Introduction: The Blue Team Transformed

All courses / AI Blue / Module 1 / Chapter 1

Learning objectives

After the lesson the participant can:

Explain the five parts of the working thesis and name the evidence that would refute each one
Distinguish the three places where AI sits in a blue team's work and the usage modes they correspond to
Describe the five degrees of delegation and explain why the line between Level 2 Supervised and Level 3 Bounded matters most
Draft a first inventory of the AI that already takes part in a team's work

Key concepts

Blue team: The group of people and functions that defend an organisation: analysts, detection engineers, threat intelligence analysts, threat hunters, incident responders and on-call engineers. The book treats the whole team, not only the security operations centre.
Working thesis: The book's own five-part conclusion: transformed, not abolished; from the queue to the loop; autonomy matched to reversibility; the defenders' AI is defended; and the route to the craft and staff wellbeing are design questions. Each part carries a refutation condition.
Degrees of delegation: The series' autonomy levels applied per function and per action class, from Level 0 Advisory to Level 4 Autonomous. The mode says how the AI is deployed and whose identity it uses; the level says who decides each action.
Level 3 Bounded: The AI executes a defined class of action inside a codified playbook enforced by a policy decision point outside the model, with sampling and a stop path. It is defined by the playbook and the policy decision point, not by the model's confidence.
Records, not claims: The rule that the team's work appears as versioned artefacts in version control, such as detection records, case records, playbook manifests, hunt records, post-incident reviews and mandate manifests.

Interactive exercises

Do them here and get feedback at once. Choose a card and then where it belongs, or drag it.

Interactive exercise 1 · Sort

Which degree of delegation is this?

Sort each description of how an AI system takes part in a blue team function into the degree of delegation the chapter's table gives it.

Interactive exercise 2 · Scenario

The summary that arrived in a supplier release

Read the situation from the chapter's third night scene and choose what the SOC lead should do first.

Teaching plan

10 min	The teacher reads the three night scenes aloud; participants note for each scene who chose the degree of delegation, and discover that nobody did.
15 min	Teacher presentation of the three places where AI sits, the five functions as a loop and the table of the five degrees of delegation.
15 min	Pairs take one thesis claim each, restate it in their own words and argue whether its refutation condition could be observed in their organisation.
25 min	Exercise: participants draft the first AI inventory for their own team or for Nordvik Region, following the six steps of the practical guide.
10 min	Plenary: groups report their unknown findings; the teacher links them to the commissions AIDR-0700 and AIDR-0750 and to the reading paths.

Discussion

In the three night scenes the degree of delegation came from a default. Which defaults in your own tools or contracts are setting a degree of delegation today?
The thesis is presented as a claim about design, not a prediction. What changes in how a management body should read it because of that distinction?
Nordvik Region has to create a practice and Hansa Mutual has to restrain one. Which of the two positions is closer to your organisation, and what follows for where you start?

Written exercise

Exercise · 25 minutes

A first inventory of AI in the team's work

Using the practical guide of the chapter, list every tool in the path from telemetry to closure for your own team, or for Nordvik Region as the chapter describes it (procured SIEM, EDR, email gateway and a managed provider under NR-2025-044). For each tool and managed service record every feature that uses a model. Assign each finding a usage mode, the blue team functions it touches, the data class it processes and a provisional degree of delegation as it actually behaves. Mark each finding as decided, tolerated or unknown. For the managed service, write the three questions the guide says to ask in writing. Do not use logs to find individual analysts.

Deliverable: An inventory table with one row per AI capability, giving mode, functions, data class, actual level, owner and status, plus the three written questions to the provider.

Your work

Self-test

Choose an answer to see whether it is right, or open the answer below each question.

According to the chapter, what did the three night scenes at Nordvik Region and Hansa Mutual have in common?
Show the answer
B. In none of them did anyone choose a degree of delegation; it came from defaults
The chapter stresses that the provider's closure, the shift lead's speed and the console's summary all came from defaults: degrees of delegation exist whether or not anyone chose them.
What defines Level 3 Bounded in the chapter's table of degrees of delegation?
Show the answer
D. A codified playbook enforced by a policy decision point outside the model
Level 3 is defined by the playbook and the policy decision point outside the model, not by the model's confidence. Approval of each action is Level 2 Supervised.
Which evidence would refute the thesis claim 'autonomy matched to reversibility'?
Show the answer
A. Evidence that irreversible containment at Level 4 Autonomous causes less harm than at Level 3 Bounded or below
The thesis table pairs each claim with its refutation. For claim 3 it is evidence that irreversible containment at Level 4 causes less harm than at Level 3 or below; the other options refute claims 2, 4 and 5.