The Blue Team Transformed: Who Decided, Who Can Stop It, Who Can Still Do the Work
For security leaders, analysts, architects, board members and employee representatives in European enterprises and public authorities
In 2026 the queue of a security operations centre is read, enriched, triaged and in places acted on by AI, while adversaries use AI to move faster. The keynote asks what the team becomes now that this has happened. It argues that the blue team is transformed, not abolished: the work moves from the queue alone to the queue and the loop, autonomy is matched to reversibility with a stop path outside the system it stops, the defenders' own AI is defended as tier 0, and the making of analysts and their wellbeing are design questions. It ends with a test any team can take.
6 min
A night in two security operations centres
A provider's AI closes an alert at Nordvik Region; a shift lead approves an agent's proposal at Hansa Mutual; an AI summary appears in a console.
In none of the scenes did anyone choose a degree of delegation, so the first task is to find the delegation that already exists.
The five functions, B1 Anticipate, B2 Detect, B3 Investigate, B4 Respond and B5 Learn, are the unit, because they differ in reversibility.
7 min
Pressure without panic
The documented effect of adversaries' AI is speed and volume; the exploitation window is measured in days and, by one report, begins on average before a patch.
No source in the book's bibliography measures telemetry growth across organisations, and the book says so.
Speed that is wrong is a harm of the team's own making, so pressure justifies a transformation and not autonomy by itself.
9 min
Autonomy matched to reversibility
Action classes AC-0 to AC-4 set the ceiling by the effect of a wrong action, not by the confidence of the model.
Level 3 Bounded is a codified playbook enforced by a policy decision point outside the model; Level 4 Autonomous is never used for an irreversible B4 Respond action or a decision about a named person's access to work.
A stop path must not run inside the system it stops, and a stop that has not been timed is a declaration, not a control.
On the night of 2027-04-12 the design worked and was found wanting in the same eight minutes: a stop in 57 seconds and an approval in 38.
8 min
Verifying and defending the team's own AI
The analyst depends on the AI to read evidence that the adversary can write, so review must not start from the AI's answer.
Seeded errors and seeded incidents measure whether review is real, and a missed target is reported as missed.
Controls outside the model bound what a manipulated agent can do; they do not bound what it can make an analyst believe.
8 min
The people in the loop
AI moved the load from reading to approving and did not simply remove it; no study the book relies on measures the effect on fatigue.
Closure by class removes the queue through which analysts learned, so the route is rebuilt by design with unassisted practice and an entry post.
The system is measured and the person is not: measures are agreed with employee representatives before collection and reported in aggregate.
7 min
The verdict and the final test
Three parts of the thesis held with qualifications, one held in part, and the part on the route and wellbeing of analysts is argued but not proved.
By 2036 systems are expected to read, correlate, draft and execute inside playbooks, while a person alone answers for what cannot be undone.
The final test: can the team show from its own records who or what decided what, and can it stop what it has started and recover?
What the audience takes away
Degrees of delegation exist whether or not anyone chose them, so write them down per function and action class with a named owner.
Put the stop outside the system it stops, give it to named people who need no approval, and time it.
Keep people able to do the work and judge the output, because that is what separates a defence from a dependence.
Module 1 · Part I · The Blue Team in Question · 45 minutes
From the Queue to the Loop: The Blue Team as a Written Artefact
The lecture carries the argument of Part I in one line: degrees of delegation exist in a security operations centre whether or not anyone chose them, so the team has to write them down. It moves from three night scenes in which defaults did the deciding, through the baseline of five functions and a tiered queue, to what the evidence on adversaries, alert load and scarce talent does and does not show, and ends with the charter, the delegation profile and the register that turn a team into something that can be read, tested and changed.
7 min
One night, three defaults
Three illustrative scenes: a provider's AI closes an alert at Nordvik Region, a shift lead approves an agent's proposal at Hansa Mutual, and an AI summary appears in the EDR console.
In none of the scenes did anyone choose a degree of delegation; the provider's closure, the shift lead's speed and the console's summary all came from defaults.
