# What the NCSC's new AI research questions mean for you The UK's cyber security agency has listed what is still unproven about AI in security, which helps anyone who buys or uses AI tools. The Assurance Desk. Published 22 October 2026. Last checked 22 October 2026. **The short answer.** The NCSC has added a new chapter on AI to its research problem book. It sets out seven areas of open research on AI in cyber security, across three broad themes ([NCSC, Introducing a new AI chapter in the NCSC research problem book](https://www.ncsc.gov.uk/blogs/introducing-new-ai-chapter-ncsc-research-problem-book), checked 22 October 2026). ## What did the NCSC publish on 20 October 2026? The National Cyber Security Centre (NCSC) published a blog post on 20 October 2026 about its research problem book. It has rewritten the book to include a new chapter called 'AI in cyber security problems' ([NCSC, Introducing a new AI chapter in the NCSC research problem book](https://www.ncsc.gov.uk/blogs/introducing-new-ai-chapter-ncsc-research-problem-book), checked 22 October 2026). Much of the chapter is about agentic AI. The NCSC says agentic AI systems can plan, use tools and take actions across multiple steps ([NCSC, The NCSC research problem book, AI in cyber security problems, AI1, How can organisations re-design cyber defence workflows?](https://www.ncsc.gov.uk/collection/problem-book/ai-cyber/ai1-redesign-workflows-maximise-benefits), checked 22 October 2026). The chapter has three broad themes. The first is using AI to strengthen cyber defence. The second is the security and assurance of AI systems. The third is using data to improve cyber resilience at scale ([NCSC, Introducing a new AI chapter in the NCSC research problem book](https://www.ncsc.gov.uk/blogs/introducing-new-ai-chapter-ncsc-research-problem-book), checked 22 October 2026). A research problem book is a list of questions for researchers. The NCSC says this list is not exhaustive. It is a guide to the questions where academia, industry and government can make progress over the next 5 years ([NCSC, The NCSC research problem book, AI in cyber security problems](https://www.ncsc.gov.uk/collection/problem-book/ai-cyber), checked 22 October 2026). So the chapter asks questions. It does not set rules, and it does not tell any organisation what it must do. The NCSC asks for feedback, more research questions and examples of research already under way ([NCSC, Introducing a new AI chapter in the NCSC research problem book](https://www.ncsc.gov.uk/blogs/introducing-new-ai-chapter-ncsc-research-problem-book), checked 22 October 2026). ## What are the NCSC's AI research questions? The NCSC says many of the assumptions behind today's cyber security practice came before this kind of AI existed. It says that ideas such as vulnerability management, incident response and risk management will need to change ([NCSC, Introducing a new AI chapter in the NCSC research problem book](https://www.ncsc.gov.uk/blogs/introducing-new-ai-chapter-ncsc-research-problem-book), checked 22 October 2026). Each question in the chapter also works as a plain question you can ask a supplier or your own IT team. The table below puts them side by side ([NCSC, The NCSC research problem book, AI in cyber security problems](https://www.ncsc.gov.uk/collection/problem-book/ai-cyber), checked 22 October 2026). **The questions in the NCSC's AI chapter, and a plain question to ask about any AI tool in your own security** | The NCSC's research question | A question you can ask | | --- | --- | | How can organisations redesign cyber defence workflows to get the most from agentic AI? | Did we change how the work is done, or did we add an AI agent to the old process? | | How can AI agents reliably help defenders find, rank and reduce their attack surface? | When the tool ranks our weak points, does it know which systems matter most to the business? | | How can AI strengthen threat detection, triage and incident response? | When the tool flags an alert, can a person see why, and decide what happens next? | | How should autonomous or semi autonomous