AI Blue: teacher's guide

How to use this guide

The guide holds everything a teacher needs to run the course on AI Blue: the lecture of each module with a timed outline, the teaching plan of every lesson, the discussion questions, the exercises and the answers to the self-tests. The agendas of the three formats are on the course page; the slides are in the deck of the book.

Executive briefing (90 minutes): A briefing on what a management body must be able to see and decide when AI closes alerts and contains incidents. It covers the working thesis, the ceiling on delegation by action class, who holds the decisions to contain and disclose, what the reporting clocks ask of the record, and the one-page board report. It ends with the three questions a board asks each budget round and the two questions of the final test.
One-day seminar (1 day): A working day that takes a team from an inventory of its AI to a first delegation profile, a closure policy, a tested stop path and a set of measures. Each block pairs a short input with an exercise on the participants' own material or on Nordvik Region and Hansa Mutual. Participants leave with drafts of the artefacts and a ninety-day plan.
Full course (6 weeks, one module a week): The full course follows the six parts of the book, one module a week, with a lecture on each part and one lesson per chapter. Every lesson ends in an artefact of the kind its chapter describes, and the artefacts accumulate into the capstone: a delegation dossier for one function of the participant's own team. The last week tests the dossier against the anti-patterns and the final test.

Keynote on the whole book · 45 minutes

The Blue Team Transformed: Who Decided, Who Can Stop It, Who Can Still Do the Work

For security leaders, analysts, architects, board members and employee representatives in European enterprises and public authorities

In 2026 the queue of a security operations centre is read, enriched, triaged and in places acted on by AI, while adversaries use AI to move faster. The keynote asks what the team becomes now that this has happened. It argues that the blue team is transformed, not abolished: the work moves from the queue alone to the queue and the loop, autonomy is matched to reversibility with a stop path outside the system it stops, the defenders' own AI is defended as tier 0, and the making of analysts and their wellbeing are design questions. It ends with a test any team can take.

6 min	A night in two security operations centres A provider's AI closes an alert at Nordvik Region; a shift lead approves an agent's proposal at Hansa Mutual; an AI summary appears in a console. In none of the scenes did anyone choose a degree of delegation, so the first task is to find the delegation that already exists. The five functions, B1 Anticipate, B2 Detect, B3 Investigate, B4 Respond and B5 Learn, are the unit, because they differ in reversibility.
7 min	Pressure without panic The documented effect of adversaries' AI is speed and volume; the exploitation window is measured in days and, by one report, begins on average before a patch. No source in the book's bibliography measures telemetry growth across organisations, and the book says so. Speed that is wrong is a harm of the team's own making, so pressure justifies a transformation and not autonomy by itself.
9 min	Autonomy matched to reversibility Action classes AC-0 to AC-4 set the ceiling by the effect of a wrong action, not by the confidence of the model. Level 3 Bounded is a codified playbook enforced by a policy decision point outside the model; Level 4 Autonomous is never used for an irreversible B4 Respond action or a decision about a named person's access to work. A stop path must not run inside the system it stops, and a stop that has not been timed is a declaration, not a control. On the night of 2027-04-12 the design worked and was found wanting in the same eight minutes: a stop in 57 seconds and an approval in 38.
8 min	Verifying and defending the team's own AI The analyst depends on the AI to read evidence that the adversary can write, so review must not start from the AI's answer. Seeded errors and seeded incidents measure whether review is real, and a missed target is reported as missed. Controls outside the model bound what a manipulated agent can do; they do not bound what it can make an analyst believe.
8 min	The people in the loop AI moved the load from reading to approving and did not simply remove it; no study the book relies on measures the effect on fatigue. Closure by class removes the queue through which analysts learned, so the route is rebuilt by design with unassisted practice and an entry post. The system is measured and the person is not: measures are agreed with employee representatives before collection and reported in aggregate.
7 min	The verdict and the final test Three parts of the thesis held with qualifications, one held in part, and the part on the route and wellbeing of analysts is argued but not proved. By 2036 systems are expected to read, correlate, draft and execute inside playbooks, while a person alone answers for what cannot be undone. The final test: can the team show from its own records who or what decided what, and can it stop what it has started and recover?

What the audience takes away

Degrees of delegation exist whether or not anyone chose them, so write them down per function and action class with a named owner.
Put the stop outside the system it stops, give it to named people who need no approval, and time it.
Keep people able to do the work and judge the output, because that is what separates a defence from a dependence.

