NCSC's AI research chapter, 20 October 2026: 7 problems, 33 strands, and no UK code or guideline named

Seven problems, 33 strands, and no UK code, guideline or standard named

On Tuesday 20 October 2026 the NCSC published a blog saying it has "re-written our NCSC research problem book" to include "an entirely new chapter", "AI in cyber security problems". The chapter is eight pages on ncsc.gov.uk: an introduction and seven problems, labelled AI1 to AI7. Counting the headings under "Strands or sub-problems" on the seven problem pages gives 33 strands (derived: 4, 5, 4, 4, 5, 6 and 5). The eight pages run to 4,827 words (derived).

A text search of those eight pages finds the Code of Practice for the Cyber Security of AI named 0 times (derived). The same is true of the NCSC's own Guidelines for secure AI system development, the ETSI standard on securing AI, the AI Security Institute, Cyber Essentials and the Cyber Assessment Framework. The word "guidance" appears 0 times. The seven problem pages carry 0 outbound links (derived from the page source); the introduction links to two NCSC blogs and a feedback form. The UK government published that Code on 31 January 2025, 627 days before the chapter (derived). Some published material bears on what the chapter asks. The chapter points to none of it.

What the count does not establish matters as much. It does not show that the NCSC is unaware of those documents, that no answer exists, or that the chapter is badly made. A research problem book exists to say what is not yet known, and this one says its list "is not exhaustive". It is also not a plan. It sets no requirement, no end date, no funding and no measure of success (each checked below). It invites "academia, industry and government" to make progress over "the next 5 years". This briefing reads the chapter for what it asks, what a defender can use today, and what stays open.

Method and time stamp. The pages were read from ncsc.gov.uk, gov.uk and the other publishers' own sites between about 11:46 and 12:02 BST on Tuesday 20 October 2026, with saved copies. The blog, the chapter introduction and all seven problem pages were read in full. Three things were not: the joint guidance "Careful adoption of agentic AI services" (the Australian page did not answer from the reading machine, so it is described only as the NCSC describes it), the 50-page implementation guide to the Code (named on gov.uk, not opened), and an Internet Archive capture of the earlier edition (the archive refused the request), so what changed in the older chapters cannot be read from an archive here. The blog, the eight chapter pages, the book introduction and the update by default page were re-read at about 12:17 BST and had not changed. Nothing was typed into the NCSC's feedback form.

What the chapter asks: seven questions, three themes the pages do not label

The blog says the chapter "identifies seven areas spanning three broad themes": the use of AI to strengthen cyber defence, the security and assurance of AI systems themselves, and the use of data-driven methods to improve cyber resilience at scale. A common thread, it says, is human-AI collaboration. The chapter introduction names the same three areas in slightly different words. Neither page says which problem sits under which theme. The grouping below is this briefing's, made by order and wording (derived), and it has one soft joint: AI4 is about assuring defence systems that are themselves AI, so it can be read under either of the first two themes.

The seven problems as titled on the NCSC's pages (read 20 October 2026), with the number of strands under each, counted from the page headings, and this briefing's grouping by theme.

The NCSC's question	Strands	Theme (derived)
AI1: How can organisations re-design cyber defence workflows to maximise the benefits of agentic AI?	4	Using AI for defence
AI2: How can AI agents reliably help defenders identify, prioritise and reduce their attack surface?	5	Using AI for defence
AI3: How can AI strengthen threat detection, triage and incident response?	4	Using AI for defence
AI4: How should autonomous or semi-autonomous cyber defence systems be evaluated and assured?	4	Using AI for defence (could read as assurance of AI)
AI5: How can individual AI and machine learning systems be secured throughout their lifecycle?	5	Security of AI systems
AI6: How do we secure current and future AI ecosystems?	6	Security of AI systems
AI7: How can data-driven methods improve cyber security analysis, posture and resilience at national scale?	5	Data methods at national scale

By that grouping, 17 of the 33 strands (51.5 per cent) sit under using AI for defence, 11 (33.3 per cent) under the security of AI systems and 5 (15.2 per cent) under national-scale data methods (derived). Put another way, 22 strands ask how to use AI and 11 ask how to secure it. If AI4 is read as assurance of AI systems, the split becomes 13, 15 and 5. Either way the weight is on using AI, which is also what the NCSC is building towards. The introduction says finding answers matters to "the NCSC and the Department for Digital, Culture, Media and Sport (DCMS) work on Cyber Shield", and the closing statement on AI1 calls Cyber Shield its "ultimate ambition of our Cyber Shield initiative". The interest is stated on the page: the NCSC wrote the chapter, runs the problem book and is building Cyber Shield with a government department, so the agenda points where that programme needs answers.

