NCSC highlights key checks before using AI to hunt vulnerabilities

The UK’s National Cyber Security Centre has issued guidance for organisations considering the use of artificial intelligence models to identify software weaknesses. The message is simple: AI can support security work, but it can also introduce fresh risks if it is adopted without a clear plan.

The NCSC warns that scanning code with an AI tool is not the same as improving security. Organisations still need strong vulnerability management, patching discipline and a clear understanding of their systems. In many cases, basic cyber hygiene will reduce risk more effectively than chasing large numbers of newly discovered issues.

Questions to ask before deploying AI

The guidance encourages security teams to think through several practical questions before granting AI systems access to code, documentation or production environments.

• What business outcome is the organisation trying to achieve?
• Is AI the best way to improve security, or should effort go into core hygiene first?
• Is there a process in place to receive, prioritise and fix vulnerabilities?
• How will results be ranked so the most exploitable issues are addressed first?
• What are the risks of exposing sensitive information or over-permissioning the model?

The centre also advises organisations to review the model they choose, including where it is hosted, which legal jurisdiction applies and what data retention rules may come with the service. It recommends starting with the external attack surface and checking findings with human review, rather than relying on AI alone.

Planning for the long term

The NCSC says organisations should also think beyond a single project. Frontier AI systems are developing quickly, and security teams will need a sustainable plan for evaluating new models, handling updates and responding to vulnerabilities across the products and services they depend on.

It adds that AI is best treated as a tool that can speed up skilled work, not replace experienced practitioners. Organisations that combine automation with strong asset management, patching and security expertise are more likely to see real gains.