenges such as these will be critical to unlocking the next generation of agentic cyber defence. The programme will create opportunities for research, experimentation and collaboration focused on these Cyber Shield challenges, bringing together government, industry and academia to address them.

As cyber security becomes increasingly shaped by AI, the UK must retain the ability to understand and coordinate national cyber risk in line with its own security priorities. While commercial products will remain an important part of cyber defence, protecting the UK's most critical systems requires trusted mechanisms for sharing insight, coordinating defensive action and understanding risk at national scale. By creating shared infrastructure, common protocols and strong partnerships across government, industry and academia, Cyber Shield aims to strengthen both national resilience and the UK's cyber security ecosystem.

AI offers an opportunity to narrow the gap between the defender and attacker, enabling defenders to operate with greater speed, consistency and reach than has previously been possible. A longstanding challenge in cyber security is that defensive actions rarely scale as effectively as offensive ones. Attackers have consistently benefited from automation and growing digital complexity, allowing them to identify and exploit weaknesses across large numbers of targets. By contrast, defenders often need to assess risks individually, coordinate changes across organisations and obtain approval before action can be taken. 

The NCSC and DCMS will lead this work, and deliver the foundational platform, but to truly narrow the gap and push the frontier of cyber defence requires anticipation, participation and a bias to action from the wider UK cyber security community. Organisations will need to integrate agents, share insights, help shape emerging standards and contribute to solving the technical and policy challenges that stand in the way of scaling agentic cyber defence.