AI for defence
Using AI in cyber defence without over-trusting it
The NCSC encourages using AI to strengthen defences. The condition is that people check what it produces and that the tool itself is secured.
Last reviewed against NCSC, Department for Science, Innovation and Technology and OWASP GenAI Security Project. Sources
The case for
What the NCSC says
The NCSC recommends using AI to strengthen defences and notes that suppliers already use it to find and fix vulnerabilities [3]. It also advises preparing for a wave of patches that address long-standing technical debt [3]. A team that cannot absorb that volume of fixes will fall behind, so patching capacity matters as much as the tool.
The case for caution
Output needs checking
The NCSC lists hallucinations, meaning confident but incorrect output, among the flaws of AI models [2]. OWASP's 2025 list includes improper output handling and misinformation [8]. For defence, that means an alert summary, a suggested fix or a block rule is a draft until someone confirms it.
Safe use patterns
Secure the tool
Defence AI is a target too
A defensive AI tool reads logs, tickets and emails, which are content an attacker can influence. The prompt injection risk applies to it as much as to any other tool [1]. Give it the least access it needs [9].
Where defenders can use it
Match the tool to a task you already understand, such as summarising alerts, drafting reports or flagging patterns for an analyst to review. Keep a named person accountable for each conclusion, in line with the NCSC's call for active human oversight [3].
Fundamentals still matter
The NCSC says good cyber security fundamentals protect against both AI-assisted and other threats [3].
Next
Related guides
See the controls guide for the working set, and AI agent security if the tool acts on its own.
Keep reading
Read next
Suppliers
Security questions UK buyers should put to AI suppliers: prompt injection claims, supply chain, data handling, access and logging, based on NCSC advice.
Read the guide
What it is
What AI security means: securing AI systems and using AI safely in defence, the main weaknesses, and the UK guidance that applies to your organisation.
Read the guide
OWASP list
The OWASP Top 10 for LLM applications 2025: all ten risks listed, which matter most for UK organisations, and how to use the list in a review.
Read the guideHow CyPro can help
Need a hand planning for this?
Understanding the change is one job. Working out what it means for your systems, your suppliers and your roadmap is several more. CyPro's consultants can take any of them on.
Fractional CISO for the board
A senior security lead who advises the board on what to fix first, what to accept and what to tell customers, and owns the decision record.
More on cypro.co.uk
Hardening and segmentation
Our consultants put the controls in place that limit the damage when something is missed: firewall rules, network isolation and tighter admin access.
More on cypro.co.uk
Penetration testing
A focused test of your systems and the controls around them, so you know they hold before an attacker finds out for you.
More on cypro.co.uk
Vulnerability scanning
Find every internet-facing system you run, including the forgotten ones, and see which are still on a vulnerable build.
See the scanning service
24/7 security monitoring
Our SOC analysts watch your systems day and night for the signs of an attack in progress: unexpected processes, new outbound connections, logins that do not fit.
More on cypro.co.uk
Incident response
If you may already be compromised, our responders contain it, preserve the evidence, find out what was touched and get you running again safely.
More on cypro.co.uk
Plan ahead
Want a plan for your organisation?
AI security starts with knowing which tools are in use, who owns them and what they can reach. CyPro can help set the governance, accountability and controls around that.