Risk-aware autonomous defence with generative AI

The integration of artificial intelligence into industrial cybersecurity creates unique challenges at the intersection of technical efficiency, accountability, and ethics—especially in critical infrastructures governed by regulations like NIS2 and ISO 27001. We introduce AIOD, an autonomous cyber defence system that combines large language models (LLM), retrieval-augmented generation (RAG), and a risk-based decision framework derived from ISO 27001. Unlike conventional Endpoint Detection and Response (EDR) or Security Operations Center (SOC) playbooks, AIOD autonomously interprets incidents, selects organisational risk policies, and generates executable mitigation code under auditable constraints. Evaluated in a controlled Industry 4.0-inspired testbed with replayed events, AIOD achieved sub-minute containment of port scans and sub-10-minute mitigation for malware surrogates (EICAR-based), demonstrating potential for near-real-time response under simplified but representative conditions. Our findings highlight not only the technical potential of LLM-based cyber defence but also raise critical questions around safety, the creative interpretation of vague policies, and human oversight—underscoring the need for governance frameworks to responsibly deploy such systems in cybersecurity and critical infrastructure.