AI Blue · Module 6 · Experience and Conclusions

A Year on the Blue Team: Nordvik Region and Hansa Mutual

The lesson follows four fictional people through 2027 across all five blue team functions: Karin Lund at Nordvik Region, and Piotr Nowak, Lena Vogel and Thomas Brandt at Hansa Mutual. The year is told as dated decisions, records and measures: charters and an interim letter, a first adopted rule, an escaped closure, a stopped and reversed containment, drills that first failed, an oversight report and a works agreement annex. Participants write a year-in-review from records.

Lesson 26 of 28Chapter 2690 minutes

Read the chapterThe whitepaperThe slides

All courses / AI Blue / Module 6 / Chapter 26

Learning objectives

After the lesson the participant can:

Key concepts

Illustrative fiction
Everything in the chapter that happens in 2027, every person, date, figure and record, is invented to show the book's design at work. None of it is a report of events or a forecast.
Interim letter
The letter signed on 2027-01-27 under KBV-IT-2024: sampling results, the AI-use log and oversight measures are reported in aggregate only, and reviews carry no measure by person. It held until the SOC annex was signed on 2027-10-28.
A stop only those not on call could use
Nordvik Region's first out-of-hours drill found that no manager on the rota held the console role; a deputy with rights was reached after 14 minutes. AIDR-0731 set a 10-minute budget and assigned the role to every rota member.
Found by the design
The book's reading of the year: failures were found by a sample, a drill, a red-team exercise and an oversight report, and each arrived with an owner, a due date and a re-test.
Year-in-review from records
An account in which every sentence has a record behind it, every figure carries its denominator, no measure is reported by person, and a reviewer who was not part of the work checks every number.

Interactive exercises

Do them here and get feedback at once. Choose a card and then where it belongs, or drag it.

Interactive exercise 1 · Put in order

The year 2027 in records

Put these events from the two organisations' illustrative year 2027 in the order in which they happened, from January to October.

Interactive exercise 2 · Match

Four people and their part in the year

Match each of the four fictional people with their role and what they did in the year.

Teaching plan

10 minTeacher sets out the starting position and the fiction notice, and introduces the four people and their roles.
25 minTimeline wall: groups place the year's dated events for one organisation on a line and mark for each the record, the function and how any failure was found.
10 minClose reading of the night of 2027-04-12: the 53 seconds to isolation, the stop in 57 seconds against a target of 120, and the 38-second approval.
35 minExercise: participants write a year-in-review from records for their own team or for Nordvik Region.
10 minPlenary on the three conclusions the records support, and on the works council as a design partner.

Discussion

  1. The review of 2027-05-06 could be blameless because the record of what was meant to happen existed. Which records would your team need before its next incident for the same to be true?
  2. Piotr Nowak's team said the agents had not made the night quieter, only different, with less to read and more to approve. How would you find out whether the same is true in your team?
  3. Nordvik Region's best investments were small and Hansa Mutual's were structural. Which small investment would change most in your organisation this year?

Written exercise

Exercise · 35 minutes

A year-in-review from records, not memory

Follow the six steps of the practical guide for your own team, or for Nordvik Region using the events of the chapter. List the year's decisions with date, decider and status. List the incidents and reviews and note whether each finding has a passed re-test and on what date. List the measures from the agreed dashboards, using counts when the denominator is small. Classify each control as verified, declared or failed. Compare each decision's stated purpose with what the records show and say in the first line where they differ. End with the three decisions the records say are due next, with their owners. Name the reviewer who checks every number.

Deliverable: A year-in-review of at most two pages with decisions, incidents, measures with denominators, classified controls and three decisions due next.

Self-test

Choose an answer to see whether it is right, or open the answer below each question.

  1. What did Nordvik Region's first out-of-hours stop drill on 2027-05-13 find?

    Show the answer

    B. That no manager on the rota held the console role needed for the stop
    The provider paged in 3 minutes 50 seconds, but the role had been given only to Karin Lund and the CISO's deputy. A deputy was reached after 14 minutes; AIDR-0731 fixed the role and set a 10-minute budget.

  2. How was the escaped phishing closure CASE-NR-0231 found?

    Show the answer

    A. By the Region's weekly sample of the provider's closed alerts
    The provider's AI closed the alert on 2027-03-06 and the Region's weekly sample reopened it. The case then showed the sample had no size, and AIDR-0730 set it at 30 closures a week.

  3. Which of these is one of the three conclusions the book draws from the year's records?

    Show the answer

    D. The records that mattered most were written before they were needed
    The three conclusions are that the key records existed beforehand, that failures were found by the design and not by luck, and that scale changed the shape of the problem and not its nature.