The NCSC research problem book
The most significant problems which the NCSC believes are in need of concerted and significant collaborative effort from multiple and diverse disciplines over the next decade.
Page 24 of 29
AI3 - How can AI strengthen threat detection, triage and incident response?
Arslan Haider via Getty Images
AI systems can help defenders process large volumes of security information, identify suspicious patterns and support operational decision-making. This is particularly important where organisations face high alert volumes, complex supply chains and fast-moving incidents where early decisions can affect the scale of harm.
AI could support threat detection, triage and response by combining weak signals, identifying unusual behaviour, summarising evidence and suggesting next steps during investigations or incidents. However, defensive decisions are often made with incomplete information, and poor AI support could increase false confidence, miss important context or overwhelm analysts with low-quality recommendations.
This problem asks how AI can improve the speed, quality and consistency of threat detection, triage and incident response, while ensuring that human defenders remain able to understand, challenge and act on AI-supported judgements.
Strands or sub-problems
Detection and triage
Many cyber defence teams need to assess large volumes of alerts, logs and reports. AI could help group related activity, enrich alerts with context, identify suspicious behaviour and support decisions about what should be investigated first. Research is needed to understand where AI can most usefully support detection and triage, how recommendations should be explained, and when decisions should be escalated to human responders.
Anomaly detection and weak signals
Some cyber threats are difficult to detect because the evidence is incomplete, noisy or spread across multiple sources. AI could help combine weak signals and identify patterns that may not be obvious from any single data source. Research is needed to understand how these methods can be made robust, explainable and useful in practice, while avoiding excessive false positives or missed detections.
Supply chain threat monitoring
Organisations increasingly rely on software, services and dependencies outside their direct control. AI could help monitor parts of the digital supply chain, such as software packages, code releases or infrastructure changes, for suspicious behaviour or indicators of compromise. Research is needed into how AI can support earlier warning of supply chain threats without generating unmanageable volumes of alerts.
Incident response support
During an incident, defenders need to build a picture quickly, decide what matters most and coordinate action. AI could help summarise evidence, identify affected systems, suggest containment options and maintain a shared operational picture. Research is needed to understand how AI can support responders under pressure without obscuring uncertainty or replacing accountable human decision-making.
Why this is important
In many cyber incidents, the hardest problem is not collecting information but understanding what matters and deciding what to do next. AI offers the opportunity to help defenders process large volumes of telemetry, identify significant activity and accelerate investigations, but speed is only valuable if it leads to better decisions. Research is needed to understand when AI-assisted detection, triage and response actually improves outcomes, how uncertainty should be communicated, and where human oversight remains critical. For smaller organisations with limited security resources, getting this right could make the difference between identifying a compromise early and discovering it long after the damage has been done.