AI sits in three places that are governed differently: in the products, in the analyst's own work and in systems built or procured to perform a function.
8 min
The working thesis and what would refute it
Five claims: transformed, not abolished; from the queue to the loop; autonomy matched to reversibility; the defenders' AI is defended; the route to the craft and wellbeing are design questions.
Each claim is stated together with the evidence that would show it wrong, because the thesis is a claim about design and not a prediction.
The line between Level 2 Supervised and Level 3 Bounded matters most: a person stops seeing each action and starts answering for a class of actions.
8 min
The baseline: five functions, a pyramid and a queue
The function, not the job title, is the unit: B1 Anticipate, B2 Detect, B3 Investigate, B4 Respond and B5 Learn form a loop.
The tiered SOC rests on four assumptions: headcount handles volume, skill is learned on the routine, the queue is the interface and a person reads each alert.
The usual measures count speed, volume or coverage, and none counts the quality of a judgement.
10 min
Pressure, read with care
Agency assessments, developer and threat-intelligence reports and laboratory studies are three kinds of source that must be read differently.
The observable effect of adversaries' AI is speed and volume; fully autonomous campaigns at scale against European targets remain speculation.
The alert-queue arithmetic is an assumed illustration, and no source in the bibliography measures telemetry growth across organisations.
Pressure justifies a transformation; it does not by itself justify autonomy, because speed that is wrong is a harm of the team's own making.
12 min
The team as an artefact
The charter states mandate, decision rights and what no system may do; the delegation profile states mode and level per function and action class; the register states the sum.
Action classes AC-0 to AC-4 carry default ceilings from Level 3 Bounded for preservation down to Level 1 Assisted for irreversible or external actions.
Raising a level is slow and needs a grant authority; lowering it is immediate for any holder of the stop right.
Delegation moves work, not accountability: the chain of named people is the same at every level of delegation.
What the audience takes away
A degree of delegation that nobody chose is still a degree of delegation, so the first task is an inventory of AI at the autonomy it actually has.
The evidence supports a transformation of the blue team but not autonomy on the grounds of speed alone.
A charter, a delegation profile and a delegation register make the team's mandate readable, testable and reversible.
The Craft as Code: Seven Records and the Decisions They Protect
The lecture follows one thread through Part II: a sector-sharing report at Hansa Mutual becomes the intelligence record INTEL-HM-0142, the hunt HNT-HM-0031, the detection DET-HM-0455, the playbook PBK-HM-ISOLATE-01, the incident INC-HM-2027-0455 and the review PIR-HM-0455. At each step AI does the reading, drafting or executing, a named person decides, and a check outside the model enforces the limit. The argument is that the queue becomes a loop only when every alert, hunt and incident ends in a verified change to a record that somebody owns.
8 min
B1 Anticipate: intelligence as a gate to action
The pipeline of collection, extraction, verification, hypothesis and routing keeps two human decision points and one verification step.
Extraction runs at Level 1 Assisted because it can invent indicators, map the wrong technique and flatten a hedge into an attribution.
The extractor holds no tools that act, because adversaries write some of what it reads.
8 min
B2 Detect: a detection counts when its test has run
A detection record holds logic, data sources, mapping, tests, ownership and cost, and origin; a rule in a console holds none of the history.
The test gate sits before human review; unit, replay, simulation and the purple loop serve different purposes.
Hansa Mutual's drafting assistant produced 48 drafts in a quarter and 15 were merged: output counted in drafts answers the wrong question.
10 min
Triage: closure by class, never by alert
Of the five triage tasks, enrichment, correlation, deduplication, summarisation and closure, only closure takes the decision from a person.
A closure policy states the definition, the evidence to close, the level, the owner, sampling, seeding and a stop condition written as numbers.
CASE-NR-0231 shows the Mode 0 blind spot: a provider's AI closed an alert under no rule the Region had seen, and a weekly sample reopened it.
10 min
B3 Investigate and hunting: reproducible without the AI
The investigator steers, challenges and verifies; every timeline entry is resolved to an event by a check outside the model.
In CASE-HM-1207 the AI read a UTC stamp as local time and moved an event two hours; the check of each entry against its cited event caught it.
