Conclusions: The Blue Team Transformed

All courses / AI Blue / Module 6 / Chapter 28

Learning objectives

After the lesson the participant can:

• State the verdict on each of the five parts of the thesis and what remains unproved in each
• Distinguish the four kinds of evidence the book uses and explain what 'held' means in its verdicts
• Explain the author's projection for 2036 by function and which parts of it are speculative
• Apply the final test to a team and draft a one-page plan for the first ninety days

Key concepts

Held, not proved

When the chapter says a part of the thesis held, it means it survived the tests the book could apply: the literature, the instruments, the design and the worked cases. None of it is a measured outcome from a real SOC over years.

The queue and the loop

The test changed the second part of the thesis: 'from the queue to the loop' is better stated as 'from the queue alone to the queue and the loop', because the queue remains and a loop with no cap becomes a queue.

A person conducting systems

The third term of the projection: the person who conducts an AI team under a written mandate, engineers, verifies and learns, while a person alone decides and answers for what cannot be undone, is disclosed or is decided about people.

Six commitments of the series

Keep decisions as records that can be corrected, keep the stop outside the system stopped, keep people able to do the work and judge the output, keep dependence reversible, match autonomy to reversibility, and keep a named person in the chair for every consequence.

The final test

Two questions answered by records and drills, not opinions: can the team show from its own records who or what decided what, and can it stop what it has started and recover?

Interactive exercises

Do them here and get feedback at once. Choose a card and then where it belongs, or drag it.

Teaching plan

Discussion

1. The fifth part of the thesis is described as argued but not proved, a requirement on design and not a result. What should an organisation do with a claim of that status?
2. The book does not claim that people are better than machines at detecting intrusions, and sets a high bar on purpose for withdrawing the thesis. What exactly is the claim, then, and why is the bar set there?
3. The sixth commitment applies twice in a blue team: to the incidents it handles and to the analysts themselves. Why is the second application the one a SOC is least likely to see?

Written exercise

Self-test

Choose an answer to see whether it is right, or open the answer below each question.

1. Which part of the thesis does the chapter judge the weakest, argued but not proved?

   1. That the blue team is transformed, not abolished
   2. That autonomy is matched to reversibility, with a stop path outside the system it stops
   3. That the defenders' AI is part of the estate that is defended
   4. That the route by which analysts are made and their wellbeing are design questions
   Show the answer

   D. That the route by which analysts are made and their wellbeing are design questions
   The fifth part rests on established research on automation, but whether the designs work and what AI does to the load are not shown. It is a requirement on design and not a result.

2. Which of the twelve questions does the chapter leave open?

   1. Who may isolate, disable or disclose, and how fast
   2. Whether AI reduces or intensifies fatigue
   3. Which functions may be delegated, to what degree, and who decides
   4. Who is accountable for a missed intrusion that AI closed
   Show the answer

   B. Whether AI reduces or intensifies fatigue
   Question 9 is open: the effect depends on team design and is not yet well measured. The other three are the questions the book answers outright, because a team can settle them by its own decision.

3. In the author's projection for 2036, what is a person alone expected to do in B4 Respond?

   1. Contain anything wide, irreversible or person-related, disclose and command
   2. Execute reversible containment inside a playbook that a policy decision point enforces
   3. Assemble evidence packs and run re-tests
   4. Read, extract and correlate intelligence reports
   Show the answer

   A. Contain anything wide, irreversible or person-related, disclose and command
   The system executes reversible containment inside a playbook, the person conducting systems writes and tests playbooks and holds the stop, and a person alone contains what is wide, irreversible or person-related, discloses and commands.