AI Changes the Tempo, Not the Fundamentals
The useful question is not whether AI can “fight AI”. It is whether a security team can use it to find relevant signals earlier, investigate them consistently and contain genuine incidents without creating a second source of operational risk.
The UK National Cyber Security Centre’s current assessment to 2027 expects AI to increase the efficiency, frequency and intensity of cyber intrusions. The most important near-term effects are likely to be faster vulnerability research, reconnaissance, social engineering and analysis of stolen data. It does not describe fully autonomous, end-to-end advanced attacks as the normal case by 2027; skilled operators remain involved.
That distinction matters. UK businesses do not need a science-fiction “AI guardian”. They need stronger security foundations, well-bounded assistance and evidence that a defensive model improves the incident workflow.
Map the Threat to a Decision
“Detect threats” is too broad to evaluate. Start with one decision and one accountable owner.
| Threat problem | Useful AI task | Dangerous shortcut | Minimum control |
|---|---|---|---|
| Too many vulnerability findings | Rank by exploitability, exposure and asset importance | Let a model patch production from unverified text | Verified asset inventory, approved patch source and rollback |
| Suspicious email or identity event | Correlate sender, device, login and campaign context | Treat persuasive model prose as proof of compromise | Show source evidence and keep an analyst escalation path |
| Possible lateral movement | Compare activity with role and system baselines | Automatically disable every anomalous account | Constrain actions by identity tier and test a break-glass route |
| Potential exfiltration | Join endpoint, network and data-access signals | Upload raw sensitive logs to an unapproved external model | Minimise fields, control processors and preserve an auditable query trail |
| Attack on an AI-enabled application | Detect prompt injection, unexpected tool calls or data access | Assume a model’s own safety filters protect connected systems | Least privilege, sandboxing, allow-listed tools and output validation |
A prioritisation assistant and an autonomous containment system are different products. Their evaluation, authority and acceptable failure rates should not be combined.
Fix the Inputs Before Adding a Model
AI cannot reconstruct telemetry that was never collected. The NCSC’s March 2026 analysis on frontier AI and cyber defence puts accurate asset inventories, access control, secure configuration and comprehensive logging ahead of experimental automation.
Before a pilot, establish:
- which identities, endpoints, cloud control planes and business applications are in scope;
- whether logs share reliable timestamps, asset identifiers and user identifiers;
- which tier-one systems have missing or delayed telemetry;
- how alerts were resolved and labelled;
- which actions are reversible;
- who may approve isolation, credential revocation or service shutdown;
- how the team operates if the AI service is unavailable.
This baseline is also what makes the related AI cyber-resilience workflow measurable. A lower alert count is not automatically an improvement; the system may simply be suppressing difficult cases.
Build an Evidence-Centred Detection Record
Every AI-assisted alert should produce a record that an analyst can verify without rerunning a private model conversation. At minimum, preserve:
- the source events and their timestamps;
- the asset and identity context used;
- the model or ruleset version;
- the classification, confidence or rank;
- the action proposed or taken;
- the person or policy that authorised it;
- the final incident disposition;
- the feedback returned to the evaluation set.
Free-form explanations can help an analyst read the evidence, but they are not the evidence. If a vendor cannot expose the source records behind a recommendation, it should not control a consequential response.
Security telemetry may also contain personal data, message content or confidential client information. The ICO’s security outcomes guidance requires risk-appropriate technical and organisational measures, including detection, resilience and regular testing. Apply data minimisation and retention rules to the monitoring pipeline rather than keeping every prompt and raw event indefinitely.
Professional-services firms should additionally use the confidentiality patterns in private AI for secure automation.
Use an Automation Ladder
The NCSC warns that automated blocking, quarantine and access revocation can reduce containment time but can also cause disruption or data loss greater than the original attack. Its April 2026 note on AI adoption for cyber defence therefore emphasises permissions, sandboxing, verification and appropriate human oversight.
A practical ladder is:
Level 0: Shadow
The model sees historical or mirrored events but cannot create tickets or change systems. Compare its output with resolved incidents and current controls.
Level 1: Enrich
It adds context, retrieves playbooks, groups related alerts and drafts investigation notes. An analyst still decides severity and action.
