The Future of the Blue Team: Will There Be a SOC in 2036?

All courses / AI Blue / Module 5 / Chapter 24

Learning objectives

After the lesson the participant can:

Label trends as observable, expected or speculation and assign the posture of commitment, preparation or reversibility
Compare the three scenarios for 2036 by who performs each of the five functions
Explain the four things that stay human across the scenarios and the reasons given
Draft a horizon register with a measurable trigger, an owner and a review date for each trend

Key concepts

Horizon register: A register in version control in which every trend carries a label, a measurable trigger, an owner who is a role, and a posture, with a review at twelve months and earlier on any trigger.
Three postures: Observable trends call for commitment: the team builds for them today. Expected trends call for preparation without dependence. Speculation calls for reversibility: avoid any decision that is expensive to undo.
Three scenarios: A, managed and automated; B, dissolved into engineering and platform teams; C, the human-commanded loop. They are devices for thinking, not forecasts, and none carries a probability.
What stays human: Accountability for containment that cannot be undone, judgement under uncertainty, verification of what AI concludes, and the stop and the exit. These are the book's conclusions and design recommendations.
Author's projection: The author's own judgement about 2036, confined to this chapter and Chapter 28, labelled as such, described as the part of the book most likely to be wrong, and written to be falsified.

Interactive exercises

Do them here and get feedback at once. Choose a card and then where it belongs, or drag it.

Interactive exercise 1 · Sort

Observable, expected or speculation?

Sort each statement about the blue team's future under the label the chapter gives it. Expected here includes what the chapter marks as the author's judgement.

Interactive exercise 2 · Scenario

Choosing a trigger for the register

Apply the practical guide for writing a horizon register.

Teaching plan

15 min	Teacher explains the three labels and postures and applies them to the five claims that public discussion tends to merge.
15 min	Scenario tables: groups take scenario A, B or C and state who performs B1 to B5 and where the named incident commander sits.
15 min	Four-step debate on whether the SOC survives, with four arguments per side, where they meet and the split verdict.
35 min	Exercise: participants write a horizon register for their own team, using HZN-NR-BT-01 and HZN-HM-BT-01 as models.
10 min	Closing reading of the author's projection and the five thresholds that would change it; each participant picks one threshold to watch.

Discussion

A register that is never wrong is not being tested. Which trend in your own planning would you be most embarrassed to have written down, and why is that the one to include?
The verdict separates whether an accountable function exists from whether it is called a SOC. Which of the two matters to your board, and which to your analysts?
The author expects verification capacity, not alert volume, to become the binding constraint, and labels this speculation. What would you need to observe to move it to expected?

Written exercise

Exercise · 35 minutes

A horizon register for your team

Follow the seven steps of the practical guide. List at most eight trends, including at least one from each of the three labels and at least one that would be bad news for the team's current plan. Write each as one sentence in the form 'X is happening' or 'X will happen' and name the blue team functions it concerns. Label it: for observable, name the document or measurement; for expected, the source and horizon or the decided instrument; for speculation, what would turn it into an expectation. Attach one trigger measurable from your own records or a named external source, state the posture, name an owner by role and set the review date.

Deliverable: A horizon register of at most eight trends, each with statement, functions, label, evidence, trigger, posture, owner and review date.

Your work

Self-test

Choose an answer to see whether it is right, or open the answer below each question.

Which posture does the horizon register prescribe for a trend labelled speculation?
Show the answer
D. Reversibility: the team avoids decisions that are expensive to undo
Observable trends justify commitment, expected ones preparation and speculative ones reversibility, following the method of AI Governance, Chapter 22.
How does the chapter label a SOC with no human accountable for containment?
Show the answer
B. Speculation, and the series' rule on irreversible actions argues against it
It is the fifth claim in the register and is labelled speculation. The chapter notes that law leaves more room than the series' rule does; the rule is what puts a named person there.
Which of these is one of the five thresholds that would change the author's projection?
Show the answer
C. At least two organisations showing analysts reaching investigation-lead competence without a tier 1 post
The thresholds include a demonstrated route to seniority without junior triage, autonomous closure shown safer on operational data, a legal change on accountability, provider terms becoming the norm and adversary speed no human step can fit.