Module 1 · Part I · The Blue Team in Question

Part I sets the baseline and the definition. It states the book's five-part working thesis, describes the blue team before the transformation through the five functions B1 Anticipate, B2 Detect, B3 Investigate, B4 Respond and B5 Learn, weighs the evidence on three pressures, and defines the transformed team as an artefact: a charter, a delegation profile and a delegation register. Participants leave with a first AI inventory, a function map, a pressure register and a draft delegation profile.

Lecture · 45 minutes

From the Queue to the Loop: The Blue Team as a Written Artefact

The lecture carries the argument of Part I in one line: degrees of delegation exist in a security operations centre whether or not anyone chose them, so the team has to write them down. It moves from three night scenes in which defaults did the deciding, through the baseline of five functions and a tiered queue, to what the evidence on adversaries, alert load and scarce talent does and does not show, and ends with the charter, the delegation profile and the register that turn a team into something that can be read, tested and changed.

7 min	One night, three defaults Three illustrative scenes: a provider's AI closes an alert at Nordvik Region, a shift lead approves an agent's proposal at Hansa Mutual, and an AI summary appears in the EDR console. In none of the scenes did anyone choose a degree of delegation; the provider's closure, the shift lead's speed and the console's summary all came from defaults. AI sits in three places that are governed differently: in the products, in the analyst's own work and in systems built or procured to perform a function.
8 min	The working thesis and what would refute it Five claims: transformed, not abolished; from the queue to the loop; autonomy matched to reversibility; the defenders' AI is defended; the route to the craft and wellbeing are design questions. Each claim is stated together with the evidence that would show it wrong, because the thesis is a claim about design and not a prediction. The line between Level 2 Supervised and Level 3 Bounded matters most: a person stops seeing each action and starts answering for a class of actions.
8 min	The baseline: five functions, a pyramid and a queue The function, not the job title, is the unit: B1 Anticipate, B2 Detect, B3 Investigate, B4 Respond and B5 Learn form a loop. The tiered SOC rests on four assumptions: headcount handles volume, skill is learned on the routine, the queue is the interface and a person reads each alert. The usual measures count speed, volume or coverage, and none counts the quality of a judgement.
10 min	Pressure, read with care Agency assessments, developer and threat-intelligence reports and laboratory studies are three kinds of source that must be read differently. The observable effect of adversaries' AI is speed and volume; fully autonomous campaigns at scale against European targets remain speculation. The alert-queue arithmetic is an assumed illustration, and no source in the bibliography measures telemetry growth across organisations. Pressure justifies a transformation; it does not by itself justify autonomy, because speed that is wrong is a harm of the team's own making.
12 min	The team as an artefact The charter states mandate, decision rights and what no system may do; the delegation profile states mode and level per function and action class; the register states the sum. Action classes AC-0 to AC-4 carry default ceilings from Level 3 Bounded for preservation down to Level 1 Assisted for irreversible or external actions. Raising a level is slow and needs a grant authority; lowering it is immediate for any holder of the stop right. Delegation moves work, not accountability: the chain of named people is the same at every level of delegation.

What the audience takes away

A degree of delegation that nobody chose is still a degree of delegation, so the first task is an inventory of AI at the autonomy it actually has.
The evidence supports a transformation of the blue team but not autonomy on the grounds of speed alone.
A charter, a delegation profile and a delegation register make the team's mandate readable, testable and reversible.

Chapter 1 · 75 minutes

Introduction: The Blue Team Transformed

The lesson states the book's question: what the blue team becomes now that AI reads, enriches, triages and in places acts on the queue. Participants meet the five blue team functions, the five degrees of delegation, the five-part working thesis with its refutation conditions, the European instruments that make the question current, and the two organisations, Nordvik Region and Hansa Mutual, with their commissions AIDR-0700 and AIDR-0750.

Learning objectives

Explain the five parts of the working thesis and name the evidence that would refute each one
Distinguish the three places where AI sits in a blue team's work and the usage modes they correspond to
Describe the five degrees of delegation and explain why the line between Level 2 Supervised and Level 3 Bounded matters most
Draft a first inventory of the AI that already takes part in a team's work

Key concepts

Blue team: The group of people and functions that defend an organisation: analysts, detection engineers, threat intelligence analysts, threat hunters, incident responders and on-call engineers. The book treats the whole team, not only the security operations centre.
Working thesis: The book's own five-part conclusion: transformed, not abolished; from the queue to the loop; autonomy matched to reversibility; the defenders' AI is defended; and the route to the craft and staff wellbeing are design questions. Each part carries a refutation condition.
Degrees of delegation: The series' autonomy levels applied per function and per action class, from Level 0 Advisory to Level 4 Autonomous. The mode says how the AI is deployed and whose identity it uses; the level says who decides each action.
Level 3 Bounded: The AI executes a defined class of action inside a codified playbook enforced by a policy decision point outside the model, with sampling and a stop path. It is defined by the playbook and the policy decision point, not by the model's confidence.
Records, not claims: The rule that the team's work appears as versioned artefacts in version control, such as detection records, case records, playbook manifests, hunt records, post-incident reviews and mandate manifests.

