GCHQ plans AI national cyber shield for UK within five years

GCHQ has created a blueprint for a national cyber defence that uses autonomous AI agents to detect and respond to threats across UK critical infrastructure. The agency expects the system to be in service within five years and to operate at machine speed across energy, water, healthcare, transport and financial services.

The programme aims to use agentic AI to identify threats, find software flaws and repair vulnerabilities faster than human teams can. GCHQ director Anne Keast-Butler said the plan will “hardwire cutting-edge agentic AI into machine-speed cyber defence.” Officials say the shield is intended to reduce the risk of large-scale incidents that can cause major economic damage; the attack on Jaguar Land Rover has been estimated to have cost the UK economy £1.5bn.

Ministers have described the initiative as a generational endeavour and the Cabinet Office has asked leading AI companies to work with government on development. Security minister Dan Jarvis set out early plans for a national cyber shield in April, saying public infrastructure will need a different approach than off-the-shelf vendor tools. GCHQ said the National Cyber Force is already carrying out targeted cyber operations to counter state threats, terrorists and criminals while the agency explores defensive uses of advanced AI.

Keast-Butler warned that frontier AI models are exposing many previously unknown software vulnerabilities. She said GCHQ is building frontier AI “responsibly and ethically” into its analytic systems to speed translation and to find “needles in a haystack” of intelligence data.

The director reported growing state activity against UK and European infrastructure, citing a mix of cyber and kinetic actions by Russia. She highlighted concerns about attacks on undersea cables and pipelines, efforts to undermine supply chains and attempts to damage public confidence in services. “We’re also disrupting Russia’s attempts to smuggle Western tech, fending off its cyber attacks, and countering reckless sabotage and assassination attempts,” Keast-Butler commented.

On sourcing technology, Keast-Butler said sovereign IT does not require all components to be made inside the UK. She defined tech sovereignty as the ability of nations to shape their digital future and said the government will back UK tech firms and academic research while continuing to use global technology under careful supply-chain and data controls.

GCHQ also flagged the coming impact of practical quantum computing. Keast-Butler noted that quantum sensing is delivering new capabilities, such as detecting missile launches, and warned that fully capable quantum computers could complete tasks that now take years in seconds, including breaking common encryption. The agency’s mathematicians are developing new encryption methods designed for the quantum era, and businesses were urged to follow National Cyber Security Centre guidance on adopting quantum-resistant algorithms.

Space-based technology is a further focus. GCHQ noted more than 10,000 new space objects have been launched in three years and said the growing number of satellites increases data flows and the potential attack surface. The agency is working with partners to secure satellites and other space assets that support communications, navigation and intelligence.

The government plans a five-year timetable for a functioning AI-powered cyber shield, with collaboration between intelligence agencies, defence partners, industry and academia. Officials said the goal is a system that can operate at scales and speeds beyond human teams to protect the networks and services that underpin daily life.