Britain's National Cyber Security Centre (NCSC) has named seven research problems in artificial intelligence and cyber security that it wants academics, companies and government researchers to work on, the agency said in a blog post Tuesday. The list is not regulation, but it shows where the cyber agency of a Five Eyes intelligence partner sees the biggest unsolved problems as organizations hand security work to AI agents.
What Happened
The NCSC added a chapter, "AI in Cyber Security Problems," to its research problem book, a standing list of questions it wants outside researchers to tackle. The agency's technical director for cyber AI research and a principal AI researcher on secondment to the agency introduced it in a blog post.
The chapter is built on three themes: AI that helps defenders find vulnerabilities, harden systems and respond to threats; the security of AI and machine-learning systems themselves; and data-driven methods for understanding cyber resilience across the whole country. Under them sit seven questions:
- How organizations can redesign cyber defense workflows to get the most from agentic AI, meaning systems that plan, use software tools and act with some autonomy.
- How AI agents can reliably help defenders find, rank and shrink their attack surface, the set of systems and entry points an attacker could target.
- How AI can strengthen threat detection, triage and incident response.
- How autonomous or semi-autonomous defense systems should be evaluated and assured.
- How individual AI and machine-learning systems can be secured throughout their lifecycle.
- How current and future AI ecosystems can be secured.
- How data-driven methods can improve security analysis and resilience at national scale.
Running through all of them, the NCSC says, is human-AI collaboration: which defense tasks suit which level of autonomy, where human judgment stays essential, and how to keep meaningful oversight as systems scale.
Why It Matters
The authors argue that core security practices, including vulnerability management, incident response and risk management, were designed before today's AI systems and will need rethinking. For boards and security leaders, the fourth and fifth questions stand out. A national cyber agency is saying there is not yet a settled way to test and trust a defensive agent that acts on its own, or to secure an AI system from development through retirement. Organizations already giving agents access to security tooling are working in that gap.
The chapter also notes that attackers are using AI to lower the barrier to offensive work, while defenders operate under organizational and governance constraints attackers do not face. The blog adds that AI capability alone will not deliver the agency's "Cyber Shield" goal of AI-enhanced defense; questions of system design, assurance and trust have to be answered too.
What to Watch
The NCSC is asking for comments on the challenges, suggested research questions and examples of current or planned work through its problem book feedback form. Signals to watch are whether the agency follows with funded research calls, and whether its answers on assuring autonomous defense feed into firmer guidance for organizations deploying AI agents.