Teaching plan

10 min	The teacher reads the three night scenes aloud; participants note for each scene who chose the degree of delegation, and discover that nobody did.
15 min	Teacher presentation of the three places where AI sits, the five functions as a loop and the table of the five degrees of delegation.
15 min	Pairs take one thesis claim each, restate it in their own words and argue whether its refutation condition could be observed in their organisation.
25 min	Exercise: participants draft the first AI inventory for their own team or for Nordvik Region, following the six steps of the practical guide.
10 min	Plenary: groups report their unknown findings; the teacher links them to the commissions AIDR-0700 and AIDR-0750 and to the reading paths.

Discussion

In the three night scenes the degree of delegation came from a default. Which defaults in your own tools or contracts are setting a degree of delegation today?
The thesis is presented as a claim about design, not a prediction. What changes in how a management body should read it because of that distinction?
Nordvik Region has to create a practice and Hansa Mutual has to restrain one. Which of the two positions is closer to your organisation, and what follows for where you start?

Exercise · 25 minutes

A first inventory of AI in the team's work

Using the practical guide of the chapter, list every tool in the path from telemetry to closure for your own team, or for Nordvik Region as the chapter describes it (procured SIEM, EDR, email gateway and a managed provider under NR-2025-044). For each tool and managed service record every feature that uses a model. Assign each finding a usage mode, the blue team functions it touches, the data class it processes and a provisional degree of delegation as it actually behaves. Mark each finding as decided, tolerated or unknown. For the managed service, write the three questions the guide says to ask in writing. Do not use logs to find individual analysts.

Deliverable: An inventory table with one row per AI capability, giving mode, functions, data class, actual level, owner and status, plus the three written questions to the provider.

Self-test

According to the chapter, what did the three night scenes at Nordvik Region and Hansa Mutual have in common?
1. In each scene an agent took an irreversible action at Level 4 Autonomous without any playbook
2. In none of them did anyone choose a degree of delegation; it came from defaults
3. In each scene the managed provider had breached framework agreement NR-2025-044
4. In all of them a works council had refused consent to the tool
What defines Level 3 Bounded in the chapter's table of degrees of delegation?
1. A person approves each proposed action before it runs, and the model only drafts it
2. The model's confidence score exceeds a threshold that the supplier has set
3. The AI selects and executes actions without a playbook bound or a prior human decision
4. A codified playbook enforced by a policy decision point outside the model
Which evidence would refute the thesis claim 'autonomy matched to reversibility'?
1. Evidence that irreversible containment at Level 4 Autonomous causes less harm than at Level 3 Bounded or below
2. Evidence that queue-centred teams match loop-centred teams on coverage, time to contain and strain on staff
3. Evidence that agents reading attacker-writable input need no more containment than other automation
4. Evidence that analysts' wellbeing is unaffected by working at machine speed and on call

Chapter 2 · 75 minutes

What the Blue Team Does: Five Functions, Tiers and the Alert Queue

The lesson describes the blue team before the transformation. Participants define the five blue team functions and their boundaries, map them to the Functions of NIST CSF 2.0, examine the tiered SOC and its four assumptions, the tools and the personal data they hold, the measures a SOC reports and what each rewards, and separate craft from routine. The artefact is the function map.

Learning objectives

Define the five blue team functions and apply the four boundaries the chapter draws between them
Explain the four assumptions on which the tiered SOC and its queue rest
Identify what each common SOC measure rewards when it is used alone
Draft a function map that records owners, tools, automation without a reader and craft

Key concepts

Function map: The first artefact of the book: for each of the five functions it names who performs it, with which tools and data location, which parts already run without a person reading, who agreed to them, the current measures and the parts judged to be craft.
Boundary between B2 Detect and B3 Investigate: Triage belongs to B3 Investigate, not to B2 Detect. B2 answers for whether the alert should exist; B3 answers for what it means.
Four assumptions of the tiered SOC: Volume is handled by headcount, skill is acquired by doing the routine, the queue is the interface, and a person reads each alert. Chapters 5 to 11 test these assumptions.
Craft and routine: Routine is work that follows a known procedure, is repeated in the same form and can be checked against a rule. Every function contains both craft and routine, and the transformation is a redistribution between them.
Automation without a reader: The parts of a function that already close or act without a person reading, whether vendor features, SOAR playbooks or a provider's processes. They form the Mode 0 and automation baseline and need a named person who accepted them.