The book's introduction says each problem has "a statement from an NCSC expert explaining why this problem is a priority". On the seven pages, five closing statements are signed by NCSC roles (the Deputy Chief Technology Officer, two Technical Directors, a Senior Researcher in Security of AI and a Deputy Director in the National Resilience Directorate). One, on AI6, is signed by an outside contributor who leads an OWASP agentic security initiative. One is missing: AI4, the problem on how autonomous defence systems should be evaluated and assured, has no closing statement (derived, from the page source).

Three small things on the pages, noted as read and not as accusations. The AI pages print "Published 20 October 2026" beside "Reviewed 10 July 2024" and "Version 1.1", a review date 832 days before the publication date (derived). The book's introduction still says "The newest problem book chapter covers hardware security" and that further chapters will cover areas "such as socio-technical or cyber physical", though a cyber-physical chapter and this AI chapter are both in its navigation. And on 21 September the NCSC said it would be publishing its "‘AI for Cyber Defence’ problem book soon". 29 days later (derived) the chapter arrived under a wider title that adds the security of AI systems and national-scale data methods.

Which problems already have a published UK document you can read today

For each problem, the table lists the UK government documents read for this briefing whose own text addresses the problem's subject, and how formal each is. It is a judgement, shown in full so it can be disputed. A document that touches a problem does not answer it: the question here is whether something exists to read, not whether the research is done.

UK government documents read on 20 October 2026 that touch each problem, with their kind and where they stop. "None found" means none in the pages read, not that none exists.

Problem	Published UK documents read that touch it	Kind, and where it stops
AI1 redesign defence workflows for agents	NCSC blog, 20 August 2026, on managing the cyber risk of agentic AI: three oversight models, a unique identity for each agent, short-lived credentials, logging, emergency shutdown. NCSC blog, 21 September 2026: five dimensions, each scored 0 to 4, to rate the risk of a defensive action.	Interim advice and an opinion blog. The 20 August blog says the NCSC is developing formal guidance which will "build upon, and ultimately supersede, this blog". Neither redesigns a defence workflow.
AI2 agents reduce the attack surface	NCSC blog, 30 March 2026, with an AI Security Institute co-author: attack-surface reduction is the first of three "top bets". Vulnerability management guidance v2.1 and the 1 May 2026 patch wave blog.	A blog on AI, and formal guidance with 0 AI terms in the pages read (derived). The blog says most tools "still only identify problems rather than fix them".
AI3 detection, triage and incident response	NCSC Intelligent security tools guidance, published 18 April 2019, version 1.0, with a note: "This guidance is currently under review."	The guidance the NCSC points to for buying AI-based security tools is 2,742 days old (derived). The 30 March blog covers detection and response as two of its bets.
AI4 evaluate and assure autonomous defence	None found that sets out how to evaluate or assure an autonomous defence system. Nearest: the 21 September blog rates the risk of an action, not a system; the 20 August blog says "judge" models should be "independently evaluated for performance"; the AI Security Institute's cyber range research tests models as attackers.	No test, baseline or pass mark for a defence system in any page read.
AI5 secure AI systems across their lifecycle	DSIT Code of Practice for the Cyber Security of AI, 31 January 2025: 13 principles in five lifecycle phases. NCSC Guidelines for secure AI system development, 27 November 2023. ETSI EN 304 223 V2.1.1, December 2025.	The Code is a "voluntary Code of Practice". The Code and the standard use the word agent 0 times (derived). They set principles for the systems. Neither is a method for assuring one deployment (this briefing's reading).
AI6 secure AI ecosystems and supply chains	Code principles 7 (supply chain), 11 (updates) and 12 (monitoring) cover parts of it. NCSC blogs on agentic AI, 15 May and 20 August 2026. The joint guidance "Careful adoption of agentic AI services" is named by the NCSC and was not read.	In part. Nothing read covers multi-agent ecosystems. The AI6 closing statement says "Assurance built for individual systems and human-speed oversight has not kept pace."
AI7 data methods at national scale	None found that is a method. Nearest: the Cyber Shield blog, 7 July 2026, lists "National-level scanning" and "analysis of aggregated data to understand national level exposure" as a planned function.	An intended capability, with no method, data model, date or funding stated.

