UK NCSC publishes 10 questions for organisations using AI models to find vulnerabilities

The UK NCSC's May 11 blog sets out ten questions organisations should ask before deploying AI models for vulnerability discovery, warning that finding flaws alone does not improve security and that fundamental cyber hygiene often matters more than hunting zero-days. Per the guidance, teams need processes to receive, prioritise and fix findings — the NCSC notes only around 400 of the 40,000-plus CVEs from 2025 were tracked as exploited — and should weigh data leakage, model jurisdiction, infrastructure security and legal risks before selecting hosted models. It recommends starting with the external attack surface using both AI and human verification, and stresses that AI models accelerate the skills of security staff rather than replace them.