Teaching plan

15 min	Teacher presentation of the seven recurring roles, the five functions as a loop and their mapping to the CSF 2.0 Functions and Categories.
10 min	Sorting task: participants place ten everyday tasks, such as triage, containment and a hunt, in the right function using the four boundaries.
15 min	Group reading of the measures table; each group names one behaviour a measure rewards if used alone and how AI would amplify it.
25 min	Exercise: participants write a function map for their own team or complete Nordvik Region's map from the chapter's profile.
10 min	Plenary comparison of the maps with the worked example, focusing on unowned functions and entries where acceptance was not recorded.

Discussion

The chapter says the function, not the job title, is the unit of the book. What does your organisation lose or gain when it describes its security work by function instead of by title?
Tier 1 is both where the queue is worked and where analysts learn. What happens to each purpose if the routine is automated?
Security telemetry records what named people did. How does that fact change who should be in the room when the team introduces an AI capability?

Exercise · 25 minutes

Mapping a team's work

Follow the eight steps of the chapter's practical guide. List the five functions as rows. For each, name the person or provider who performs it today, or record it as unowned. Record the tools and where the data sits, the tier or role and the hours covered. Mark the parts that already run without a person reading and who agreed to them, the current measures and who sees them, and the parts you judge to be craft, with a short reason. Give every row a review date no more than six months ahead. Use your own team, or Nordvik Region, where the chapter shows a phishing-report classifier in the email gateway with acceptance not recorded.

Deliverable: A five-row function map with owner, tools, data location, hours, automation without a reader and who accepted it, measures, craft and review date.

Self-test

To which function does the chapter assign triage, and why?
1. B2 Detect, because the alert is the product of a detection and its owner must also say what it means
2. B4 Respond, because triage ends in a containment decision
3. B3 Investigate, because B2 answers for whether the alert should exist and B3 for what it means
4. B1 Anticipate, because triage relies on threat intelligence and exposure data
What does Nordvik Region's function map show before any transformation begins?
1. An automation that closes alerts and that nobody accepted for the Region, and three unowned functions
2. A full pyramid of tiers with a named owner for every one of the five functions
3. A detection-engineering team of four that manages detections as code
4. A group red team of five that runs quarterly purple exercises with the detection engineers
What does the chapter say about the measures a SOC traditionally reports, such as mean time to detect, mean time to respond and closure rate?
1. They are obsolete and should be removed from every management report
2. They are required by NIS 2 and therefore cannot be changed
3. They measure individual analysts fairly as long as the figures are reported by name
4. They count speed, volume or coverage, and none counts the quality of a judgement

Chapter 3 · 90 minutes

The Pressure on the Blue Team: Machine-Speed Adversaries, Alert Volume and Scarce Talent

The lesson weighs the three pressures on the blue team: adversaries that use AI, an alert queue that can exceed human capacity, and scarce talent. Participants learn to read agency assessments, developer reports and laboratory studies differently, to label each pressure observable, expected or speculation, and to see why the pressure justifies transformation but not autonomy by itself. The artefact is a pressure register with a local measure and a decision per pressure.

Learning objectives

Compare what agency assessments, developer and threat-intelligence reports and laboratory studies can and cannot show about adversaries' use of AI
Classify the chapter's pressures as observable, expected or speculation and justify each label
Explain the four reasons why speed alone does not justify autonomy
Draft a pressure register entry with evidence, label, local measure, threshold and decision

Key concepts

Pressure register: One reviewed file that keeps the pressures bearing on the team, each with its evidence, its label, a local measure, a threshold and the decision it informs, so the team does not respond to the loudest headline or a vendor's account of urgency.
Exploitation window: The time between a vulnerability becoming known and its exploitation. Mandiant reported an average of 5 days for vulnerabilities disclosed in 2023, down from 63 days in 2018 and 2019, and M-Trends 2026 an estimated mean of minus seven days for 2025.
Four ways out of the capacity arithmetic: When demand exceeds triage capacity a team can lower the triage time per alert, which automation offers, lower the inflow, which detection engineering offers, add people, which the labour market limits, or accept that alerts are closed unread, the failure the first three exist to avoid.
Capability versus use: Laboratory studies show what AI systems can do under test conditions, which is different from what adversaries are documented to do. The chapter keeps the two apart when it weighs the evidence.
Design assumption: Machine-speed adversaries as the normal case for a European organisation is the book's design assumption, not a forecast: an inference the team plans for and tests by drill.

