1. Executive summary
The NCSC has published a blog post, "One does not simply defend agentically", arguing that defenders cannot deploy agentic AI in the way attackers can because defensive work is constrained by organisational and political factors rather than purely technical ones. The post frames the asymmetry using Halvar Flake's maxim that offensive problems are technical while defensive problems are political, and concludes that AI-enabled offensive capability will likely grow faster than autonomous defensive capability unless defenders change their approach. It points to the CETAS work on Autonomous Cyber Defence, commissioned by the NCSC, as a model for breaking the problem down by defender risk appetite. No vulnerability, threat actor, or incident is described; this is strategic guidance relevant to clients planning AI adoption in security operations.
2. Regulatory framing
No specific DORA/NIS2 article is directly engaged by this item. The post is a strategic essay with no incident, third-party arrangement, or testing obligation that triggers a named article in the regulatory reference. Clients adopting agentic AI tooling in security operations may later engage DORA Art. 24 (digital operational resilience testing, general requirements) when such tooling is used in or subjected to resilience testing, but the post itself contains no fact that triggers it.
3. Technical analysis & attack chain
This item is a strategic blog post, not a vulnerability or campaign, so there is no attack chain to reconstruct. The argument proceeds as follows, from the source text only.
The post opens with Halvar Flake's maxim that all offensive problems are technical problems and all defensive problems are political problems. Attackers face questions such as whether they have an exploit for a vulnerability and how to avoid detection. Defenders face questions such as how to get budget to replace an end-of-life system, how to get IT operations to make time for patching, and how to get a change request for firewall rules approved.
The asymmetry is explained by core purpose. An attacker's employer profits from offence, whether by stealing money, extorting victims, or exfiltrating information. A defender's organisation exists for another purpose, such as developing products, treating patients, or providing digital services, and cyber defence is a cost of doing business that competes with other priorities. Defensive spend therefore has to be assessed against competing uses, and defensive actions carry the risk of breaking the organisation, for example a patch taking down a VPN or a firewall rule breaking business connectivity. The post notes that some board members see little difference between a DoS attack taking down IT and a poorly implemented defensive action doing the same, except that the board can shout at the defence team over the phone.
On AI specifically, the post states that agentic tooling suits offence because AI is good at technical problems with a clearly measurable success state, such as the target program crashing or malware calling home. Defensive problems are not mostly technical and do not always have a clear success state, so defensive AI automation quickly becomes a matter of organisational politics, and someone has to be responsible for the action taken. The post's conclusion is that the threat from AI-enabled attacks will grow while autonomous or agentic defence may struggle to keep up unless the approach changes.
The recommended approach is to stop trying to mimic attackers' use of agentic tooling and instead explicitly consider the constraints. The post endorses the CETAS work on Autonomous Cyber Defence, commissioned by the NCSC, which found that defenders have different levels of appetite for where they would apply AI. The fetched excerpt ends mid-sentence in the section on applying AI automation to technical defensive tasks, beginning with the category of offensive te[chniques], so the remainder of that section is not available to this advisory.
The related NCSC post "Managing the cyber risk of agentic AI" (corpus-1) gives the complementary risk-side guidance: use safeguards, sandboxing and active oversight to realise the benefits of autonomous systems while limiting unintended activity. Both posts are single-source NCSC publications; no second vendor or agency corroborates the specific claims, which is expected for guidance of this type and does not indicate doubt about them.
4. Mitigation & containment
There is no vulnerability to patch and no threat to contain. The actionable content is process and governance, and it is thin in the fetched material, so the steps below stay within what the sources state.
P1 (within 24h): No action required within 24 hours. This item does not describe an active threat.
P2 (within 72h): Circulate both NCSC posts to whoever owns AI adoption in security operations and to the SOC lead, and ask them to identify which defensive tasks, if any, are currently candidates for agentic automation. The "Managing the cyber risk of agentic AI" post names safeguards, sandboxing and active oversight as the controls for autonomous systems; any candidate task list should be assessed against those three controls before procurement or pilot.
P3 (within 7 days): Review the CETAS Autonomous Cyber Defence work referenced by the NCSC and map its findings on defender risk appetite against your current security operations roadmap. Where agentic AI is already in use in the SOC, confirm that a named human is responsible for each automated action, since the post states that someone needs to be responsible for the action taken. Record the review outcome for your next resilience testing planning cycle.
5. Indicators of compromise
No indicators of compromise available in the source material.
6. Detection
Insufficient indicators to author detection rules.
7. Sources
- NCSC UK, "One does not simply defend agentically", https://www.ncsc.gov.uk/blogs/one-does-not-simply-defend-agentically, 2026-09-21
- NCSC UK, "Managing the cyber risk of agentic AI", https://www.ncsc.gov.uk/blogs/managing-the-cyber-risk-of-agentic-ai, date not stated in provided material
8. Adverse Trace position
We assess this item as low severity for immediate operational risk and moderate value for planning: it contains no vulnerability, actor, or incident, but it states a position that should inform how clients scope AI in security operations over the next planning cycle. The core point for EMEA financial services is that defensive AI adoption is governed by organisational constraints, budget competition and accountability for automated actions, not by model capability alone, and clients who pilot agentic tooling without the safeguards, sandboxing and active oversight named in the companion NCSC post take on operational risk that their own change-management processes are not yet designed to absorb. Both sources are NCSC publications and the argument is single-sourced; we treat the CETAS endorsement as the NCSC author's stated opinion rather than independent corroboration. We will monitor for the full text of the post, which is truncated in the fetched material, and for any follow-on NCSC or CETAS publications that turn the risk-appetite framing into concrete deployment guidance.
Published via PulseTrace — Adverse Trace threat intelligence.