The UK Treasury is backing up its AI rhetoric with hard cash, allocating £130 million specifically for AI-powered cyber defenses. This isn't just about buying better firewalls; it's about deploying autonomous agents to hunt down security flaws in critical infrastructure before human operators or attackers even notice they exist. The move signals a shift from reactive patching to proactive, AI-driven exposure management.

The National Cyber Shield and NERV Centre

Two major components anchor this spending: a £60 million National Cyber Shield and a £70 million National Exposure and Real-Time Vulnerability (NERV) Centre. The Shield leverages agentic AI to bolster defenses, including a £25 million challenge fund for UK cybersecurity firms and a regulatory sandbox to test autonomous tools. Meanwhile, the NERV Centre will use AI to continuously sniff out vulnerabilities across Britain’s economy, moving beyond static scans to real-time threat detection.

From Theory to Practice: The PHP2Shell Precedent

This investment arrives days after the PHP2Shell security scare, which took dozens of government websites offline due to critical flaws in the ubiquitous scripting language. AI-assisted researchers uncovered these vulnerabilities, and the National Cyber Security Centre (NCSC) coordinated with OpenAI to manage disclosure. AI minister Kanishka Narayan revealed that AI tools had already identified 500 previously unknown security flaws across the public sector, proving the tech’s efficacy in the wild.

Broader AI Spending and Industry Backing

The cyber defense push is part of a wider £600 million AI spending spree. The AI Security Institute (AISI) receives £120 million to test dangerous capabilities, while the National AI Biosecurity Initiative gets £165 million, supported by compute credits from OpenAI and Anthropic. Additionally, £60 million is earmarked for the Sovereign AI Fund to support British robotics and autonomous systems, alongside £18 million for an Advanced Chip Design Academy to reduce reliance on foreign semiconductor expertise.

Key Takeaways

  • £130M is dedicated to AI cyber defense, split between the National Cyber Shield (£60M) and NERV Centre (£70M).
  • Autonomous AI agents are being tested in a regulatory sandbox for critical infrastructure.
  • AI has already found 500 unknown public sector flaws, validating the shift to agentic defense.
  • OpenAI and Anthropic are contributing significant compute and model credits to biosecurity efforts.
  • Uncertainty remains regarding how much autonomy these AI defenders will have without human oversight.

The Bottom Line

Paying for AI is easy; trusting it to act autonomously on critical infrastructure is hard. Until we see clear protocols for when these agents can act without human intervention, this is a high-stakes experiment in machine-speed security.