Your own AI use
Unapproved and agentic AI: the risk inside your own organisation
The NCSC warns that staff using unapproved AI services can expose sensitive information, and that agentic AI adds risk through the access it holds.
Last reviewed against National Cyber Security Centre, SecurityWeek and Cyber Security News. Sources
The warning
Two separate risks
Alongside the threat from attackers, the NCSC highlights risks from an organisation's own AI adoption.
Unapproved services
Steps
A first pass
-
1
Ask staff and teams which AI tools they use, without blame, and note why. -
2
Provide approved alternatives where the unapproved tool meets a real need [5]. -
3
For agentic tools, list what systems and data each can reach and remove what it does not need. -
4
Apply safeguards, sandboxing and active human oversight [5].
Defence
AI on your side
The NCSC believes AI will ultimately be a net positive for cyber security, and advises adopting it carefully to strengthen defences [5]. Reporting of the review adds that automated defensive actions need clear limits and human oversight to avoid disruption [7].
A useful rule is to treat an AI tool like any other supplier or user account: it needs an owner, a defined purpose and the least access that lets it work. The NCSC's guidance asks you to know what access such tools hold [5].
Related reading: what to do and the NCSC's assessment, which covers new attack surfaces created by AI deployment [2].
Why oversight matters
The NCSC acknowledges that automated defensive activity currently sits outside many organisations' risk tolerances [9].
Keep reading
Read next
Cyber Essentials
The NCSC chief calls Cyber Essentials the starting point against AI-assisted attacks. What that means and the 75% first-certificate discount.
Read the guide
Funding
Cyber Shield, the NERV Centre, a National Agentic Security Unit and an AI Cyber Security Centre: what was announced alongside the NCSC warning.
Read the guide
Legacy systems
AI makes known weaknesses in old systems easier to exploit. The NCSC's advice on unsupported technology and the cost of tech on the cheap.
Read the guideHow CyPro can help
Need a hand getting ready?
Reading the rules is one job. Mapping them to your organisation, closing the gaps and showing the evidence are several more. CyPro's consultants can take any of them off your plate.
Fractional CISO for the board
A senior security lead who advises the board on what to fix first, what to accept and what to tell customers, and owns the decision record.
More on cypro.co.uk
Penetration testing
A focused test of your systems and the controls around them, so you know they hold before an attacker finds out for you.
More on cypro.co.uk
Hardening and segmentation
Our consultants put the controls in place that limit the damage when something is missed: firewall rules, network isolation and tighter admin access.
More on cypro.co.uk
24/7 security monitoring
Our SOC analysts watch your systems day and night for the signs of an attack in progress: unexpected processes, new outbound connections, logins that do not fit.
More on cypro.co.uk
Incident response
If you may already be compromised, our responders contain it, preserve the evidence, find out what was touched and get you running again safely.
More on cypro.co.uk
Vulnerability scanning
Find every internet-facing system you run, including the forgotten ones, and see which are still on a vulnerable build.
See the scanning service
Get ready
Need to know what this means for you?
The NCSC expects ransomware to get faster and cheaper to run. CyPro can help you plan and rehearse your response before an attack and take charge of containment and recovery if one happens.