By this reading, one problem (AI5) has current code and guidance written for its subject and one (AI6) has it in part, which is 2 of 7. Two (AI1, AI2) have interim advice only, one (AI3) has guidance from 2019 marked for review, and two (AI4, AI7) have nothing found in the pages read (derived judgement). The two problems with a code behind them are the two about securing AI. None of the five about using AI, which carry 22 of the 33 strands, has current formal guidance written for it. The NCSC has not ignored them: the blogs above exist. But it calls its August blog interim advice that formal guidance will supersede.

One gap is easy to count. Agentic AI dominates the chapter, with 22 mentions of "agentic" and 54 of "agent" in all (derived). It is absent from the Code, which says "agent" 0 times in about 4,700 words, and from the ETSI standard, 0 times in about 6,000 words (derived). The NCSC blog of 15 May says the standard outlines requirements for AI systems "writ large, including agentic systems". Both statements can be true: a standard can cover agents without using the word. A reader cannot tell which controls apply to an agent without reading each against it, and nothing the chapter points to does that for them.

Stated and not stated: what the chapter commits to

"Not stated" means not found in the eight pages read in full, using a text search where a count is given. It does not mean the information does not exist elsewhere.

What the NCSC's chapter pages (20 October 2026), the book introduction and the feedback form state, and what they do not.

The question	Stated	Not stated
Is it a requirement?	The list is "a guide to the types of research questions". The word "must" appears twice, neither time as a duty on an organisation, and "shall" 0 times (derived).	Any duty on a UK organisation, or any link to a regulator, a law or a procurement rule.
By when?	The chapter says "the next 5 years". The book introduction says "the next decade" and "five to ten years".	An end year (derived: 2031), a review date, or a date for an answer to any of the seven.
Who pays?	The blog welcomes feedback, suggestions and examples of research, and points to a form.	Funding, a budget, a grant or a call. The words "fund" and "grant" appear 0 times (derived).
How is an answer judged?	AI4 asks how autonomous systems should be compared "with human-only teams and human-AI teams". AI2 wants metrics that are "transparent and meaningful".	A measure, a threshold or a pass mark for "reliably", "meaningful" or "secure enough". "Threshold" and "deadline" appear 0 times (derived).
What does it build on?	Two NCSC blogs and a form. The chapter says "we have evidence that capable AI tools are being used by threat actors".	The Code of Practice, the Guidelines or the ETSI standard, named 0 times. The evidence for threat actors' use is not cited on the page.
What happens to a submission?	The form asks for a name, an email address, a title, a summary of "250 words or fewer", the area and any previous relationship with the NCSC.	A reply, a publication, a review time, or how a result would reach guidance.

Read together, the pages ask for research and promise nothing in return. That is normal for a problem book. The consequence for a UK organisation is that none of the seven questions will be answered on a date you can plan against, so any plan that waits for an answer, such as a procurement that waits for a method to assure autonomous defence (AI4), has no date to wait for. The same pattern, a government document on AI agents with many numbered items and no deadline, is in this site's briefing on the US guidance for testing AI agents, which counted 50 numbered items and 0 deadlines.

Six friendly names, and what each leaves open

A friendly name is a label that sounds like a control and is not one. The chapter uses several. The table quotes how the pages use each and what they leave undefined.

How the eight chapter pages and the blog use six terms, with what the pages do not define. Quotations are short and exact; counts are by text search (derived).

