The Palace of Westminster beside the River Thames

NERV and the National Cyber Shield: what the UK's £130m cyber package means for CISOs

The UK government has put £130m behind a simple idea: use AI to find and fix weaknesses faster than attackers can exploit them. On 24 October 2026, HM Treasury announced £60m for a National Cyber Shield and £70m for a new National Exposure and Real-Time Vulnerability (NERV) Centre, as part of a wider AI package worth more than £600m. The Chancellor confirmed both in a written statement to Parliament on 26 October.

For security leaders, this is not yet a set of new obligations. But it does show where national cyber defence is heading, and it is a good moment to check that your own house is in order.

What was announced

The National Cyber Shield (£60m) will use agentic AI to improve the UK's cyber defences. It includes a £25m challenge fund for UK AI and cyber security innovators and scoping work for a new regulatory sandbox to support agentic cyber security across critical national infrastructure, the public sector and industry.
The NERV Centre (£70m) will deploy AI tools to identify cyber vulnerabilities across critical infrastructure and the wider economy.
The AI Security Institute gets an extra £120m for testing AI systems and developing technical standards.
£24m will support "the systematic hardening of the public sector technology estate", according to the written ministerial statement.
A new NCSC AI Cyber Security Centre of Excellence in Manchester will train government cyber and AI experts.

Security Minister Dan Jarvis said the investment would help the UK "strengthen our national security, while staying one step ahead of those who seek to use AI to do us harm."

Where this comes from

The Cyber Shield is not new as an idea. In July 2026, the NCSC set out a blueprint for it, which it is developing with the Department for Science, Innovation and Technology. That blueprint describes "red" agents that find weaknesses in systems and "blue" agents that defend against threats in real time. Over time, these agents would move from spotting vulnerabilities at machine speed to fixing them automatically.

The blueprint lists six capabilities it will need: reliable and explainable AI for cyber security, federated agents, vulnerability discovery and mitigation, co-ordinated detection and response, national-level scanning, and national-level mitigation. National-level scanning means automated scanning of critical UK IP ranges for exposed vulnerabilities. National-level mitigation includes things like automatically blocking known malicious domains.

Two points in the blueprint matter most for CISOs. First, the agents are meant to work "under the control and authority of their owners", so organisations keep control of their own systems. Second, the NCSC plans to start with network defenders in government and critical sectors, then move to solutions that can scale commercially.

Why the NCSC thinks this is needed

The NCSC's reasoning is blunt. It says AI is already helping attackers with vulnerability discovery and reconnaissance, so "activities that once took weeks can now take minutes". It also notes that it has not yet seen fully autonomous attacks across the whole intrusion lifecycle in real systems, but expects frontier AI models are likely to become capable of it.

At the same time, many attacks still succeed because of basic problems: outdated or unsupported systems, slow patching and weak access controls. In other words, the threat is speeding up, but the fixes that matter most are still the familiar ones.

What this means for your vulnerability programme

Assume more vulnerabilities will surface, faster

If NERV does what it is designed to do, more weaknesses across the economy will be found more quickly. Add in AI-assisted research by attackers and defenders alike, and the volume of disclosures is likely to keep rising. In May, the NCSC told organisations to prepare for a "vulnerability patch wave", a rush of updates across open source, commercial, proprietary and SaaS software.

Know your exposure before someone else does

A national centre scanning for exposed weaknesses is a strong reason to get an accurate view of your own internet-facing estate first. The NCSC's advice is to find and shrink your external attack surface, start with perimeter technology and work inwards, and replace or bring back into support anything that can no longer be patched.

Patch by default

The NCSC recommends an "update by default" policy. That means turning on automatic secure hot patching and automatic updates wherever they are available, using a risk-based method such as Stakeholder-Specific Vulnerability Categorisation (SSVC) to set priorities where they are not, and speeding up sharply when a critical flaw is being actively exploited, especially on an internet-facing system. Our recent post on php2shell is a good example of why that speed matters.

Start using AI in defence, but carefully

The NCSC is clear that organisations should start to use AI in cyber defence, including agentic AI to find exposed vulnerabilities and AI to detect and contain incidents. It is just as clear about caution. Its guidance on agentic AI says to start with tightly bounded pilots, never give an agent unrestricted access to sensitive data or critical systems, and keep humans accountable for every decision to deploy, every permission granted and every outcome. As the guidance puts it, "If you cannot understand, monitor or contain an agent's actions, it is not ready for deployment."

What to do now

Map your external attack surface and close anything that does not need to be exposed.
Check your patching capacity. Could your team and your change process cope with a sharp rise in critical updates?
List end-of-life systems, especially internet-facing ones, and agree a plan to replace them or bring them back into support.
Ask your supply chain, commercial and open source, how it would handle a high volume of patches, as the NCSC suggests for larger organisations.
Pick one low-risk AI defence pilot, with clear limits, a named owner and full monitoring.
Track the challenge fund and the sandbox. The NCSC has invited organisations interested in helping to develop the Cyber Shield to contact it at cybershield@ncsc.gov.uk.

What we do not know yet

The announcement does not include a launch date, an application process for the challenge fund or detail on how the NERV Centre will work, including who will run it and how it will work with the organisations whose systems it looks at. CISOs in critical sectors in particular will want to see that detail when it arrives. More may follow with the Budget.

The direction, though, is clear. National cyber defence is moving to machine speed. The organisations best placed to benefit will be the ones that already know their exposure, patch quickly and have started to use AI in defence safely.