cyber defence systems be evaluated and assured? | Was the tool tested on systems like ours, or only in a demonstration? | | How can individual AI and machine learning systems be secured throughout their lifecycle? | Who checks the AI system after it goes live, and how often? | | How do we secure current and future AI ecosystems? | Which other companies' models, data and plugins does the tool depend on? | | How can data driven methods improve cyber security analysis, posture and resilience at national scale? | This one is for national bodies, not for a single organisation. | Source: NCSC, The NCSC research problem book, AI in cyber security problems, https://www.ncsc.gov.uk/collection/problem-book/ai-cyber (checked 22 October 2026) ## Why does human oversight run through the whole chapter? The NCSC says one thread runs through all the areas: human and AI working together ([NCSC, Introducing a new AI chapter in the NCSC research problem book](https://www.ncsc.gov.uk/blogs/introducing-new-ai-chapter-ncsc-research-problem-book), checked 22 October 2026). It wants to understand where autonomy adds real value, and where human judgement remains essential. It also wants to know how people can keep meaningful oversight without losing machine speed ([NCSC, Introducing a new AI chapter in the NCSC research problem book](https://www.ncsc.gov.uk/blogs/introducing-new-ai-chapter-ncsc-research-problem-book), checked 22 October 2026). The NCSC also says agentic AI should not remove the need for meaningful human oversight where it matters. Research could help define when human approval is essential, and how people should review or challenge an action the AI recommends ([NCSC, The NCSC research problem book, AI in cyber security problems, AI1, How can organisations re-design cyber defence workflows?](https://www.ncsc.gov.uk/collection/problem-book/ai-cyber/ai1-redesign-workflows-maximise-benefits), checked 22 October 2026). The NCSC has already published practical advice on this. Its blog 'Managing the cyber risk of agentic AI', from 20 August 2026, names three levels of human control. It says not every deployment needs the same degree of autonomy, and its advice should be applied in proportion ([NCSC, Managing the cyber risk of agentic AI](https://www.ncsc.gov.uk/blogs/managing-the-cyber-risk-of-agentic-ai), checked 22 October 2026). That blog is interim advice. The NCSC says formal guidance will build on it and ultimately replace it ([NCSC, Managing the cyber risk of agentic AI](https://www.ncsc.gov.uk/blogs/managing-the-cyber-risk-of-agentic-ai), checked 22 October 2026). Alan Woodward, writing on LinkedIn, made a similar point from the security side. He wrote that safety which lives inside the thing you are trying to secure cannot be the whole answer ([Alan Woodward on LinkedIn](https://www.linkedin.com/posts/woodwardalan_when-constabulary-dutys-to-be-done-activity-7504845317138235392-2ZNr), checked 22 October 2026). **Three levels of human control over an AI agent** - **Human in the loop** - A person approves each action before it happens. - **Human on the loop** - A person monitors the actions and can step in if needed. - **Human out of the loop** - The AI acts on its own, with no human review. From the NCSC's interim advice on agentic AI. The NCSC says the right level depends on how much autonomy an agent needs and the risk involved. Source: NCSC, Managing the cyber risk of agentic AI, https://www.ncsc.gov.uk/blogs/managing-the-cyber-risk-of-agentic-ai (checked 22 October 2026) > "An AI cannot police itself. That duty remains ours." > Alan Woodward, LinkedIn post excerpt > Alan Woodward on LinkedIn, AI Safety Requires More Than Trained Models, Alan W. posted on the topic, https://www.linkedin.com/posts/woodwardalan_when-constabulary-dutys-to-be-done-activity-7504845317138235392-2ZNr (checked 22 October 2026) > [View LinkedIn post](https://www.linkedin.com/posts/woodwardalan_when-constabulary-dutys-to-be-done-activity-7504845317138235392-2ZNr) ## Agentic AI in cyber security: what is still unproven? Some things about agentic AI in cyber security