NCSC: "One does not simply defend agentically"

What it is

A risk framework for deciding which defensive security tasks can safely be automated with agentic AI, from NCSC CTO for Architecture Dave Chismon. The core mechanism is a three-dimension scoring model for any proposed automated defensive action.

How it works

Chismon proposes scoring a candidate automation along three axes:

• Potency — does it merely advise a human, or does it act directly on a system? Low-potency ("advise a human") is the safer starting point.
• Harm to the business — could the action itself break something (e.g., a patch takes down a VPN, a firewall rule breaks a business function)?
• Scope of control — is the action tightly bounded (e.g., limited to a single user account or single computer) or broad?

He grounds this in three principles already visible in mature practices like SOC triage and vulnerability scanning: technology detects, humans act on the result; detection itself must not harm the organisation; and any automated response must be tightly scoped. He cites existing SOAR deployments as the rare case where remedial action is automated — and notes this only works because each rule is individually crafted, tested, and "highly deterministic."

Preconditions / Affected

Applies to any organisation considering agentic/autonomous AI for defensive (not offensive) security operations — particularly those running or planning SOC, SOAR, vulnerability scanning, or detection pipelines.

What to do

• Start automation with low-potency, advisory tasks: AI-assisted log/traffic summarisation and vulnerability triage, rather than direct system actions.
• Prefer automating against systems that are easy to recover ("cattle, not pets") before extending agentic action to fragile legacy systems.
• Before trusting any "low risk" automated action, invest in deterministic proof it's actually low risk — e.g., using AI to conclusively enumerate all client connection routes from traffic logs, or to reverse-engineer a binary to establish the exact set of network calls or processes it could ever spawn.
• Treat SOAR-style deterministic, individually-tested rules as the template for any remedial automation, rather than open-ended agentic response.

Caveats

Chismon is explicit this is a proposed framework, not a validated one — the deterministic-proof techniques for traffic/binary analysis are posed as open research questions NCSC wants addressed (to be detailed in a forthcoming "AI for Cyber Defence" problem book), not as solved or available tooling.