The UK’s National Cyber Security Centre (NCSC) warned that artificial intelligence is currently positioned to provide greater advantages to cyber attackers than defenders, as attackers face fewer constraints when deploying AI autonomously.
Dave Chismon, the NCSC’s chief technology officer for architecture, said attackers can allow AI agents to operate with broad autonomy, while defenders must account for the risk that autonomous systems could disrupt or damage the networks they are intended to protect. This imbalance could allow AI-enabled attacks to scale faster than automated defenses.
The NCSC has also said AI is rapidly improving offensive capabilities, including vulnerability discovery and exploitation, while defensive uses such as automated mitigation and response carry risks including service disruption, data loss and operational failures.
Jacob Krell, Senior Director: Secure AI Solutions & Cybersecurity, Suzu Labs:
“The NCSC’s warning that AI may favor attackers needs a harder qualification. Attackers cannot simply give an AI agent broad access and walk away.
“They still have to manage operational security (OPSEC), avoid attribution, control their infrastructure and stop the agent from creating evidence. If it scans the wrong target, contacts a victim or exposes the operator, the consequences can include arrest and prosecution. Criminal liability is a real constraint on offensive autonomy.
“Defenders carry a different risk. A security team whose AI-driven firewall change breaks a VPN may face an outage review, discipline or a lawsuit. The engineer does not usually face an arrest warrant because the agent made a bad change. That makes defensive autonomy a governance problem, not a simple question of whether the technology can act.
“Organizations should reduce that governance and organizational friction by creating pre-approved classes of low-risk, reversible actions, with clear asset ownership, deterministic validation and tested rollback. Changes with broad or uncertain impact should still require human approval. The goal is to remove unnecessary approval friction from routine remediation while keeping consequential actions gated.
“An attacker has to keep an AI agent quiet, scoped and out of the wrong network. A defender has to get an AI agent approved, tested and recoverable. The first is an OPSEC and criminal-liability problem. The second is governance and organizational friction, which defenders can reduce through better ownership, pre-approval and rollback design.”
Lydia Zhang, President & Co-Founder, Ridge Security Technology Inc.:
“The inconvenient truth that Chismon points out in this article has been the reality security teams have been dealing with for years: the imbalance between attackers and defenders in their ability to adopt and operationalize new technologies. AI has obviously widened that gap dramatically.
“But there is also a significant silver lining for defenders: many of the advantages AI gives attackers can also be turned toward defense. AI can help fix vulnerabilities early in the development lifecycle through automated patching, and it can also help remediate vulnerabilities in production.
“We recently demonstrated how an organization can practically combine a security testing tool with a code agent to reduce critical vulnerabilities from 10 to 0 in just four runs.
“So perhaps the challenge is no longer purely technical. The technology is increasingly capable. The bigger challenge is organizational: risk tolerance, processes, accountability, and mindset.”
Donald McFarlane, Board Member, Xcape Inc.:
“Treasury Secretary Scott Bessent articulated a useful starting point this week: accountability. Discussing the Hugging Face incident, he argued that responsibility rests with the humans and organizations deploying these systems, not with an AI agent treated as though it were an independent actor. He has also argued against shielding frontier labs from liability.
“I agree wholeheartedly with that basic principle. More specifically, liability should follow control, causation, intent and duty of care, rather than simply attaching every downstream harm to the person or company who trained the model.
“A malicious user deliberately employing AI to attack someone should bear primary responsibility. An operator that gives an agent powerful credentials, excessive authority and inadequate supervision should be responsible for negligent deployment. Integrators should be accountable for unsafe implementations. Model developers should remain responsible where foreseeable defects, or failures to exercise reasonable care in developing and testing their products, materially contribute to harm.
“That approach also recognizes that responsibility may be shared. Relevant questions would include who controlled what, what risks were reasonably foreseeable, what safeguards were available, and whose acts or omissions materially contributed to the outcome.
