The Chancellor has announced £130m for two national cyber defence programmes ahead of next week’s Budget, including early work on a regulatory sandbox for agentic AI security tools in critical national infrastructure. For operators of essential services, the open question is what assurance, accountability and evidence regulators will expect once AI agents are allowed to act on live systems.
What happened
On Saturday 24 October 2026 the Treasury published a pre-Budget AI package worth more than £600m, which Chancellor John Healey will set out in full when he delivers the Budget on Wednesday. A £100m AI Biosecurity Lab took the headlines, but the cyber items matter more to network operators.
According to the Treasury announcement, the package includes:
- £60m for a National Cyber Shield, an agentic AI programme to strengthen UK cyber defences. Within that, £25m goes to a challenge fund for UK AI and cyber security innovators, and some money goes to scoping a new regulatory sandbox for deploying agentic security tools across critical national infrastructure (CNI), the public sector and industry.
- £70m for a National Exposure and Real-Time Vulnerability (NERV) Centre, which will use AI tools to find cyber vulnerabilities across critical infrastructure and the wider economy.
- A further £120m for the AI Security Institute (AISI) to test new AI systems and develop technical standards.
- An unspecified sum for a new NCSC AI Cyber Security Centre of Excellence, based in Manchester, to develop government cyber and AI specialists.
Press coverage of the package put the combined value of the Cyber Shield and NERV at £130m. Ciaran Martin, former chief executive of the NCSC, welcomed the measures in the Treasury release, saying the UK needs to “padlock our systems, and harness AI for defence”. Shadow AI minister Ben Spencer questioned how the approach fits with closer EU alignment.
The detail
Neither programme starts from nothing. In July the NCSC and DSIT set out a vision for a national “Cyber Shield”: red agents probing systems for weaknesses and blue agents detecting, containing and fixing problems at machine speed. Its required capabilities included explainable AI trusted by system owners to make live changes, federated agents under each organisation’s control, and national-level scanning of critical UK network ranges. Saturday’s announcement attaches a public budget to that vision.
The NERV Centre looks like the funded version of that national exposure scanning. Ministers describe its job as finding vulnerabilities across CNI and the economy. They have not yet said whether it will only observe from the outside, as most attack surface monitoring does, or whether operators will be asked to give it deeper access.
Very little has been published about the sandbox. The government has committed only to scoping one. No regulator, legal basis, timetable or entry criteria have been named so far. That matters, because a sandbox is a regulatory tool: it lets organisations try something existing supervisory expectations would make risky, under agreed conditions and closer oversight.
Why it matters for UK organisations
For operators of essential services and relevant digital service providers, the sandbox is the most significant item. Agentic security tools act as well as advise: they can isolate hosts, change firewall rules, revoke credentials and push configuration changes. Under the NIS Regulations, an operator remains responsible for appropriate and proportionate security measures whoever, or whatever, makes the change. If an autonomous agent takes a substation’s control network offline while containing a suspected intrusion, the competent authority will want to know who authorised that behaviour, what guardrails were in place and how the decision can be reconstructed afterwards.
A well-designed sandbox could answer those questions before the tools spread across CNI. It could let the NCSC and sector regulators agree on human oversight, logging, rollback and testing, and turn that into guidance that maps onto the Cyber Assessment Framework. A poorly designed one could become a route for vendors to market “regulator-approved” autonomy without the evidence to back it.
NERV raises a different governance question. A national centre that keeps finding exposures in critical infrastructure will produce a steady flow of findings about named organisations. Boards should assume that, once the state is telling you about a weakness, regulators may treat any delay in fixing it as a matter of record.
The extra AISI money matters because the Treasury explicitly links it to developing technical standards. Those standards are likely to become the benchmark that procurement teams, insurers and auditors use when judging AI security products, including the products this package pays to develop.
Expert view
In my experience, the hard part of automated response has never been detection logic. It is getting an operations team to trust a machine with change authority on production systems. When we test OT and enterprise environments, the most damaging outages are often self-inflicted: a blocking rule or emergency patch applied without understanding what depends on it. Agentic tools make those changes faster and at scale, for better or worse.
So I welcome the government treating this as a governance problem from the start, rather than simply paying for more tooling. But scoping is not delivery. The sandbox will only be credible if it publishes clear conditions: what the agent may do on its own, what needs a human, how actions are logged in tamper-evident form and how quickly a change can be reversed. I would also want a named regulator to own it, not a loose arrangement between agencies.
On NERV, my worry is capacity rather than intent. Finding vulnerabilities is now cheap. Fixing them in a hospital trust or water company with a legacy estate and a small team is not. Unless the money comes with remediation support and sensible prioritisation, NERV could add to the backlog rather than reduce it.
What to do now
- Know your exposure before NERV tells you. Run your own external attack surface discovery across every internet-facing asset, including those owned by third parties. This maps directly to the Cyber Essentials firewall and secure configuration controls.
- Tighten patch timelines. Check that high and critical fixes on internet-facing systems meet the 14-day window that Cyber Essentials security update management requires.
- Write an AI agent change policy now. Decide which actions any automated or agentic tool may take on its own, which need approval and who answers for the outcome.
- Limit agent privileges. Give security agents their own scoped identities, not shared admin accounts, in line with the Cyber Essentials user access control principles, and review those permissions regularly.
- Demand evidence from vendors. Ask suppliers of autonomous security tools for logging, rollback and test results. Watch for AISI standards and treat them as a future procurement baseline.
- Engage early. If you are a CNI operator, tell your sector regulator and the NCSC that you are interested in the sandbox, so your operational constraints shape its rules.
Bottom line
The £130m for the National Cyber Shield and NERV Centre turns months of NCSC planning into funded programmes, and the proposed sandbox recognises that autonomous defence needs a governance framework as well as technology. Until the sandbox has a regulator, rules and a timetable, critical infrastructure operators should get their own exposure management and change control in order.
Sources
- GOV.UK: Chancellor unveils Britain’s ambitious plan for AI
- City AM: Healey vows AI will not ‘leave workers behind’ in £600m Budget package
- ITV News: UK to set up AI ‘biosecurity lab’ to detect risks of future pandemics
- Seaside Radio: UK pledges to spend £600m to defend against AI health and security threats
- FutureScot: UK Government to harness agentic AI for new national ‘cyber shield’
