What happened
On 20 October 2026 the UK NCSC re-wrote its research problem book to include a new chapter, 'AI in cyber security', setting out seven research problem areas across three broad themes: using AI to strengthen cyber defence; the security and assurance of AI systems themselves; and using data-driven methods to improve cyber resilience at scale. A recurring theme is human-AI collaboration — where autonomy provides genuine value, where human judgement stays essential, and how meaningful oversight is maintained at machine speed.
Why it matters
This is authoritative direction from a leading national cyber security body on where the most critical AI-security research gaps lie, and it explicitly notes that many assumptions underpinning today's vulnerability management, incident response and risk management predate generative and agentic AI and need to evolve. It feeds directly into NCSC guidance and the Cyber Shield initiative, and is a useful signal for anyone prioritising AI-security research or engineering investment in the UK. It frames research problems rather than prescribing controls, so it is guidance rather than a normative framework.
Action needed
AI-security researchers, vendors and UK critical-infrastructure operators should review the seven problem areas and the NCSC's call for feedback, and align research/roadmap priorities to the identified defence, assurance, resilience and human-oversight gaps.