“The NCSC is also right that defenders cannot simply mirror attackers. Autonomous defensive action can itself disrupt the systems we are trying to protect, so greater autonomy has to come with governance, bounded authority, recoverability and clear human accountability. Its framework for evaluating potency, scope, criticality, rollout confidence and recoverability is a useful start.
“But I am more optimistic about the defensive side of this equation. AI gives defenders the opportunity to operate at machine speed as well. We should be designing systems that permit progressively greater autonomous action where it can be safely bounded and reversed. And cybersecurity has much to learn from military doctrine and tactics: deception, manoeuvre, shaping the battlespace and channeling adversaries toward ground of the defender’s choosing. AI can make those approaches substantially more powerful.
“AI is an extraordinarily powerful general-purpose technology. We need strong engineering, clearly assigned human accountability, meaningful incident reporting and judicially determinable duties of care. Autonomous software does not somehow break the chain of human responsibility, and we should not create regulatory barriers that only the largest incumbent laboratories can afford.”
John Strand, Owner, Black Hills Information Security:
“Absolutely, AI is going to create more attack opportunities simply because these systems have broad autonomy and more latitude in what they can do, especially when you start looking at open-weight models. But there’s another part of this that I don’t think people fully appreciate. Complexity is the enemy of computer security.
“The more services you have, the more attack surface you create. Even if those services don’t have known vulnerabilities today, AI can rapidly fuzz them, analyze them, and identify weaknesses that attackers may have previously overlooked because finding and exploiting them required significant time and skill.
“AI changes that equation. Vulnerabilities and exploitation opportunities that were previously out of reach for the average attacker are suddenly much more accessible. You no longer need to be an exceptionally skilled vulnerability researcher to find some of these weaknesses. AI can do a tremendous amount of that heavy lifting for you.”
Defenders always should have the advantage. Therefore the balance needs to be reset so that the good guys are the ones that win.
AI set to help cyber attackers more than defenders, UK official warns
Posted in Commentary with tags UK on September 23, 2026 by itnerdThe UK’s National Cyber Security Centre (NCSC) warned that artificial intelligence is currently positioned to provide greater advantages to cyber attackers than defenders, as attackers face fewer constraints when deploying AI autonomously.
Dave Chismon, the NCSC’s chief technology officer for architecture, said attackers can allow AI agents to operate with broad autonomy, while defenders must account for the risk that autonomous systems could disrupt or damage the networks they are intended to protect. This imbalance could allow AI-enabled attacks to scale faster than automated defenses.
The NCSC has also said AI is rapidly improving offensive capabilities, including vulnerability discovery and exploitation, while defensive uses such as automated mitigation and response carry risks including service disruption, data loss and operational failures.
Jacob Krell, Senior Director: Secure AI Solutions & Cybersecurity, Suzu Labs:
“The NCSC’s warning that AI may favor attackers needs a harder qualification. Attackers cannot simply give an AI agent broad access and walk away.
“They still have to manage operational security (OPSEC), avoid attribution, control their infrastructure and stop the agent from creating evidence. If it scans the wrong target, contacts a victim or exposes the operator, the consequences can include arrest and prosecution. Criminal liability is a real constraint on offensive autonomy.
“Defenders carry a different risk. A security team whose AI-driven firewall change breaks a VPN may face an outage review, discipline or a lawsuit. The engineer does not usually face an arrest warrant because the agent made a bad change. That makes defensive autonomy a governance problem, not a simple question of whether the technology can act.
“Organizations should reduce that governance and organizational friction by creating pre-approved classes of low-risk, reversible actions, with clear asset ownership, deterministic validation and tested rollback. Changes with broad or uncertain impact should still require human approval. The goal is to remove unnecessary approval friction from routine remediation while keeping consequential actions gated.
“An attacker has to keep an AI agent quiet, scoped and out of the wrong network. A defender has to get an AI agent approved, tested and recoverable. The first is an OPSEC and criminal-liability problem. The second is governance and organizational friction, which defenders can reduce through better ownership, pre-approval and rollback design.”
