GCHQ plans AI national cyber shield within five years

GCHQ has confirmed plans to build a national cyber shield that will use autonomous AI agents to detect and repair threats to the UK’s energy, water, health, transport and financial systems. The agency expects the capability to be operational within five years and says it has produced a blueprint to ‘hardwire cutting‑edge agentic AI into machine‑speed cyber defence.’

GCHQ director Anne Keast-Butler told officials the system will identify threats to critical national infrastructure and speed responses to software vulnerabilities. She described the agency’s use of frontier AI for tasks such as translating foreign languages and extracting high-value information from large data sets. Ministers have described the programme as a ‘generational endeavour.’

Officials linked the plan to a rise in high-impact cyber incidents affecting businesses and public services. The agency cited a recent attack on Jaguar Land Rover that it estimates cost the UK economy £1.5 billion. The Cabinet Office has asked leading AI companies to work with government to develop AI-powered defensive capabilities.

The shield is framed as a response to both state and criminal activity. Keast-Butler warned of increased Russian activity against the UK and Europe, including attempts to damage undersea cables and pipelines and operations intended to disrupt infrastructure, supply chains and public trust. GCHQ and partners, including the National Cyber Force, conduct daily operations to counter state threats and disrupt smuggling of Western technology.

The director highlighted risks from the latest frontier AI models, which can find large numbers of previously unknown software flaws. She said the newest systems are ‘rapidly unearthing fault lines in technologies our society relies on every single day,’ and argued that defensive AI operating at machine speed is needed to keep pace with automated attacks and discovery tools.

Security minister Dan Jarvis announced the national cyber shield plans in April and said protecting critical infrastructure will require a fundamentally different approach in the age of advanced AI. Keast-Butler said the shield will combine domestic technology and global suppliers while managing supply chain risks, adding that ‘Sovereignty doesn’t have to mean ‘made in the UK” if dependencies and data are carefully managed.

Keast-Butler urged businesses to prepare for quantum computing, noting that quantum sensing is already in use and that practical quantum computers could greatly reduce the time needed to break current encryption. The agency recommended organisations follow guidance from the National Cyber Security Centre and begin adopting encryption algorithms that are resistant to quantum attacks. GCHQ mathematicians are developing new forms of cryptography.

GCHQ also flagged the growing importance of space-based technology, noting more than 10,000 objects have been launched in the past three years. The agency is working with industry and academia to secure and defend satellites and other space assets as part of the national cyber shield programme.