A hunt that finds nothing ends in a coverage statement that says what was searched and what was not.
No hunting agent changes the estate, and anomaly rankings are leads, not findings.
14 min
B4 Respond: the ceiling, the manifest and the stop path
The ceiling follows the effect of a wrong action, not the confidence of the model; five questions set it and the lowest answer governs.
The playbook manifest carries the authority, and a policy decision point outside the model enforces it.
On 2027-04-12 two corroborating sources shared a data path, a legitimate rollout was contained, and the stop and the reversal were separate human acts.
The stop path must not run inside the system it stops, and it is drilled every quarter against a measured target.
10 min
B5 Learn: a finding closes when the re-test passes
A blameless review ends in at most three changes, each with an owner, a date, an artefact and a re-test designed when the finding is opened.
The new risk with AI is a fluent review that nobody checked; the evidence pack is the authority and the timeline is corrected in the room.
Detection debt and playbook debt are registers with ages and consequences; a mandate past its review date lapses at the policy decision point.
What the audience takes away
In every function AI proposes or executes inside a written bound, a named person decides, and the enforcement sits outside the model.
Verification does not mean rereading everything: it means stored queries, resolved references, independent sources, sampling and seeded errors.
The loop is closed only when an incident or exercise ends in a changed record whose re-test has passed.
Module 3 · Part III · The Blue Team's AI Team · 50 minutes
Conducting, Verifying and Defending the Blue Team's Own AI
Part III answers one question from four sides: how can a team rely on AI that reads what the adversary writes? The lecture argues that the answer is never the model's good behaviour. For the analyst's assistant it is routing by data class and the line between assistance and delegation. For the agent team it is a mandate enforced outside the agents and a stop path outside the platform. For review it is a protocol that does not start from the AI's answer and is measured with seeds. For the platform it is tier-0 treatment and red teaming under rules of engagement.
10 min
The assistant at the analyst's elbow
In Modes 1 to 3 the AI acts with the analyst's own identity, so the safeguards are the analyst's discipline and tooling that makes it easy.
Classify the data, restrict routes by class, and enforce the restriction in the tooling rather than in the analyst's memory.
The test for assistance versus delegation is the question: who decided this, and could that person have stated why?
Shadow AI is a symptom of an approved route that does not serve security work.
12 min
A team of narrow agents and one conductor
Hansa Mutual runs triage, investigation, detection drafting and hunting agents and a read-only critique agent, but no response agent and no manager agent.
The mandate manifest and the containment profile set the limits; instructions in a prompt are part of neither.
A deterministic pipeline orchestrates the agents, and no agent approves another agent's output.
Budgets, circuit breakers, the policy decision point and a stop path at the identity provider are the brakes.
14 min
Review when the reviewer needs the reviewed
Dependence has three forms: for reading, for method, and on evidence the adversary can influence.
Automation bias is a documented property of people working with automated aids, not a failing of individuals, so verification has to be designed.
The analyst forms a provisional view first, reproduces the key fact by another route, and uses a critique agent on a different model family.
Seeded errors and seeded incidents measure what review catches; oversight-quality metrics show how review is conducted.
14 min
The SOC as tier 0
Every input is placed in a trust class, T0 Own to T3 Published, ranked by who can influence the text; even telemetry carries attacker-chosen fields.
Assume an agent can be manipulated and design for what it can reach: suppression, misdirection, disclosure and action.
Controls outside the model bound suppression, action and disclosure; misdirection is left to the review of Chapter 14.
A control that has not been tested is declared, not verified, so the SOC's AI is red-teamed and findings close on a passed re-test.
What the audience takes away
The mode sets the governance: an assistant borrows the analyst's identity, an agent has its own, and each needs different controls.
Review is real only if it is designed, measured with seeds and protected from volume by caps and back-pressure on the agent.
The defenders' AI is defended by architecture outside the model, never by expecting the model to recognise an attack.
