Govern
Summarise risk evidence and control status while keeping decisions with accountable people.
- Approved data
- Traceable sources
- Decision owner
Defender AI / 2026
Use AI to increase defensive capacity—not uncontrolled authority.
AI can help defenders analyse more information, prioritise work and accelerate investigation. The useful pattern is AI assists → human validates → security control acts.
DataApproved
OutputVerified
ActionsBounded
OutcomeMeasured
Govern → Identify → Protect → Detect → Respond → Recover
Map AI use to a real cyber function and measurable outcome.
ASD/ACSC guidance frames defensive AI opportunities across the operating functions defenders already use.
Identify
Assist asset discovery, exposure analysis, vulnerability prioritisation and threat intelligence.
- Validate asset context
- Prioritise remediation
- Measure false positives
Protect
Support configuration review, secure coding and control validation.
- Human code review
- No autonomous production changes
- Test recommendations
Detect
Help correlate identity, endpoint, email and network telemetry.
- Preserve original evidence
- Tune for environment
- Escalate uncertainty
Respond
Assist triage, timeline construction and containment planning.
- Human incident commander
- Record sources
- Approval before containment
Recover
Summarise lessons, dependencies and control improvements.
- Validate evidence
- Assign owners
- Track completion
Safe operating pattern
AI recommendation is not an authorised change.
Use AI to reduce analyst workload while policy and execution remain independently controlled.
Bound the question
Give AI a specific task and approved evidence set.
Preserve provenance
Keep source logs, alerts, code or advisories.
Validate output
Require analyst review and deterministic checks where possible.
Separate execution
Do not let analysis silently become privileged action.
Measure value
Track time saved, quality and risk introduced.
High-value use cases
Start where human review is natural and failure is recoverable.
Good early use cases improve prioritisation and understanding without direct production authority.
Vulnerability prioritisation
Combine severity with asset criticality, exposure and exploit context.
Threat intelligence triage
Summarise primary sources and map relevance to owned assets.
Phishing analysis
Extract indicators while preserving the original message.
Secure-code review
Find candidate weaknesses for developer verification and testing.
Incident investigation
Correlate evidence and generate hypotheses for analyst validation.
Detection engineering
Draft queries or rules that are tested before deployment.
Human-controlled AI defence
Build capability without losing authority.
Start with the real workflow, data, identities, tools and consequences. Then place controls where they can stop harm.