UK Bolsters Cyber Defenses with £130 Million AI Investment

"We need to padlock our systems, and harness AI for defense," said Ciaran Martin, former head of the National Cyber Security Centre.

National Cyber Shield and agentic AI

The Treasury is dedicating £60 million to a new National Cyber Shield that will deploy "agentic AI" and autonomous AI agents to bolster Britain's defenses. The plan includes a £25 million challenge fund aimed at UK cybersecurity firms, and a regulatory sandbox to test autonomous security tools across critical infrastructure, government and industry. Officials have not specified how much freedom these AI defenders will have to act without human intervention, nor when they will be deployed.

NERV Centre: real-time vulnerability hunting

Alongside the Cyber Shield, the government will spend £70 million to establish the National Exposure and Real-Time Vulnerability (NERV) Centre. The NERV Centre is described as using AI to sniff out vulnerabilities across Britain's infrastructure and wider economy — hunting flaws in real time before attackers can exploit them.

The announcement arrived days after the PHP2Shell security scare, when dozens of government websites were taken offline after critical flaws were discovered in a widely used scripting language. According to the government account, the National Cyber Security Centre worked with OpenAI to coordinate the disclosure of those PHP vulnerabilities and give affected vendors time to prepare fixes, after AI-assisted researchers uncovered the flaws.

The AI minister, Kanishka Narayan, said last week that AI had uncovered 500 previously unknown security flaws across significant parts of the public sector — a statistic officials present as evidence for increased, AI-driven hunting for vulnerabilities.

AI Security Institute, biosecurity lab, and private partners

The Treasury is also allocating £120 million to the AI Security Institute (AISI), which will test advanced AI systems for dangerous capabilities and research ways to keep them under control. Separately, the government is putting £165 million into a National AI Biosecurity Initiative, including £100 million for what it calls the world's first dedicated AI Biosecurity Lab.

Private partners are already committed in material ways: OpenAI is contributing £100 million in compute and model credits; Anthropic is offering up to £100 million in model credits, model access and technical support. Google DeepMind and British biotech firm Basecamp Research are also named as involved. The remaining £65 million of the biosecurity package is earmarked for biosurveillance and medical countermeasures.

Sovereign AI Fund, chip design and regional centres

The wider AI package — part of a more than £600 million AI spending announcement ahead of the Budget — includes industry and skills measures. The government is adding £60 million to its Sovereign AI Fund to invest in British companies developing robotics and autonomous systems, and another £60 million for AI research and development procurement. An Advanced Chip Design Academy will receive £18 million to build local semiconductor expertise.

Other items in the package include £30 million for local AI partnerships, a £15 million AI challenge prize initially focused on healthcare, and £23 million for research into AI's impact on jobs and the economy. Manchester will host a new NCSC AI Cyber Security Centre of Excellence to train government specialists. Ministers are also setting aside £10 million a year to study how AI will reshape employment and industry, explicitly including the jobs it might make redundant.

What this means for cybersecurity firms, government security teams, and AI developers

• For cybersecurity firms: the £25 million challenge fund and the regulatory sandbox are concrete opportunities to build and test autonomous security tools for critical infrastructure, government and industry.
• For government security teams: the NERV Centre, National Cyber Shield and the Manchester Centre of Excellence signal a shift toward AI-first vulnerability discovery and response, but the degree of operational autonomy for those AI systems remains unspecified.
• For AI developers and platform providers: OpenAI, Anthropic, Google DeepMind and Basecamp Research are already named partners in the biosecurity and testing initiatives, and the Sovereign AI Fund plus procurement spending create additional channels for engagement with the public sector.

The package is large, busy and tightly choreographed: funding for defensive AI, capabilities testing, biosecurity and domestic industry all land in one announcement. The measures respond directly to recent incidents — most notably the PHP2Shell scare and AI-assisted vulnerability discoveries — but a number of key details remain unresolved, including deployment timelines and the operational limits of autonomous defenders. Whether the technology can live up to the government's ambitions without creating a fresh set of problems is another matter.

Original story