Summary
- £60 million will fund a National Cyber Shield, including agentic AI tools for critical infrastructure defence and a £25 million challenge fund for UK cybersecurity firms.
- £70 million establishes the NERV Centre to use AI for real-time vulnerability discovery across Britain’s infrastructure and economy.
- AI-assisted researchers have already uncovered 500 previously unknown flaws across parts of the UK public sector, per the AI minister.
- The PHP2Shell incident — which took dozens of government sites offline — underscores the urgency; NCSC coordinated disclosure with OpenAI involvement.
- How much autonomy the new AI defenders will have, and when they deploy, is not yet determined.
What was announced
The UK Treasury has allocated £130 million specifically to AI-powered cyber defence as part of a broader £600 million-plus AI spending package revealed ahead of the Budget. The cyber allocation splits into two main programmes: a £60 million National Cyber Shield and a £70 million National Exposure and Real-Time Vulnerability Centre, referred to as the NERV Centre.
National Cyber Shield
The Cyber Shield funding will support the deployment of agentic AI across critical infrastructure, government systems and industry, with the stated aim of identifying security flaws before adversaries can exploit them. Within that envelope sits a £25 million challenge fund aimed at UK cybersecurity firms and plans for a regulatory sandbox to test autonomous security tools. What the sandbox’s scope covers, and which sectors will participate first, has not been specified.
The NERV Centre
The £70 million NERV Centre will use AI to scan for vulnerabilities across Britain’s broader infrastructure and economy in something closer to real time. The government’s AI minister, Kanishka Narayan, has said existing AI-powered vulnerability work has already surfaced 500 previously unknown security flaws across significant parts of the public sector. The NERV Centre appears intended to industrialise that capability.
Context: PHP2Shell and NCSC-OpenAI coordination
The announcement arrived shortly after the PHP2Shell security incident, in which critical flaws in the widely used scripting language forced dozens of UK government websites offline. The NCSC worked with OpenAI to coordinate responsible disclosure of the PHP vulnerabilities, giving affected vendors time to prepare fixes after AI-assisted researchers discovered them. Ciaran Martin, former head of the NCSC, cited the episode in support of the investment. “We need to padlock our systems, and harness AI for defense,” he said.
AI Security Institute and biosecurity
The package also directs £120 million to the AI Security Institute, which evaluates advanced AI systems for dangerous capabilities and researches methods of keeping them under control. A separate £165 million funds a National AI Biosecurity Initiative, including £100 million for what the government describes as the world’s first dedicated AI Biosecurity Lab. OpenAI and Anthropic have each committed up to £100 million in compute or model credits to the biosecurity effort, with Google DeepMind and British biotech firm Basecamp Research also participating.
Sovereign capability and workforce
Additional funding addresses domestic AI capacity: £60 million for the Sovereign AI Fund, £60 million for AI research and development procurement, and £18 million for an Advanced Chip Design Academy intended to reduce reliance on foreign semiconductor design. Manchester will host a new NCSC AI Cyber Security Centre of Excellence to train government security specialists. The government is also committing £10 million annually to study AI’s impact on employment and industry.
What remains open
The sources do not specify when the agentic AI tools will be deployed, what human oversight thresholds will apply, or how the regulatory sandbox will be governed. The degree of autonomy these systems will have to act without human intervention is explicitly unresolved. For security leaders, those are not incidental details — they are the questions that will determine whether this becomes a meaningful capability or an expensive proof of concept.
Why it matters
For CISOs operating in or adjacent to UK critical infrastructure, government supply chains or regulated sectors, this signals a material shift in how the British government intends to approach national-scale vulnerability management. Agentic AI tooling operating across infrastructure creates both opportunity and new attack surface considerations — autonomous systems that discover vulnerabilities can also be targeted or manipulated. The PHP2Shell incident is a useful calibration point: even coordinated disclosure supported by AI assistance resulted in government sites going offline. Boards will ask about alignment with these national programmes; security leaders should be positioned to explain both the benefits and the residual risks of autonomous defensive tooling, particularly before governance frameworks are published.
What to do now
- Monitor UK government communications on the NERV Centre and National Cyber Shield for participation criteria, especially if your organisation operates critical infrastructure or holds public sector contracts.
- Track the regulatory sandbox framework as it develops — early engagement with sandbox processes can provide useful intelligence on how autonomous security tools will be assessed and approved.
- Review your own vulnerability discovery programmes in light of the government’s claim that AI tooling surfaced 500 previously unknown flaws in public sector systems; consider whether similar blind spots exist in your environment.
- Assess any PHP or web scripting dependencies in your estate given the PHP2Shell incident; confirm patch status and review disclosure timelines with your vulnerability management team.
- Identify whether your organisation qualifies for the £25 million challenge fund if you are a UK cybersecurity firm, or whether partnerships with fund recipients would be strategically relevant.
