NCSC Annual Review 2026

In 2026, the Government Cyber Coordination Centre (GC3), a joint NCSC-DCMS enterprise, the AI Security Institute (AISI) and other government departments, launched Project DROMOS to explore how frontier AI models could help identify software vulnerabilities more quickly and effectively across government systems. The initiative brought together cyber security specialists, software engineers and AI experts from across government to test how emerging technologies could augment existing security practices.

The programme began with a four-week pilot focused on analysing government code repositories. By using frontier AI models to review large and complex codebases, DROMOS explored how security teams could identify potential weaknesses at a speed and scale that would be difficult to achieve through manual review alone. Early results demonstrated the potential for AI-assisted vulnerability discovery, providing the confidence to expand the programme into operational environments across government.

Building on these successes, DROMOS expanded to selected government environments, where participating organisations used AI-assisted analysis to uncover hundreds of potential security issues, including critical vulnerabilities. By combining the speed of frontier AI models with expert human oversight, departments were able to assess findings, prioritise action and strengthen the security of their systems more efficiently.

Beyond vulnerability discovery, DROMOS has helped government develop a better understanding of how AI can be deployed safely and responsibly in cyber operations. The programme established governance processes, operational procedures and assurance measures to support human oversight, manage false positives and ensure AI-generated findings were handled appropriately.

The lessons learned through DROMOS are helping shape the future of cyber defence across government. As one of the first coordinated efforts to apply frontier AI models to vulnerability discovery at operational scale, the programme has demonstrated how emerging technologies can strengthen resilience, improve visibility of security risks and help protect the digital services relied upon by citizens and businesses every day.