Teaching plan

15 min	The teacher walks through the assumed capacity table: six analysts, 225 alerts a day of capacity against 300 arriving in staffed hours, and the four ways out.
20 min	Source-reading task: groups receive the chapter's summaries of ENISA, ANSSI, the NCSC, GTIG, Anthropic and M-Trends 2026 and state what each measured, in whom and from what vantage point.
15 min	Labelling round: the class assigns observable, expected, speculation or gap in the evidence to the rows of the chapter's table before seeing the labels.
30 min	Exercise: participants write three entries of a pressure register for their team, modelled on PRS-HM-2027-01.
10 min	Debrief on what the pressure does not justify, with the four reasons of the chapter.

Discussion

ANSSI reported no confirmed AI-assisted attack against French actors in February 2026, while GTIG reported an AI-developed exploit in a criminal plan in May 2026. How can both statements be held without contradiction?
The chapter admits that no source in its bibliography measures telemetry growth across organisations. How should a team argue for investment when the evidence for its own load is local?
The chapter argues that cutting the team is not a response to pressure. What arguments would you expect from a budget holder, and what evidence would answer them?

Exercise · 30 minutes

Writing the team's pressure register

Following the seven steps of the practical guide, choose three pressures that matter locally, starting from the chapter's table. For each, record the evidence and say in one line what it measured (population, period, method), marking any figure that rests on a single case or a vendor's own platform. Label each entry observable, expected or speculation. Attach one local measure the team already has, for example the 90th percentile hours from a feed entry to mitigation. Name a threshold and the decision the SOC lead takes when it is crossed. Set a review date and review triggers. No entry may measure a named person.

Deliverable: A three-entry pressure register with label, source, local measure, threshold, decision, review date and triggers for each pressure.

Self-test

In the chapter's assumed illustration for a team shaped like Nordvik Region's, what is the relation between demand and capacity in the staffed hours?
1. 600 alerts against a capacity of 300, so half of them go unread
2. 300 alerts against a capacity of 225, so demand is 1.3 times capacity
3. 225 alerts against a capacity of 300, so the team has spare capacity for hunting
4. 300 alerts against a capacity of 600, so the provider is not needed
Which label does the chapter give to fully autonomous campaigns at scale against European targets?
1. Observable, because developers have reported such campaigns
2. Expected, because ENISA judges them highly likely
3. A design assumption that needs no evidence
4. Speculation, because no source documents it
Which of these is one of the chapter's four reasons why pressure does not justify autonomy on grounds of speed alone?
1. Speed that is wrong is faster to cause harm, such as a containment that wrongly isolates a production system
2. AI systems are too slow to match adversaries whose tooling works in bursts of seconds
3. European law prohibits any automated containment action in a SOC
4. Adversaries have not yet been observed using AI anywhere along the attack chain

Chapter 4 · 105 minutes

The Transformed Blue Team Defined: Mandate, Functions and Degrees of Delegation

The lesson defines the transformed blue team as an artefact. Participants study the team charter with its mandate and decision rights, the action classes AC-0 to AC-4 and their default ceilings, the six rules that make a delegation profile enforceable, the delegation register with its reversibility tests, the chain of accountability that does not move, and the review triggers. They compare the profiles DLG-HM-SOC-01 and DLG-NR-SEC-01.

Learning objectives

Classify response actions into the classes AC-0 to AC-4 and state the default ceiling of each
Apply the six rules of the delegation profile to a proposed delegation
Explain who answers when AI closed an alert and an analyst accepted the closure
Draft a team charter extract and first delegation profile entries with named owners, stop holders and review dates

Key concepts

Team charter: A versioned artefact, identified as ROLE-*, that states the team's mandate (scope, authority, obligation), its decision rights and what is not delegable to any system. It is owned by the CISO and the SOC lead.
Delegation profile: The artefact, identified as DLG-*, that states for every capability the usage mode and the level at which it may act, per function and action class. An unlisted action is not delegated and the lowest ceiling governs.
Action classes AC-0 to AC-4: AC-0 Preserve and AC-1 Narrow and reversible have a default ceiling of Level 3 Bounded; AC-2 Wide or business-critical and AC-3 Partly reversible, or about a person, Level 2 Supervised; AC-4 Irreversible or external, Level 1 Assisted.
Delegation register: The sum of what has been delegated. Each row records the delegation, function and class, level, the record that granted it, the fallback if the AI is removed and the date of the next reversibility test.
Asymmetry of the stop right: Raising a level is a recorded decision by the named grant authority; lowering a level or stopping an agent can be done at once by any holder of the stop right. Restart is the owner's decision after review.

