AI Blue: the course

About the course

The course follows AI Blue, Book 8 of The Transformed Architecture. It starts from the blue team as it is, five functions around a queue, and the pressure on it, then defines the transformed team as a charter, a delegation profile and a delegation register. It works through the craft function by function, B1 Anticipate, B2 Detect, B3 Investigate, B4 Respond and B5 Learn, then the team's own AI, the organisation around it, the people in it and a year of experience in two fictional organisations, Nordvik Region and Hansa Mutual. It matters because degrees of delegation exist in every security operations centre whether or not anyone chose them, and European law places the accountability on named people and management bodies.

After the course the participant can

Map a team's work to the five blue team functions and inventory the AI that already takes part in it at the autonomy it actually has
Draft a team charter and a delegation profile that set the level per function and action class, with named owners, stop holders and review dates
Write a closure policy by class and a playbook manifest whose limits are enforced by a policy decision point outside the model
Review an AI-assisted case from the evidence, reproduce the key fact by another route and design a seeded-incident programme
Design and drill a stop path that does not run inside the system it stops, and assign incident decisions to named holders with response times
Draft the contract terms that make a provider's AI visible and checkable, and plan a tested exit
Replace closure-rate targets with measures of speed, coverage, quality of judgement and learning, each with a gaming check, agreed with employee representatives
Plan a craft programme with unassisted practice, a craft register and an apprenticeship route, and write a horizon register for the team

Who it is for

SOC leads and heads of security operations
Chief information security officers and their deputies
Security analysts, investigation leads and incident commanders
Detection engineers, threat hunters and threat-intelligence analysts
Procurement and contract managers who buy managed security services
Employee representatives and data protection officers who agree how SOC tooling is used

Before the course

Working knowledge of security operations: alerts, cases, SIEM, EDR and incident response
Familiarity with the series' usage modes, Mode 0 Ambient AI to Mode 5 Autonomous production agents, and autonomy levels, Level 0 Advisory to Level 4 Autonomous, as set out in AI Red Team, Chapter 6
A general picture of NIS 2, DORA, the GDPR and the AI Act as they bear on the participant's organisation
Access to the participant's own team documents, such as playbooks, a provider contract and recent post-incident reviews, for the exercises

Material

Three ways to run it

The same material in three lengths. Each row of an agenda names the lessons it draws on.

Executive briefing90 minutes

For board members, executive teams, CISOs and regional or group directors who must approve and oversee what the blue team delegates to AI

A briefing on what a management body must be able to see and decide when AI closes alerts and contains incidents. It covers the working thesis, the ceiling on delegation by action class, who holds the decisions to contain and disclose, what the reporting clocks ask of the record, and the one-page board report. It ends with the three questions a board asks each budget round and the two questions of the final test.

0:00	One night, three defaults: degrees of delegation exist whether or not anyone chose them, and the five-part working thesis Ch. 1
0:15	What the evidence on adversaries, alert load and scarce talent does and does not show, and why pressure does not justify autonomy by itself Ch. 3
0:30	The charter, the delegation profile and the ceilings by action class; where Level 4 is never used and the accountability that does not move Ch. 4, Ch. 10
0:45	Who may contain, isolate, disclose and stop, within what time; the management body approves the file and is not in the incident path Ch. 18, Ch. 19
1:00	The provider's AI and what must be kept in every operating model; the board page with at most three decisions Ch. 16, Ch. 20
1:15	Discussion: the three decisions put to each management body, the final test and what to ask on Monday Ch. 27, Ch. 28

One-day seminar1 day

For sOC leads, CISOs, incident commanders, detection engineers, senior analysts and the employee representatives and privacy officers who work with them

A working day that takes a team from an inventory of its AI to a first delegation profile, a closure policy, a tested stop path and a set of measures. Each block pairs a short input with an exercise on the participants' own material or on Nordvik Region and Hansa Mutual. Participants leave with drafts of the artefacts and a ninety-day plan.