are still unproven, and the chapter says so. A system that performs well in a benchmark or a demonstration may behave differently on live systems ([NCSC, The NCSC research problem book, AI in cyber security problems, AI4, How should autonomous cyber defence systems be evaluated and assured?](https://www.ncsc.gov.uk/collection/problem-book/ai-cyber/ai4-evaluate-autonomous-cyber-defence-systems), checked 22 October 2026). The NCSC also says poor AI support could increase false confidence, miss important context or overwhelm analysts with low quality recommendations ([NCSC, The NCSC research problem book, AI in cyber security problems, AI3, How can AI strengthen threat detection, triage and incident response?](https://www.ncsc.gov.uk/collection/problem-book/ai-cyber/ai3-ai-strengthen-threat-detection-response), checked 22 October 2026). Its August blog adds that safety controls built into AI models give a baseline level of protection. It says they should not be treated as the whole answer ([NCSC, Managing the cyber risk of agentic AI](https://www.ncsc.gov.uk/blogs/managing-the-cyber-risk-of-agentic-ai), checked 22 October 2026). The chapter says assurance must cover more than how well a system performs. It should cover logging, monitoring, explainability, human oversight, misuse, loss of control and misalignment, and it should continue after the system goes live ([NCSC, The NCSC research problem book, AI in cyber security problems, AI4, How should autonomous cyber defence systems be evaluated and assured?](https://www.ncsc.gov.uk/collection/problem-book/ai-cyber/ai4-evaluate-autonomous-cyber-defence-systems), checked 22 October 2026). The NCSC says it has evidence that attackers use capable AI tools, and that AI makes some attacks easier and others faster. Oliver Patel, writing on LinkedIn about AI governance, put the wider debate in proportion. He wrote that for most organisations, the doomsday scenarios are not the most relevant AI challenge they are managing ([NCSC, The NCSC research problem book, AI in cyber security problems](https://www.ncsc.gov.uk/collection/problem-book/ai-cyber) and [Oliver Patel on LinkedIn](https://www.linkedin.com/posts/oliver-patel_mapping-official-frameworks-and-guidelines-activity-7506678366461227008-bmig), checked 22 October 2026). > "For most organisations, the doomsday scenarios are not the most relevant AI challenge they are managing." > Oliver Patel, LinkedIn post excerpt > Oliver Patel on LinkedIn, Agentic AI Governance Frameworks and Guidelines, Oliver Patel, AIGP, CIPP/E, MSc posted on the topic, https://www.linkedin.com/posts/oliver-patel_mapping-official-frameworks-and-guidelines-activity-7506678366461227008-bmig (checked 22 October 2026) > [View LinkedIn post](https://www.linkedin.com/posts/oliver-patel_mapping-official-frameworks-and-guidelines-activity-7506678366461227008-bmig) ## What does this mean if you buy AI security tools or services? If you buy AI security tools or services, start from one point: defenders cannot use AI as freely as attackers do. The NCSC says they must work within organisational, operational and governance limits ([NCSC, The NCSC research problem book, AI in cyber security problems](https://www.ncsc.gov.uk/collection/problem-book/ai-cyber), checked 22 October 2026). To benefit fully from agentic AI, the NCSC says organisations usually need to redesign their workflows, not simply add agents to them ([NCSC, The NCSC research problem book, AI in cyber security problems, AI1, How can organisations re-design cyber defence workflows?](https://www.ncsc.gov.uk/collection/problem-book/ai-cyber/ai1-redesign-workflows-maximise-benefits), checked 22 October 2026). Peter Haigh, the NCSC's Deputy Chief Technology Officer, wrote about agentic AI in cyber defence workflows ([NCSC, The NCSC research problem book, AI in cyber security problems, AI1, How can organisations re-design cyber defence workflows?](https://www.ncsc.gov.uk/collection/problem-book/ai-cyber/ai1-redesign-workflows-maximise-benefits), checked 22 October 2026). The NCSC says research is still needed on how