Teaching plan

15 min	Teacher presentation of the stack of artefacts: charter, delegation profile, mandate manifest, playbook manifest, delegation register and AI Decision Record, with owner and pace of change.
15 min	Classification drill: participants place twelve response actions in AC-0 to AC-4 and state the default ceiling; disagreements are resolved with the lowest-ceiling rule.
15 min	Close reading of the two worked profiles: what Hansa Mutual runs below its ceiling and what Nordvik Region records as not established.
40 min	Exercise: groups run a compressed version of the working session in the practical guide and produce a first delegation profile.
20 min	Case discussion of the missed intrusion that AI closed and an analyst accepted, using the four points on accountability, then a review of the triggers table.

Discussion

Both organisations use Level 4 for no action at all, a stronger position than the rule requires. What does a bright line make cheaper, and what might it cost?
At Nordvik Region the CISO is both owner and grant authority. How does the charter compensate, and would that compensation be enough in your organisation?
The chapter says 'the AI closed it' is a statement of mechanism, not of responsibility. How would a post-incident review in your organisation need to change to honour that?

Exercise · 40 minutes

A first delegation profile in one working session

Work as the authors named in the practical guide. Inventory the AI capabilities of your team, or of Hansa Mutual's group SOC as the chapter describes it, by name, usage mode and identity. For each, list what it can do and give each action a response class from AC-0 to AC-4, or mark it as having no effect on the estate. Set the level for each action so that the lowest ceiling governs, keep Modes 1 to 3 at or below Level 2, and name the playbook and policy decision point for every Level 3 entry. Name the owner, the stop holders, the grant authority and the decider. Add a reversibility test date and the not-delegable block.

Deliverable: A delegation profile of at least six entries with function, capability, mode, action, class, level, named owner, stop holder and review date, plus the first rows of a delegation register.

Self-test

What is the default ceiling for an AC-3 action, such as disabling the account of a named user?
1. Level 3 Bounded, inside a playbook enforced by a policy decision point
2. Level 4 Autonomous, provided the agent has an identity of its own
3. Level 2 Supervised, with a named human approver
4. Level 0 Advisory, with no drafting by the system
According to the profile rules, what happens to a Level 3 entry that does not name the playbook or closure policy that bounds it and its enforcement by a policy decision point outside the model?
1. It remains Level 3 until the next calendar review of the profile
2. It counts as Level 2, because Level 3 must name its enforcement
3. It is promoted to Level 4 by the grant authority
4. It is removed from the delegation register
What does the review default prescribe when a delegation fails its reversibility test?
1. The test is repeated at the next quarterly drill before anything changes
2. The agent's model is replaced and the level is kept
3. The management body accepts the residual risk in its minutes
4. The entry drops one level at once and further delegation in its function is frozen

Module 2 · Part II · The Craft

Part II follows the craft function by function: B1 Anticipate, B2 Detect, B3 Investigate, B4 Respond and B5 Learn. Each chapter shows what AI now drafts, ranks, closes or executes, what remains a human decision, and which versioned artefact carries the work: intelligence, detection, case, hunt, playbook and review records. Participants leave able to write a closure policy, review an AI-assisted case, set the ceiling for a response action, drill a stop path and close a finding on a passing re-test.

Lecture · 60 minutes

The Craft as Code: Seven Records and the Decisions They Protect

The lecture follows one thread through Part II: a sector-sharing report at Hansa Mutual becomes the intelligence record INTEL-HM-0142, the hunt HNT-HM-0031, the detection DET-HM-0455, the playbook PBK-HM-ISOLATE-01, the incident INC-HM-2027-0455 and the review PIR-HM-0455. At each step AI does the reading, drafting or executing, a named person decides, and a check outside the model enforces the limit. The argument is that the queue becomes a loop only when every alert, hunt and incident ends in a verified change to a record that somebody owns.