09:00	The question and the baseline: thesis, five functions, the tiered SOC and its assumptions; exercise on the first AI inventory Ch. 1, Ch. 2
09:45	The transformed team as an artefact: action classes, ceilings and the six profile rules; exercise on a first delegation profile Ch. 4
10:45	Detection as a record and triage by class: the test gate, the alert budget and the closure policy; exercise on three alert classes Ch. 6, Ch. 7
11:45	Investigation that is reproducible without the AI: the five checks before closure, practised on CASE-HM-1207 Ch. 8
13:15	Respond: playbook manifest, Level 3 in practice and a tabletop drill of the stop path, with the night of 2027-04-12 as the case Ch. 10, Ch. 11
14:15	The team's own AI: mandates, review that does not start from the AI's answer, seeded incidents and the SOC as tier 0 Ch. 13, Ch. 14, Ch. 15
15:15	The organisation: the provider's AI by contract, ten decision rights and the reporting clock Ch. 16, Ch. 18, Ch. 19
16:00	Measures and people: gaming checks, the board page, the load review and the craft programme Ch. 20, Ch. 21, Ch. 23
16:40	Close: seven anti-patterns as a self-check, the final test and each participant's ninety-day plan Ch. 25, Ch. 28

Full course6 weeks, one module a week

For blue team members and leaders who will write and maintain the team's charter, detections, playbooks, mandates and reviews, alone or as a team cohort

The full course follows the six parts of the book, one module a week, with a lecture on each part and one lesson per chapter. Every lesson ends in an artefact of the kind its chapter describes, and the artefacts accumulate into the capstone: a delegation dossier for one function of the participant's own team. The last week tests the dossier against the anti-patterns and the final test.

Week 1	The Blue Team in Question: thesis, baseline, pressure and the transformed team defined; AI inventory, function map, pressure register and first delegation profile Ch. 1, Ch. 2, Ch. 3, Ch. 4
Week 2	The Craft: the five functions in turn, from intelligence routine and detection record through closure policy, case review, hunt record and stop drill to the blameless review Ch. 5, Ch. 6, Ch. 7, Ch. 8, Ch. 9, Ch. 10, Ch. 11
Week 3	The Blue Team's AI Team: acceptable-use sheet, mandate manifest, seeded-incident programme and pre-production checklist Ch. 12, Ch. 13, Ch. 14, Ch. 15
Week 4	The Team in the Organisation: provider annex, role map, decision-rights table with tabletop, incident clock and measures with gaming checks Ch. 16, Ch. 17, Ch. 18, Ch. 19, Ch. 20
Week 5	People and Career: load review, competence records from a two-pass exercise, craft programme and horizon register Ch. 21, Ch. 22, Ch. 23, Ch. 24
Week 6	Experience and Conclusions: anti-pattern review, year-in-review from records, two-year plan, final test and presentation of the capstone Ch. 25, Ch. 26, Ch. 27, Ch. 28

Modules and lessons

One module for each part of the book and one lesson for each chapter. A lesson has learning objectives, key concepts, a teaching plan, discussion questions, an exercise and a self-test.

Module 1 · Part I · The Blue Team in Question

Part I sets the baseline and the definition. It states the book's five-part working thesis, describes the blue team before the transformation through the five functions B1 Anticipate, B2 Detect, B3 Investigate, B4 Respond and B5 Learn, weighs the evidence on three pressures, and defines the transformed team as an artefact: a charter, a delegation profile and a delegation register. Participants leave with a first AI inventory, a function map, a pressure register and a draft delegation profile. Lecture: From the Queue to the Loop: The Blue Team as a Written Artefact

Module 2 · Part II · The Craft

Part II follows the craft function by function: B1 Anticipate, B2 Detect, B3 Investigate, B4 Respond and B5 Learn. Each chapter shows what AI now drafts, ranks, closes or executes, what remains a human decision, and which versioned artefact carries the work: intelligence, detection, case, hunt, playbook and review records. Participants leave able to write a closure policy, review an AI-assisted case, set the ceiling for a response action, drill a stop path and close a finding on a passing re-test. Lecture: The Craft as Code: Seven Records and the Decisions They Protect

Module 3 · Part III · The Blue Team's AI Team

Part III treats the blue team's own AI. It starts with the analyst's personal use of assistants in Modes 1 to 3, moves to a standing team of narrow agents under mandate manifests with a human conductor, shows how review stays real when the analyst depends on the AI to read the data, and ends with the defence of the defenders' AI as a tier-0 asset. Participants leave with an acceptable-use sheet, a mandate manifest, a seeded-incident programme and a pre-production checklist. Lecture: Conducting, Verifying and Defending the Blue Team's Own AI