permissions, approval points, logging and recovery should work for AI agents in security tools. These are fair questions for a supplier. Ask what the tool may do, who approves its actions, what it records and how a mistake is undone ([NCSC, The NCSC research problem book, AI in cyber security problems, AI1, How can organisations re-design cyber defence workflows?](https://www.ncsc.gov.uk/collection/problem-book/ai-cyber/ai1-redesign-workflows-maximise-benefits), checked 22 October 2026). The NCSC says autonomous systems need logging, monitoring and review. Then an organisation can see what the system did, why it acted and whether it is changing ([NCSC, The NCSC research problem book, AI in cyber security problems, AI4, How should autonomous cyber defence systems be evaluated and assured?](https://www.ncsc.gov.uk/collection/problem-book/ai-cyber/ai4-evaluate-autonomous-cyber-defence-systems), checked 22 October 2026). Its August blog gives practical steps. It says AI agents should always run in a sandbox that controls what they can connect to. Where mistakes would have serious consequences, it recommends naming the people responsible for the agent's activity ([NCSC, Managing the cyber risk of agentic AI](https://www.ncsc.gov.uk/blogs/managing-the-cyber-risk-of-agentic-ai), checked 22 October 2026). If an incident is found, it says you should always be able to 'pull the plug' and stop the agent at once ([NCSC, Managing the cyber risk of agentic AI](https://www.ncsc.gov.uk/blogs/managing-the-cyber-risk-of-agentic-ai), checked 22 October 2026). **Questions to ask before an AI tool acts in your security** - What is the tool allowed to change on its own? - Which actions need a person to approve them? - What does it log, and who reads the logs? - How do we undo an action that was wrong? - Can we stop it at once if something goes wrong? - Does it run in a sandbox that limits what it can connect to? - Who is named as responsible for what it does? - Was it tested on systems like ours, or only in a demonstration? - Who checks it after it goes live? Taken from the NCSC's open research questions and its interim advice on agentic AI. They are questions to ask, not rules that the NCSC has set. Source: NCSC, The NCSC research problem book, AI in cyber security problems, AI1, How can organisations re-design cyber defence workflows?, https://www.ncsc.gov.uk/collection/problem-book/ai-cyber/ai1-redesign-workflows-maximise-benefits (checked 22 October 2026); NCSC, The NCSC research problem book, AI in cyber security problems, AI4, How should autonomous cyber defence systems be evaluated and assured?, https://www.ncsc.gov.uk/collection/problem-book/ai-cyber/ai4-evaluate-autonomous-cyber-defence-systems (checked 22 October 2026); NCSC, Managing the cyber risk of agentic AI, https://www.ncsc.gov.uk/blogs/managing-the-cyber-risk-of-agentic-ai (checked 22 October 2026) > "Safe and effective adoption of agentic AI into cyber defence workflows is a challenge facing organisations today." > Peter Haigh, NCSC research problem book > NCSC, The NCSC research problem book, AI in cyber security problems, AI1, How can organisations re-design cyber defence workflows?, https://www.ncsc.gov.uk/collection/problem-book/ai-cyber/ai1-redesign-workflows-maximise-benefits (checked 22 October 2026) ## What does this mean for a smaller organisation? For a smaller organisation, the NCSC's point about incidents matters most. It says the hardest problem in many incidents is not collecting information. It is understanding what matters and deciding what to do next. Speed from AI is only valuable if it leads to better decisions ([NCSC, The NCSC research problem book, AI in cyber security problems, AI3, How can AI strengthen threat detection, triage and incident response?](https://www.ncsc.gov.uk/collection/problem-book/ai-cyber/ai3-ai-strengthen-threat-detection-response), checked 22 October 2026). Harry W, the NCSC's Technical Director for Incident Management, wrote about smaller organisations with limited security resources ([NCSC, The NCSC research problem book, AI in cyber security