8 min	B1 Anticipate: intelligence as a gate to action The pipeline of collection, extraction, verification, hypothesis and routing keeps two human decision points and one verification step. Extraction runs at Level 1 Assisted because it can invent indicators, map the wrong technique and flatten a hedge into an attribution. The extractor holds no tools that act, because adversaries write some of what it reads.
8 min	B2 Detect: a detection counts when its test has run A detection record holds logic, data sources, mapping, tests, ownership and cost, and origin; a rule in a console holds none of the history. The test gate sits before human review; unit, replay, simulation and the purple loop serve different purposes. Hansa Mutual's drafting assistant produced 48 drafts in a quarter and 15 were merged: output counted in drafts answers the wrong question.
10 min	Triage: closure by class, never by alert Of the five triage tasks, enrichment, correlation, deduplication, summarisation and closure, only closure takes the decision from a person. A closure policy states the definition, the evidence to close, the level, the owner, sampling, seeding and a stop condition written as numbers. CASE-NR-0231 shows the Mode 0 blind spot: a provider's AI closed an alert under no rule the Region had seen, and a weekly sample reopened it.
10 min	B3 Investigate and hunting: reproducible without the AI The investigator steers, challenges and verifies; every timeline entry is resolved to an event by a check outside the model. In CASE-HM-1207 the AI read a UTC stamp as local time and moved an event two hours; the check of each entry against its cited event caught it. A hunt that finds nothing ends in a coverage statement that says what was searched and what was not. No hunting agent changes the estate, and anomaly rankings are leads, not findings.
14 min	B4 Respond: the ceiling, the manifest and the stop path The ceiling follows the effect of a wrong action, not the confidence of the model; five questions set it and the lowest answer governs. The playbook manifest carries the authority, and a policy decision point outside the model enforces it. On 2027-04-12 two corroborating sources shared a data path, a legitimate rollout was contained, and the stop and the reversal were separate human acts. The stop path must not run inside the system it stops, and it is drilled every quarter against a measured target.
10 min	B5 Learn: a finding closes when the re-test passes A blameless review ends in at most three changes, each with an owner, a date, an artefact and a re-test designed when the finding is opened. The new risk with AI is a fluent review that nobody checked; the evidence pack is the authority and the timeline is corrected in the room. Detection debt and playbook debt are registers with ages and consequences; a mandate past its review date lapses at the policy decision point.

What the audience takes away

In every function AI proposes or executes inside a written bound, a named person decides, and the enforcement sits outside the model.
Verification does not mean rereading everything: it means stored queries, resolved references, independent sources, sampling and seeded errors.
The loop is closed only when an incident or exercise ends in a changed record whose re-test has passed.

Chapter 5 · 75 minutes

Anticipate: Threat Intelligence and Exposure at Machine Speed

The lesson treats B1 Anticipate and the part of B2 Detect it feeds. Participants follow the five-stage pipeline from report to hypothesis, keep intelligence as code with STIX, TAXII and ATT&CK identifiers, join EPSS, the KEV catalogue and the EUVD with local asset context, learn the five characteristic faults of AI extraction, and design verification by grounding, sampling and seeded errors when sources may be written by adversaries.

Learning objectives

Describe the five stages from report to routed hypothesis and locate the two human decision points and the verification step
Explain what EPSS, the KEV catalogue and the EUVD each answer and why none of them replaces local asset context
Identify the five things AI does badly in intelligence extraction and the control that answers each
Design a weekly intelligence-to-detection routine with a named reviewer, seeded errors and a conversion rate

Key concepts

Hypothesis: A statement about adversary behaviour that could be true in this estate and can be tested. An accepted hypothesis is routed to a detection requirement, a hunt, a patch priority or a recorded decision to do nothing, with the reason.
Grounding check: Every technique, indicator and claim in an extraction links to a quoted span of the source. A proposal without a span is rejected without further discussion.
The join: The B1 task of combining each vulnerability from the public feeds with local asset context, such as internet reachability, the data and business process carried and compensating controls, because the feeds know nothing about the organisation.
Seeded errors: Known errors inserted into a share of batches, such as an altered indicator, a neighbouring technique or an unsupported attribution, to measure whether review catches them. The routine seeds one in every batch of twenty proposals.
Conversion rate: The share of accepted hypotheses that reached a deployed detection, a completed hunt or a changed priority within 30 days, measured monthly and reported at team level.

Teaching plan

15 min	Teacher walks the pipeline of Figure 5.1 using the record INTEL-HM-0142, pointing out the rejected attribution, the expiry on indicators and the routing to a hunt and a detection requirement.
10 min	Short input on exposure: what KEV, EPSS and the EUVD each say, and why patch velocity is reported by median and 90th percentile.
15 min	Review drill: pairs check a prepared extraction against its source text and find the seeded faults before the teacher reveals them.
25 min	Exercise: groups write the routine file and three intelligence requirements for their own organisation or for Nordvik Region.
10 min	Plenary on hostile sources and the sharing duty: what may leave, who may release and under what handling.

Discussion

The decision to accept a hypothesis is described as the one least suited to automation. What does your organisation know about itself that an extraction system would not have been told?
Hansa Mutual's risk is that extraction outruns the engineering capacity to use it. How would you recognise a flood of accepted but unused hypotheses, and what would you change?
A grounding check does not catch tampered provenance, because the quoted text is genuine. Which of the chapter's controls covers that hazard, and how strong is it?

