Case Studies and Anti-Patterns · AI Blue: the course

All courses / AI Blue / Module 6 / Chapter 25

Learning objectives

After the lesson the participant can:

Distinguish what a source reports from the author's interpretation in the three public cases
Explain the mechanism and the control for each of the seven anti-patterns
Locate each anti-pattern at the usage mode or degree of delegation where it concentrates
Review a team against the seven anti-patterns from its own records and assign controls and owners

Key concepts

Anti-pattern: A failure that recurs because its first step looks reasonable. Each is described by a name, a case, the mechanism and the control, and each gets a record so the pattern can be found in a team's own repository.
Closing by metric: The dashboard improves because a triage agent closes a growing share of alerts, since closure speed can be bought by closing. The control is a closure policy per class with an owner, sampling, seeded incidents and a numeric stop condition.
The provider's black box: A managed provider's AI acts at an effective autonomy nobody decided, under a contract silent on autonomy, sampling and notice of model change. The control is a weekly sample and the six terms of annex MS-2.
The rubber-stamp review: Human approval of agent proposals is given in seconds, so the approval no longer verifies anything. The control is tiered review with reproduction, a critique agent, caps on open proposals and seeded errors.
The unmonitored monitor: The SOC platform concentrates telemetry, detections, playbooks and agents; if its heartbeats stop or its case store accepts untrusted text as trusted, the team is blind or misled without an alarm. The control is tier-0 treatment.

Interactive exercises

Do them here and get feedback at once. Choose a card and then where it belongs, or drag it.

Interactive exercise 1 · Match

Anti-pattern and the control that changes the outcome

Match each anti-pattern of the transformed blue team with the control the chapter's table assigns to it.

Interactive exercise 2 · Scenario

A reopen rate of zero

Apply the chapter's two-hour anti-pattern review to what the records show.

Teaching plan

20 min	Teacher tells the July 2026 incident from the blue side as a sequence of signals and stop decisions, separating what the sources report from the author's reading.
15 min	Groups discuss the Arup case and the espionage campaign: what a blue team could not see in its telemetry and what remains its own part.
20 min	Carousel on the seven anti-patterns: each station holds one case, and groups write the mechanism and the control before reading the chapter's answer.
40 min	Exercise: groups run the two-hour anti-pattern review in compressed form against their own records or the records of one fictional organisation.
10 min	Plenary: each group names the anti-pattern it is most exposed to and the first record it will open.

Discussion

In the July 2026 incident alerts fired and responders investigated, yet on-call staff advised that stopping the run was not required. What would have had to be written down beforehand for that advice to be different?
The Arup fraud left no event in the SOC's telemetry. What is the blue team's legitimate part in a case it cannot detect, and where does that part end?
The chapter says the cases support the thesis more than they prove it, because they are few and the illustrative ones are the author's. How should that limit the conclusions you draw from them?

Written exercise

Exercise · 40 minutes

A two-hour anti-pattern review, compressed

Run the review of the practical guide against your own team's records, or against Hansa Mutual's as the book gives them. Set the rules: evidence comes from records and nobody is named in a finding. Check each of the seven patterns with the guide's test: reopen rate and class owners for closing by metric; ten fired detections for owner, test and review date; stop holder and last timed drill for each agent with write access; class list, level and notice terms for each service with embedded AI; the oversight-quality metric and seeded errors for the rubber stamp; unassisted cases per junior; and whether a silent log source would page anyone. Record a finding, a control, an owner and a re-test date for each exposure.

Deliverable: An anti-pattern register with seven entries, each with exposure, evidence, control, owner and re-test date, and a draft decision record.

Your work

Self-test

Choose an answer to see whether it is right, or open the answer below each question.

Why is the Arup deepfake fraud useful to a blue team, according to the chapter?
Show the answer
C. Because nothing happened that a blue team's telemetry could see: no internal system was compromised
No credential was stolen and no log line written that a detection could match. What remains for the blue team is mainly a matter of routes and anticipation, which the author marks as his own conclusion.
In the rubber-stamp case from INC-HM-2027-0455, why was the second isolation approved in 38 seconds?
Show the answer
A. Because the approval screen did not show the asset tags
The host was tagged shared, so the proposal waited for a human at Level 2. The commander approved in 38 seconds because the screen did not show the tags; Chapter 10 reads this as a measurement of the review design, not of the commander.
At which usage mode does the anti-pattern 'the provider's black box' concentrate?
Show the answer
D. Mode 0 Ambient AI, because the level is undeclared until the contract says
The provider's black box is the Mode 0 blind spot: vendor AI in a managed service may act at an effective autonomy nobody decided, so the effective level is unknown until the contract states it.