Lydia Zhang, President & Co-Founder, Ridge Security Technology Inc.:
“The inconvenient truth that Chismon points out in this article has been the reality security teams have been dealing with for years: the imbalance between attackers and defenders in their ability to adopt and operationalize new technologies. AI has obviously widened that gap dramatically.
“But there is also a significant silver lining for defenders: many of the advantages AI gives attackers can also be turned toward defense. AI can help fix vulnerabilities early in the development lifecycle through automated patching, and it can also help remediate vulnerabilities in production.
“We recently demonstrated how an organization can practically combine a security testing tool with a code agent to reduce critical vulnerabilities from 10 to 0 in just four runs.
“So perhaps the challenge is no longer purely technical. The technology is increasingly capable. The bigger challenge is organizational: risk tolerance, processes, accountability, and mindset.”
Donald McFarlane, Board Member, Xcape Inc.:
“Treasury Secretary Scott Bessent articulated a useful starting point this week: accountability. Discussing the Hugging Face incident, he argued that responsibility rests with the humans and organizations deploying these systems, not with an AI agent treated as though it were an independent actor. He has also argued against shielding frontier labs from liability.
“I agree wholeheartedly with that basic principle. More specifically, liability should follow control, causation, intent and duty of care, rather than simply attaching every downstream harm to the person or company who trained the model.
“A malicious user deliberately employing AI to attack someone should bear primary responsibility. An operator that gives an agent powerful credentials, excessive authority and inadequate supervision should be responsible for negligent deployment. Integrators should be accountable for unsafe implementations. Model developers should remain responsible where foreseeable defects, or failures to exercise reasonable care in developing and testing their products, materially contribute to harm.
“That approach also recognizes that responsibility may be shared. Relevant questions would include who controlled what, what risks were reasonably foreseeable, what safeguards were available, and whose acts or omissions materially contributed to the outcome.
“The NCSC is also right that defenders cannot simply mirror attackers. Autonomous defensive action can itself disrupt the systems we are trying to protect, so greater autonomy has to come with governance, bounded authority, recoverability and clear human accountability. Its framework for evaluating potency, scope, criticality, rollout confidence and recoverability is a useful start.
“But I am more optimistic about the defensive side of this equation. AI gives defenders the opportunity to operate at machine speed as well. We should be designing systems that permit progressively greater autonomous action where it can be safely bounded and reversed. And cybersecurity has much to learn from military doctrine and tactics: deception, manoeuvre, shaping the battlespace and channeling adversaries toward ground of the defender’s choosing. AI can make those approaches substantially more powerful.
“AI is an extraordinarily powerful general-purpose technology. We need strong engineering, clearly assigned human accountability, meaningful incident reporting and judicially determinable duties of care. Autonomous software does not somehow break the chain of human responsibility, and we should not create regulatory barriers that only the largest incumbent laboratories can afford.”
John Strand, Owner, Black Hills Information Security:
“Absolutely, AI is going to create more attack opportunities simply because these systems have broad autonomy and more latitude in what they can do, especially when you start looking at open-weight models. But there’s another part of this that I don’t think people fully appreciate. Complexity is the enemy of computer security.
“The more services you have, the more attack surface you create. Even if those services don’t have known vulnerabilities today, AI can rapidly fuzz them, analyze them, and identify weaknesses that attackers may have previously overlooked because finding and exploiting them required significant time and skill.
“AI changes that equation. Vulnerabilities and exploitation opportunities that were previously out of reach for the average attacker are suddenly much more accessible. You no longer need to be an exceptionally skilled vulnerability researcher to find some of these weaknesses. AI can do a tremendous amount of that heavy lifting for you.”
Defenders always should have the advantage. Therefore the balance needs to be reset so that the good guys are the ones that win.
Leave a comment »