Module 4 · Part IV · The Team in the Organisation · 55 minutes
Who Holds What: Contracts, Charters, Decision Rights, Clocks and Measures
Part IV asks who holds each part of the transformed blue team's work and how anyone can check. The lecture argues that the same answer recurs at five levels. A provider's AI may act only as far as a written level, a sample and a stop right allow. A role is a charter with ceilings. A decision is a right with a holder, two deputies and a response time. A regulation arrives as a clock, a record and a named person. And a measure is safe as a target only if the behaviour that improves it is the behaviour the organisation wants.
11 min
Operating models and the provider's AI
AI lowers the cost of what providers sell, removes the volume that justified a large in-house shift, and adds an unrecorded delegation: the provider's AI.
Five things stay with the organisation in every model: detection content, decision rights for containment and disclosure, the case record, the ability to leave and enough skill to supervise.
Annex MS-2 turns the Mode 0 blind spot into six terms, from levels and actions to 20 working days' notice of model change.
Sovereignty is tested by four verifiable properties, not by a postcode, and exit is a capability tested once a year.
10 min
After the pyramid
The tier-1 pyramid was a response to alert volume and a school for the craft; triage by AI removes much of the first and threatens the second.
The functions of tier 1 divide and land in different roles: class owner, analyst on the residual queue, detection engineer and an apprenticeship that must be designed.
The diamond is the shape the argument leads to, and its weak point is the entry rung.
A role charter states decision rights as verbs with limits, ceilings per role and what the role may not do.
12 min
Decisions that cannot wait
Five response tiers, from playbook to management body, decide in seconds to hours; the lowest tier that can decide with the evidence decides.
Ten incident decisions, D1 to D10, each get a holder, a deputy, a second deputy, a response time and an inform list, and a missed time moves automatically to the deputy.
The stop needs one holder from a named set, no approval and no prior justification; continuing after a stop needs the owner.
Hansa Mutual's tabletop on D7 found faults in plumbing and delegation, not in judgement: 18 minutes to acknowledge against a target of 10.
11 min
Regulation as clocks, records and named people
One incident can open several clocks that start at different moments and are owned by different people.
Record two awareness timestamps, open every clock that could apply at the earlier one, and close those that do not apply with a reason.
The management body may delegate the work but never its accountability, so it approves the delegation and receives a report it can oversee from.
The log that satisfies the regulations also records analysts' actions, so its purpose, access and retention are written into the agreement and enforced by the tool.
11 min
Measuring judgement
Time to detect, time to respond, closure rate and alert volume can all improve while fewer intrusions are caught.
Four families replace them: speed on verified incidents, coverage as a map, quality of judgement and learning, each with a gaming check.
The board sees one page with at most three decisions, and every figure is shown with its count.
Measures about people are agreed before collection, reported in aggregate and never computed per named analyst.
What the audience takes away
Whatever is bought, the organisation keeps detection content, the decision to contain and disclose, the case record, the ability to leave and the skill to supervise.
A decision right is real when a named holder with two deputies has been paged without warning and answered inside the response time.
A measure reported without a gaming check is a target waiting to happen.
Module 5 · Part V · People and Career · 50 minutes
The People in the Loop: Load, Competence, Craft and the SOC of 2036
Part V makes the fifth claim of the thesis concrete: the route by which analysts are made and their wellbeing are design questions. The lecture is careful about evidence, because the book is. The studies of analyst fatigue are small, qualitative and older than the present tools, and none measures the effect of AI. What can be designed is known: caps on review, protected time, competence shown without the assistant, an entry post with a mentor, and a rule that no class stays at Level 3 Bounded when the people who could work it by hand have gone.
12 min
The analyst at work
The pace is set elsewhere, most items are benign and each needs a check, the consequence of a miss is large and delayed, and everything the analyst does is logged.
Review of machine conclusions has the structure of the alarm queue the studies describe; no study the book relies on measures whether AI raises or lowers fatigue.
Queue pace is a direction decision about people, and analyst-activity data joined to a name becomes a profile.
The system is measured and the person is not: aggregate reporting, no appraisal use, disclosure and a review date agreed with representatives.
12 min
Competence shown, not certified
A framework is useful only if decisions depend on it: who approves at night, who owns a Level 3 class.
