Two recent announcements show that the UK government has put AI to work to evaluate its own systems: the first relates to finding security weaknesses before attackers do, while the second is dedicated to making sense of older systems so they can be modernised. Together they point to uses of AI in the public sector with the potential to improve security, reduce risk or cut costs.
Finding weak spots before attackers do
On 12 October, AI Minister Kanishka Narayan announced that the government will use advanced AI models to strengthen cyber defences across public sector systems, stating “I want Britain to become one of the hardest countries in the world to attack using artificial intelligence”. The move builds on two pilots that have already helped identify and fix more than a thousand potential vulnerabilities across government systems and detect potential threats.
Reporting on the announcement puts the figure at 1,352 vulnerabilities, found across more than 548 code repositories in 18 government departments. In one earlier month-long exercise, run through weekly hackathons by the Government Cyber Coordination Centre, AI models analysed source code and explored possible attack paths. Security specialists then reviewed the findings, filtered out false positives and passed genuine issues on for fixing. All critical weaknesses from that exercise were remediated, with no evidence of exploitation, at an AI usage cost of £13,000.
The government is now extending the programme to more public sector systems. It is also looking at strengthening the Cyber Security and Resilience Bill to address AI-related risks to essential services, and working with the National Cyber Security Centre and the AI Security Institute on how to respond to serious incidents involving autonomous AI agents.
Making sense of legacy technology
Two days later, the Government Digital Service (GDS) published the results of another significant AI-based project, which set out to analyse legacy systems. As the team points out, one of the biggest barriers to modernisation is simply understanding how existing systems work. Documentation is often incomplete, knowledge sits with a few specialists (or has been lost completely), and some systems rely on ageing technologies understood by shrinking pools of engineers.
The pilots, run with the Student Loans Company, the UK Hydrographic Office, the Met Office and delivery partner Kainos, found that analysis tasks estimated to take weeks could be completed in a matter of hours.
At the Student Loans Company, teams analysed 33 applications written in Clojure (a niche programming language launched in 2007). The work was expected to take around five weeks, but was completed in less than a day, giving a clear view of the applications and their dependencies to allow well-informed migration planning.
At the UK Hydrographic Office, a 20-year-old desktop application with no automated tests went from 0% to 96% test coverage. Regression testing that previously took around 15 days of manual effort now takes about 30 minutes, giving engineers more confidence to make changes safely.
GDS is now developing a playbook of good practice for organisations looking to apply AI to legacy technology challenges.
The common thread: AI supports and improves delivery, rather than replacing it
Both programmes share the same approach. AI does the heavy lifting of searching, mapping and testing, while experienced people stay in charge of judgement and decisions. In the cyber pilots, security teams validated every finding and managed remediation through existing processes. In the legacy pilots, GDS was clear that success depended on clear ownership, access to systems, experienced technical teams and established delivery processes.
As the GDS team put it, AI amplified existing strengths and weaknesses rather than replacing them. Used well, it speeds up analysis and improves visibility; used without proper controls, it can accelerate poor decision making.
For public sector organisations, this is a useful counterweight to the hype. Some of the most immediate value from AI may come not from new citizen-facing services but from the less visible work of securing, understanding and improving the systems that already underpin public services.
What this means for buyers and suppliers
For public sector buyers, these results suggest that AI-assisted discovery, testing and security review can make modernisation programmes easier to plan and deliver, especially where updates to legacy systems have been put off because potential risk was considered too high.
For suppliers, particularly specialist SMEs, there is clear demand for teams that combine AI tooling with strong engineering, security and delivery skills. Government is signalling that it values partners who can show measurable results while keeping humans firmly in control.
Bramble Hub works with a network of specialist AI delivery partners. Through frameworks including Digital Outcomes and Specialists 7, G-Cloud 15 and Technology Services 4, we give public sector customers a simple, compliant route to the AI expertise they need to secure and modernise their systems.