Term	How the pages use it	Not defined
AI in cyber security	A "dual challenge": how defenders "make effective use of AI while also managing the security, safety and operational risks it introduces".	Two directions share one name: AI as the defender's tool (AI1 to AI4, AI7) and AI as the thing to secure (AI5, AI6). "Does it cover us?" needs the answer "which one?".
Agentic AI	AI1: systems that "can plan, use tools and take actions across multiple steps". The introduction: "plan and act with minimal human intervention". The blog: "increasing autonomy".	Three descriptions and no threshold: how many steps, how little intervention or how much autonomy makes a system agentic.
Human-AI collaboration	"a cross-cutting underlying theme", also "(or human-machine teaming)". Research is needed on "different levels of autonomy".	The levels are not listed. Two NCSC blogs list some (three oversight models on 20 August, five scored dimensions on 21 September). The chapter uses neither scale.
Meaningful oversight	Used in the introduction and twice in AI1, once in the strand that names the risk of "approval fatigue". "Meaningful" appears 4 times in all, once about metrics (derived).	What makes oversight meaningful: how many approvals, how fast, and with what power to refuse.
Assurance, assured	AI4: "Assurance also needs to cover more than technical performance", then a list: "logging, monitoring, explainability, human oversight, misuse, loss of control and misalignment". AI5 asks for ways to show a system is "secure enough for its intended purpose".	A list of properties, not a standard of evidence: no required evidence, no assessor, no meaning of "enough". AI5 itself says a bespoke assessment for every deployment is unlikely to scale.
Frontier AI	The blog says it once ("latest frontier AI capabilities"). The eight chapter pages use the word 0 times and say "agentic AI" instead. The NCSC's 30 March blog defines frontier models as "the most capable models available at any given time".	A moving target: which models, as of when. By the NCSC's own definition the meaning moves with each release.

The pattern is the one this site has marked before. "Human oversight" sounds like a control. A control has an owner, a speed and a power to refuse. The Code of Practice takes that step in provision 4.3: where human oversight is a risk control, operators "shall design, develop, verify and maintain technical measures". The chapter, which asks the question, leaves it open and does not point to the Code. This site's briefing on an OT lab test in which humans approved every exploit found the same gap in another document: the gate was stated and the number of approvals was not.

What the NCSC says will evolve, and the pages that carry the old assumptions

The blog says: "Many of the assumptions that underpin today's cyber security best practice were developed before this kind of AI existed." It names three concepts, vulnerability management, incident response and risk management, that "will need to evolve", and adds that this "may require a re-design of processes from the ground up". The Five Eyes statement of 22 June 2026, signed by six signatories (derived) for Australia, Canada, New Zealand, the United Kingdom and the United States, says "The timeline is not years, it is months." and that "cyber risk assumptions can become outdated in months, not years". The NCSC's Cyber Shield blog of 7 July says "activities that once took weeks can now take minutes".

The NCSC and Cyber Essentials pages read on 20 October 2026 that carry process assumptions the chapter says will change, with their dates and the AI terms found in their text (derived).

Page and dates	What it is built around	AI terms found
Vulnerability management, "1. Put in place a policy to update by default". Published 12 February 2024, reviewed 1 May 2026, version 2.1.	Best-practice timescales: "Internet-facing services and software" 5 days, operating systems and applications 7 days, internal or air-gapped 14 days, with a phased rollout of "10% of the estate updated per day". The page adds that when exploitation is rife, "the timelines above are too long".	0
Incident management, "Plan: your cyber incident response processes". Collection published 19 September 2019, reviewed 19 September 2019, version 1.0.	"a high or critical severity incident is likely to always need to go up to CIO or board level", with contacts "including out of hours" and playbooks that "cover at least the first few hours of each incident". It also suggests identifying "specific situations where the technical team should act autonomously".	0
Risk management collection. Published and reviewed 23 June 2023, version 2.0.	Guidance "for cyber security risk practitioners who help their organisations understand and make decisions". It says it is "not prescriptive".	0
Cyber Essentials, Requirements for IT Infrastructure v3.3, April 2026.	Updates for critical or high-risk fixes within 14 days. "14 days is considered a reasonable period", and a shorter one "may not be practical".	0
Intelligent security tools. Published and reviewed 18 April 2019, version 1.0.	The NCSC's guidance on buying AI-based security tools, with a note that it is under review and an invitation to recommend ways of measuring impact, positive or negative.	The subject of the guidance (not counted)

Across the vulnerability, incident, risk and Cyber Essentials pages (12,169 words, derived) there are 0 mentions of AI, artificial intelligence, machine learning, agentic or agents. That is not a fault. They were written for human-run processes, and the vulnerability page already has a second regime for mass exploitation. But their unit is the day. The 5-day figure is 120 hours (derived), and the Cyber Shield blog describes tasks measured in minutes. This briefing does not say the 5-day figure is wrong: the NCSC's page presents it as best practice for business-as-usual updates and says to go faster when exploitation is rife. The blog says the evolution may require processes to be re-designed from the ground up, while the current text assumes a human-run timetable, and no page read says what the AI-speed timetable is. That last sentence is this briefing's inference from the pages read; the NCSC's page on responding to active exploitation, linked from the same collection, was not read.