problems, AI3, How can AI strengthen threat detection, triage and incident response?](https://www.ncsc.gov.uk/collection/problem-book/ai-cyber/ai3-ai-strengthen-threat-detection-response), checked 22 October 2026). If your organisation only uses everyday AI tools, most of the chapter is not aimed at you. The NCSC's August blog makes a point that still applies. Not every use of AI needs the same degree of autonomy ([NCSC, Managing the cyber risk of agentic AI](https://www.ncsc.gov.uk/blogs/managing-the-cyber-risk-of-agentic-ai), checked 22 October 2026). If you want outside help with cyber security, the NCSC runs schemes that list approved firms. The Assurance Desk recorded the NCSC's listings on 19 September 2026. Firms listed then as NCSC Cyber Advisors included Arcanum Cyber Security, Logiq Consulting and RightCue Consulting Services ([The Assurance Desk, Arcanum Cyber Security (Arcanum Information Security Limited) profile](https://theassurancedesk.com/advisers/arcanum-cyber-security), [The Assurance Desk, Logiq Consulting Ltd profile](https://theassurancedesk.com/advisers/logiq-consulting) and [The Assurance Desk, RightCue Consulting Services Ltd profile](https://theassurancedesk.com/advisers/rightcue), checked 22 October 2026). > "For smaller organisations with limited security resources, getting this right could make the difference between identifying a compromise early and discovering it long after the damage has been done." > Harry W, NCSC research problem book > NCSC, The NCSC research problem book, AI in cyber security problems, AI3, How can AI strengthen threat detection, triage and incident response?, https://www.ncsc.gov.uk/collection/problem-book/ai-cyber/ai3-ai-strengthen-threat-detection-response (checked 22 October 2026) ## What to do 1. Read the NCSC's new chapter yourself. It is a set of research questions, not a rulebook ([NCSC, Introducing a new AI chapter in the NCSC research problem book](https://www.ncsc.gov.uk/blogs/introducing-new-ai-chapter-ncsc-research-problem-book) and [NCSC, The NCSC research problem book, AI in cyber security problems](https://www.ncsc.gov.uk/collection/problem-book/ai-cyber), checked 22 October 2026). 2. Decide how much autonomy each AI tool really needs, and which of its actions need a person to approve them ([NCSC, The NCSC research problem book, AI in cyber security problems, AI1, How can organisations re-design cyber defence workflows?](https://www.ncsc.gov.uk/collection/problem-book/ai-cyber/ai1-redesign-workflows-maximise-benefits) and [NCSC, Managing the cyber risk of agentic AI](https://www.ncsc.gov.uk/blogs/managing-the-cyber-risk-of-agentic-ai), checked 22 October 2026). 3. Ask suppliers how their tool was tested, and whether it was tested outside a demonstration ([NCSC, The NCSC research problem book, AI in cyber security problems, AI4, How should autonomous cyber defence systems be evaluated and assured?](https://www.ncsc.gov.uk/collection/problem-book/ai-cyber/ai4-evaluate-autonomous-cyber-defence-systems), checked 22 October 2026). 4. Ask what the tool logs, who reviews it after it goes live, and how you can stop it at once ([NCSC, The NCSC research problem book, AI in cyber security problems, AI4, How should autonomous cyber defence systems be evaluated and assured?](https://www.ncsc.gov.uk/collection/problem-book/ai-cyber/ai4-evaluate-autonomous-cyber-defence-systems) and [NCSC, Managing the cyber risk of agentic AI](https://www.ncsc.gov.uk/blogs/managing-the-cyber-risk-of-agentic-ai), checked 22 October 2026). 