Level 2: Recommend
It proposes a bounded response and shows the evidence, likely impact and rollback command. A named person approves execution.
Level 3: Execute Reversible Actions
A policy may permit narrowly defined actions such as blocking a known malicious indicator for a short period or quarantining a low-criticality endpoint. Permissions, duration and affected assets are constrained in advance.
Level 4: High-Impact Response
Disabling privileged identities, changing production infrastructure or interrupting customer services requires explicit human authority unless a separately tested emergency policy governs a precise condition.
“Human in the loop” should mean authority, time and competence to disagree—not an approval button that operators are expected to click.
The Pilot Scorecard
Set thresholds against local risk and analyst capacity before testing. Do not choose them after seeing the model’s results.
| Gate | Evidence required to pass |
|---|---|
| Coverage | All agreed tier-one log sources are present, timely and mapped to owners |
| Detection | On a frozen incident replay set, the new workflow meets the agreed recall and does not regress priority cases found by existing controls |
| Analyst load | False positives and investigation time fit the staffed operating capacity |
| Evidence | Every escalated alert links to source events, system version and proposed action |
| Containment | Every automated action is within its permission boundary, logged and reversible |
| Resilience | The SOC can continue during model, supplier or network failure |
| Abuse testing | Prompt injection, poisoned context, malformed events and privilege-escalation attempts have been tested |
| Fair operation | Monitoring of staff and customers has a documented purpose, lawful basis, access model and retention period |
| Incident drill | The team completes detection, escalation, containment, rollback and communications exercises within its agreed targets |
Track overrides by reason. A high override rate may expose model weakness, but it can also reveal unclear policy or poor source data.
Regulation: Separate Current Law From the Bill
As of 31 July 2026, the Cyber Security and Resilience (Network and Information Systems) Bill is not yet an Act. It completed the Commons and received its Lords second reading on 14 July; Lords committee stage is scheduled for 1 September.
The Bill would extend and update the UK’s NIS framework, including coverage of managed services, data centres and additional incident-reporting arrangements. Organisations should assess likely scope and preserve adaptable evidence, but should not describe proposed duties as law.
Existing duties still matter. Where a cyber incident is also a reportable personal-data breach, the ICO says notification must be made without undue delay and, where feasible, within 72 hours. Detection tooling should therefore feed a tested legal and communications workflow, not merely close a technical ticket.
The organisation’s broader governance evidence can follow the structure in an AI assurance evidence pack. Phishing detection should also be paired with adaptive controls and the human reporting patterns covered in AI-supported phishing training.
Questions for a Cyber-AI Supplier
Before procurement, ask:
- Which customer data is retained, where and for how long?
- Is customer telemetry used to train shared models?
- Can the system operate without sending sensitive payloads outside the approved environment?
- Which model, rule and integration changes are announced or versioned?
- Can every recommendation be traced to source events?
- How are prompt injection, poisoned threat intelligence and malicious files isolated?
- What permissions does the service require, and can they be reduced?
- Can automated actions be allow-listed, time-limited and reversed?
- What happens when the service is unavailable?
- How quickly will the supplier notify customers of a security incident?
- Can evidence and configuration be exported when the contract ends?
A 90-Day Path With Stop Points
During days 1–30, choose one incident class, repair its telemetry and build a frozen replay set. Document the current false-positive load, investigation time and missed-event pattern.
During days 31–60, run in shadow and enrichment modes. Test adversarial inputs, unavailable dependencies and unusual but legitimate administrator behaviour. Review outputs with the analysts who will use them.
During days 61–90, allow only pre-agreed reversible actions. Run an incident exercise and compare the complete workflow with the baseline.
Expand only when the system improves a defined security decision, preserves evidence and stays inside its authority. AI can increase a defender’s speed, but it does not turn weak asset management, missing logs or unsafe permissions into resilience.
Re-run the release tests after a material model, prompt, telemetry, identity or tool change. Track which version produced each recommendation, retain the cited events and make rollback achievable during an incident. Without that change record, an apparently small supplier update can invalidate the evidence used to authorise live response.
