UK NCSC Official: AI Asymmetry Favors Attackers; Defensive Systems Lack Clear Success Signals
The imbalance Chismon names is not a technology problem — it's a governance problem. Every NATO ally and partner now racing to deploy autonomous cyber defense will hit the same wall: liability.
A human defender who breaks the VPN answers to the board; an AI system that does the same is a liability claim waiting for discovery. Until defense policy creates legal safe harbors for autonomous defensive actions, the automation advantage stays with attackers, who face no board oversight. This means the real constraint is not AI capability but organizational risk tolerance — and that's a political problem that patches and framework updates cannot solve.
NATO and allied governments are betting on agentic AI to defend critical infrastructure at scale — the NCSC itself is building Cyber Shield to deploy these systems across government and national infrastructure — but Chismon's analysis exposes the foundational asymmetry that makes this bet dangerous.
Attackers optimize for a binary outcome (exploit works or fails); defenders must succeed without disrupting the systems they're protecting, which means a wrong patch or firewall rule becomes the exact attack outcome they're trying to prevent. This forces human approval into every high-risk defensive action, which defeats the automation argument. Watch whether the NCSC's Cyber Shield deployment encounters the same constraint when it moves from summarizing threat intelligence (low-risk, already approved) to autonomous remediation (high-risk, requires board accountability).
Has the NCSC stress-tested Cyber Shield against its own asymmetry argument — specifically, what happens when an autonomous system must choose between patching a critical vulnerability on a live VPN and risking a service outage?
Fault Lines
Strategic intelligence, synthesized daily — with a public track record. Every call graded against what actually happened.