5. If you have research or experience to share, the NCSC asks for feedback on the chapter ([NCSC, Introducing a new AI chapter in the NCSC research problem book](https://www.ncsc.gov.uk/blogs/introducing-new-ai-chapter-ncsc-research-problem-book), checked 22 October 2026). ## Common questions ### What is agentic AI? The NCSC says agentic AI systems can plan, use tools and take actions across multiple steps ([NCSC, The NCSC research problem book, AI in cyber security problems, AI1, How can organisations re-design cyber defence workflows?](https://www.ncsc.gov.uk/collection/problem-book/ai-cyber/ai1-redesign-workflows-maximise-benefits), checked 22 October 2026). ### Is the NCSC research problem book guidance I must follow? No. It is a guide to research questions for academia, industry and government over the next 5 years. The NCSC says the list is not exhaustive ([NCSC, The NCSC research problem book, AI in cyber security problems](https://www.ncsc.gov.uk/collection/problem-book/ai-cyber), checked 22 October 2026). ### Does the NCSC say AI should run cyber defence without people? No. The NCSC says agentic AI should not remove the need for meaningful human oversight where it matters ([NCSC, The NCSC research problem book, AI in cyber security problems, AI1, How can organisations re-design cyber defence workflows?](https://www.ncsc.gov.uk/collection/problem-book/ai-cyber/ai1-redesign-workflows-maximise-benefits), checked 22 October 2026). ### Does AI make incident response better because it is faster? Not on its own. The NCSC says speed is only valuable if it leads to better decisions ([NCSC, The NCSC research problem book, AI in cyber security problems, AI3, How can AI strengthen threat detection, triage and incident response?](https://www.ncsc.gov.uk/collection/problem-book/ai-cyber/ai3-ai-strengthen-threat-detection-response), checked 22 October 2026). ## Where next - [AI agents: what to check before they act](https://theassurancedesk.com/guides/ai-agents-permissions-and-approvals.md) - [What to ask an AI supplier before you buy](https://theassurancedesk.com/guides/what-to-ask-ai-supplier-before-you-buy.md) - [Can staff paste client data into ChatGPT or Copilot?](https://theassurancedesk.com/guides/staff-client-data-chatgpt-copilot.md) ## Sources - NCSC, Introducing a new AI chapter in the NCSC research problem book: https://www.ncsc.gov.uk/blogs/introducing-new-ai-chapter-ncsc-research-problem-book (checked 22 October 2026) - NCSC, The NCSC research problem book, AI in cyber security problems, AI1, How can organisations re-design cyber defence workflows?: https://www.ncsc.gov.uk/collection/problem-book/ai-cyber/ai1-redesign-workflows-maximise-benefits (checked 22 October 2026) - NCSC, The NCSC research problem book, AI in cyber security problems: https://www.ncsc.gov.uk/collection/problem-book/ai-cyber (checked 22 October 2026) - NCSC, Managing the cyber risk of agentic AI: https://www.ncsc.gov.uk/blogs/managing-the-cyber-risk-of-agentic-ai (checked 22 October 2026) - Alan Woodward on LinkedIn: https://www.linkedin.com/posts/woodwardalan_when-constabulary-dutys-to-be-done-activity-7504845317138235392-2ZNr (checked 22 October 2026) - NCSC, The NCSC research problem book, AI in cyber security problems, AI4, How should autonomous cyber defence systems be evaluated and assured?: https://www.ncsc.gov.uk/collection/problem-book/ai-cyber/ai4-evaluate-autonomous-cyber-defence-systems (checked 22 October 2026) - NCSC, The NCSC research problem book, AI in cyber security problems, AI3, How can AI strengthen threat detection, triage and incident response?: https://www.ncsc.gov.uk/collection/problem-book/ai-cyber/ai3-ai-strengthen-threat-detection-response (checked 22 October 2026) - Oliver Patel on LinkedIn: https://www.linkedin.com/posts/oliver-patel_mapping-official-frameworks-and-guidelines-activity-7506678366461227008-bmig (checked 22 October 2026) - The Assurance Desk, Arcanum Cyber Security (Arcanum Information Security Limited) profile: https://theassurancedesk.com/advisers/arcanum-cyber-security (checked 22 October 2026) - The Assurance Desk, Logiq Consulting Ltd profile: https://theassurancedesk.com/advisers/logiq-consulting (checked 22 October 2026) - The Assurance Desk, RightCue Consulting Services Ltd profile: https://theassurancedesk.com/advisers/rightcue (checked 22 October 2026) --- **Who publishes this.** The Assurance Desk is published by Add-Venture Advisory Ltd, company number 11854524, registered in England and Wales. The same owner runs Avouch, a marketing agency that sells AI visibility services to firms of the kind this site covers. That is a conflict of interest, and it is disclosed here.