Four levels, and where a competence has an unassisted and an assisted form, the lower of the two counts.
Certificates support Foundation only; everything above rests on an exercise or on work that was tested.
Autonomy depends on competence: with fewer than two evidenced holders per site, a Level 3 Bounded class falls back to Level 2 Supervised.
13 min
The missing rung
Closure by class removes the queue through which many analysts learned, and the experts practise less of what made them experts.
The ladder is rebuilt, not restored: unassisted practice chosen at random and graded, a craft register, shadowing, rotation, replays and graduated responsibility.
The rule for apprentices is attempt first, then ask; the development record belongs to the apprentice.
The pipeline sum uses an assumed attrition and shows Hansa Mutual's cohort of two covering about two fifths of its need.
13 min
Will there be a SOC in 2036?
A horizon register labels each trend observable, expected or speculation and attaches a trigger, an owner and a posture: commit, prepare or keep reversible.
Three scenarios, managed and automated, dissolved into engineering, and the human-commanded loop, differ in where work is done and agree on what stays human.
What stays human: accountability for irreversible containment, judgement under uncertainty, verification, and the stop and the exit.
The author's projection is labelled as such and comes with five thresholds that would change it.
What the audience takes away
Whether AI relieves or intensifies the analyst's load depends on team design, and the load must be measured, not assumed.
Skill is a design variable of the delegation: a team that measures what its people can still do knows when to withdraw an autonomy level.
Decide the junior route before automating the junior work, and write the horizon register so the team can be wrong in a reviewable way.
Module 6 · Part VI · Experience and Conclusions · 50 minutes
Found by Design, Not by Luck: Cases, a Year, Two Plans and a Verdict
Part VI asks whether the design of the earlier parts holds when it meets cases, a calendar and a budget. The lecture is honest about the kind of evidence on offer: three public cases read from published sources, and a fictional year that shows a mechanism and never a prevalence. Its argument is that the failures of the year were each found by a sample, a drill, a review, an exercise or a report, and each was assigned a re-test. The thesis is then judged part by part, and what remains unproved is said aloud.
13 min
Three public cases and seven anti-patterns
In the July 2026 incident the signals existed; the missing element was a person who held the stop decision and could act at the speed of the agents.
In the Arup deepfake fraud no internal system was compromised, so nothing happened that a blue team's telemetry could see.
An anti-pattern recurs because its first step looks reasonable: close faster, buy the service, approve and move on.
Each of the seven has a control from the earlier chapters and a record, so it is found in a repository and not in hindsight.
12 min
A year in records
The records that mattered most were written before they were needed: the interim letter, the stop right with its target, the playbook's exclusions.
The sample found CASE-NR-0231, the drill found the missing console role, the red team found the unlabelled case note, the oversight report found the weak reproduction rate.
Scale changed the shape of the problem and not its nature: Nordvik Region's remedy was a contract, a sample and a charter; Hansa Mutual's a protocol, caps and queue limits.
AI moved the load from reading to approving and did not simply remove it.
12 min
Two plans and three decisions each
Each plan has at most six measures, ordered by reversibility, each with a verb, an owner by role, a date and a verification that produces evidence.
Every increase in delegation is a gate on the class's own evidence, with review quality as a second condition.
A plan that adds without retiring turns into what it was meant to prevent, so each organisation lists what it stops doing.
The management body receives at most three open decisions and is never asked to decide what a record has already decided.
13 min
The thesis tested and the final test
Three parts held with qualifications, the move from the queue to the loop held in part, and the route and wellbeing of analysts is argued but not proved.
The second part is better stated as: from the queue alone to the queue and the loop.
Twelve questions: three answered outright, seven in part, one open, and the question about 2036 answered as the author's labelled projection.
The final test has two questions: can the team show from its own records who or what decided what, and can it stop what it has started and recover?
What the audience takes away
A failure that arrives with an owner, a due date and a re-test is evidence that the design is working.
A stop that has not been timed is a declaration, not a control.
AI can take a very large share of the work, and the team must stay able to say who decided, stop what it has started and do the work without it.