The UK: who can act on a research problem book, and what the pages say about engaging

The chapter creates no legal duty. Its only mention of regulators is in the AI6 closing statement, which says progress would give regulators and standards bodies "a technical basis for proportionate requirements", so any requirement comes later. The pages mention no data protection, procurement or supplier (0 mentions of data protection, GDPR, ICO, supplier, vendor or procure; derived). The book introduction says the problem book is "primarily intended for academia", though it may also be useful to companies carrying out research or identifying innovation gaps. On this briefing's reading, a UK security lead is more likely to be a customer of the answers than a contributor to them.

The routes the NCSC and its partners publish for engaging with research, as the pages read on 20 October 2026 describe them. Nothing was submitted or applied for.

Route	What the page says	Status read
Problem book feedback form	Asks for a name, an email address, a title, a summary and the area. Its opening sentence still lists cross-cutting, hardware security and cyber-physical problems only, though the AI areas are in the drop-down list.	Open
Cyber Shield partnering	"We invite all organisations who are interested in partnering" to contact the NCSC. No funding, date or terms are stated.	Open
Industry 100	Part-time secondments, "one day a week to one day a month", the employer keeps paying the salary, and "Security Check clearance" is required. One of the blog's two authors is described as a secondee.	Open
NCSC for Startups	"Although the programme is no longer running", the page stays as an archive; "The NCSC For Startups inbox is no longer monitored".	Closed
Academic Centres of Excellence in Cyber Security Research	"The call for ACE-CSR recognition is currently closed." 21 universities are recognised.	Closed
AI Security Institute grants	"Our programmes are not currently accepting applications."	Closed
EPSRC research-institute call (2022) and the CRANE phase one pilot call	The UKRI listing shows a closed 2022 call of 7,500,000 pounds. The CRANE page says "the call is now closed".	Closed

Of eight routes read, three are open (the form, Cyber Shield partnering and Industry 100) and none states funding (derived). The funding found is closed. The NCSC for Startups programme looks like a way in, but its own page says the programme is no longer running and that enquiries go to a partner organisation.

No UK law is attached to the chapter. The live UK law on the subject is the Cyber Security and Resilience Bill, and this site's briefing on its Lords text counted 0 mentions of AI in it as read on 15 October 2026, with the report stage listed for 26 October and liable to move. Cyber Essentials v3.3, the scheme many UK suppliers are certified to, has 0 mentions of AI (derived). So the UK documents that bind an organisation today say nothing about agents, and the documents that discuss agents bind nobody.

What to do, in the order worth doing

What could not be verified

Not read: the joint guidance "Careful adoption of agentic AI services", described here only as the NCSC describes it; the Code's 50-page implementation guide; the NCSC page on responding to active exploitation; and the NCSC glossary entry for frontier AI. The earlier edition of the problem book could not be fetched from an archive. The feedback form words three older-chapter titles differently from the navigation (HW1, CP1 and CP5), which fits the blog's "re-written" but cannot show which wording is older. The theme grouping and the published-document status of each problem are judgements, set out in the table above and in calc.py. The funding calls found are closed; other UKRI or Innovate UK calls were not searched in full. The statement that threat actors use capable AI is the NCSC's and is not cited on the chapter page; this briefing did not check incidents. All counts are of the pages as read between 11:46 and 12:02 BST on 20 October 2026 and can change if the NCSC edits them.

The question that exposes the gap

The chapter's fourth problem asks how autonomous and semi-autonomous defence systems should be evaluated and assured before and during deployment. It is the only one of the seven with no signed statement of why it matters. If a supplier's AI takes an action on your network tonight, which published UK document tells you what "assured" means for it, who can stop it, and how fast?

Key facts