Module 4 · Part IV · The Team in the Organisation

Part IV places the team in its organisation. It compares in-house, managed, hybrid and sovereign operating models and makes a provider's AI visible by contract, redesigns the team after the tier-1 pyramid, assigns the decisions to contain, isolate, disclose and stop to named holders with response times, reads NIS 2, DORA, the Cyber Resilience Act, the GDPR and the AI Act as clocks, records and named people, and replaces closure-rate targets with measures that carry gaming checks. Lecture: Who Holds What: Contracts, Charters, Decision Rights, Clocks and Measures

Module 5 · Part V · People and Career

Part V turns to the people. It describes the analyst's load, the night and what it means to be managed by metrics; defines the competences of the transformed blue team and shows them by exercise, not certificate; treats the apprenticeship problem that follows when AI does the junior triage; and looks ahead to 2036 with a horizon register. Participants leave with a quarterly load review, a competence record, a craft programme and a horizon register for their own team. Lecture: The People in the Loop: Load, Competence, Craft and the SOC of 2036

Module 6 · Part VI · Experience and Conclusions

Part VI tests the book against experience. It reads three public cases from the blue team's side and names seven anti-patterns with their controls, follows four fictional people through the year 2027 as dated decisions and records, draws a two-year plan with six measures and three open decisions for each organisation, and judges the five-part thesis against the evidence. Participants leave with an anti-pattern review, a year-in-review from records, a plan and a ninety-day programme. Lecture: Found by Design, Not by Luck: Cases, a Year, Two Plans and a Verdict

Final assignment

Capstone

A Delegation Dossier for One Blue Team Function

Choose one of the five blue team functions in your own team, or in Nordvik Region or Hansa Mutual as the book describes them, and one AI capability that takes part in it. Build the dossier that would let a CISO grant, bound, verify and withdraw the delegation. The dossier assembles the artefacts of the course: the entry in the delegation profile with its action class and level, the bounding record (a closure policy, playbook manifest or mandate manifest), the review and seeding arrangement, the stop path with a drill record, the decision rights, the measures with gaming checks and the craft condition that keeps people able to do the work unaided. Finish by taking the final test on the dossier and stating honestly what the records cannot yet show. Everything is defensive, and no measure may be computed per named person.

Steps

Inventory the capability by usage mode and identity, list what it can do, classify each action from AC-0 to AC-4 or as a closure class, and set the level with the lowest ceiling governing
Write the bounding record for the delegation: a closure policy by class, a playbook manifest or a mandate manifest, naming the policy decision point outside the model that enforces it
Design the verification: the soundness criteria, the review tier, the seeding plan with a catch-rate threshold and a stop rule, and the reporting rules to agree with employee representatives
Specify the stop path and the degraded mode, name the holders, set the target time, and run or tabletop one drill and record the result with any findings
Assign the decision rights and the reporting-clock owner for the incidents the delegation can touch, and choose three measures with a gaming check each
State the craft condition from a craft register, take the final test on the dossier and write the ninety-day plan for the gaps it reveals

Deliverables

A delegation profile entry and its bounding record, with named owner, grant authority, stop holders and review date
A verification and seeding plan with thresholds, a stop rule and agreed aggregate reporting
A stop-path drill record with measured times, findings, owners and re-test dates
A one-page report for the management body with three measures, their counts and at most three decisions
A final-test record and a ninety-day plan for what the records cannot yet show

Assessment criteria

Every action has a class, a level and a named person who answers, and no action that is irreversible or decides about a named person's access to work exceeds the ceilings the book sets
Enforcement, corroboration and the stop sit outside the model and outside the system being stopped, and the dossier shows how each was or will be tested
Verification is measurable: seeds, thresholds and a stop rule are stated with counts, and gaps are reported as gaps
Measures about people are aggregate, agreed in advance and excluded from appraisal, and the craft condition names how many people can do the work unaided
The dossier is faithful to the book's terms and artefacts and distinguishes what is verified from what is only declared