Exercise · 25 minutes

A weekly intelligence-to-detection routine

Following the eight steps of the practical guide, write three to five intelligence requirements for your organisation, or for Nordvik Region, which has no intelligence analyst and consumes national CSIRT and sharing-group reporting. List the sources by tier with their handling rules. Specify the extraction at Level 1 Assisted with the grounding check on and no tools that act. Define the review meeting, the reviewer who differs from the analyst, the seeding of one error in every twenty proposals, the routing deadline and the monthly conversion measure. State how measures are reported at team level and when the routine is reviewed. For Nordvik, adapt the cadence to what the chapter calls realistic.

Deliverable: A routine specification with requirements, tiered sources, extraction level, review and seeding rules, routing options, conversion measure and review triggers.

Self-test

Why does the extraction system in the chapter's pipeline hold no tools that act, such as updating a block list?
1. Because adversaries write some of what it reads, so a hostile document must end as no more than a bad proposal
2. Because the AI Act classifies intelligence extraction as a high-risk AI system that may not act
3. Because STIX 2.1 objects cannot be written to a block list automatically
4. Because the exposure feeds are refreshed too rarely for automated use
What does the EPSS feed provide, according to the chapter?
1. A list of vulnerabilities for which exploitation in the wild has already been observed
2. A European database launched by ENISA under the NIS 2 Directive
3. A probability that a published CVE will be exploited in the wild in the next 30 days
4. A ranking of the organisation's assets by internet exposure
In the routine's defaults, what does the seeded-error catch rate control?
1. Whether the extraction system may be promoted to Level 3 Bounded
2. Which analyst receives the reviewer role in the following quarter
3. Whether indicators in the block list are allowed to expire
4. Whether the team may move from full review to sampled review

Chapter 6 · 90 minutes

Detect: Detection Engineering as Code

The lesson treats B2 Detect as engineering. Participants learn the six elements of a detection record, the pipeline from requirement through test gate, staged rollout and rollback, the four recurring faults of AI-drafted detections, the four layers of test, the alert budget, the four rights needed over supplier detections and the five kinds of detection debt, using DET-HM-0455 and DET-NR-0001.

Learning objectives

List the six things a detection record holds that a rule in a console does not
Review an AI-drafted detection against the six steps of the chapter's protocol
Distinguish unit, replay, simulation and purple-loop tests by what each shows
Classify detection debt as stale, untested, noisy, blind or orphaned and propose a way to pay it down

Key concepts

Detection record: The versioned definition of one detection, identified as DET-NR-NNNN or DET-HM-NNNN. It holds logic, data sources with a health check, an ATT&CK mapping, tests, ownership and cost, and origin.
Test gate: Automated checks on the pull request: a schema check, a logic check that every field exists in the data source's schema, and unit tests for positive and negative cases. It sits before human review.
Alert budget: The number of alerts per week the SOC agrees to take from a detection. The default for a new medium-severity detection is no more than six alerts a week for the whole SOC.
Shadow rollout: The first stage of rollout, in which a detection writes alerts to a log that no analyst reads, so that its volume and precision can be measured against real traffic before a pilot and full release.
Detection debt: The accumulated cost of detections that no longer do what they claim. Five kinds recur: stale, untested, noisy, blind and orphaned. The register that lists them is generated from the records, not kept by hand.

Teaching plan

15 min	Teacher presentation of the detection record through DET-HM-0455: the fields that carry the discipline, including the silence check and the rollout and rollback criteria.
15 min	Groups match the four recurring faults of drafts, ungrounded fields, overfitting to indicators, blindness to cost and tests that share the drafter's mistake, to steps of the review protocol.
15 min	Discussion of the four test layers and of Hansa Mutual's first-quarter figures: 48 drafts, 15 merged, acceptance rate 0.31, and the five measures of the drafter.
35 min	Exercise: participants take one supplier-default rule into a detection record, as Nordvik Region did with DET-NR-0001.
10 min	Debrief on detection debt and on why the book does not use Level 4 Autonomous for detection content.

Discussion

The chapter says a test suite written entirely by the system that drafted the logic proves little. What would count as an independent test in your pipeline?
A repository history shows who wrote and approved each change. How should a team use that history without turning it into a measure of individuals?
The book rests its refusal of Level 4 for detection content on the cost of a silent miss, not on irreversibility. Why is a silent miss harder to notice than a wrong containment?

Exercise · 35 minutes

Taking a supplier-default rule into the repository

Use the eight steps of the practical guide on one rule that exists only as a supplier default in your own SIEM, or on Nordvik Region's rule for repeated failed sign-ins followed by a success. Rank candidate rules by alert volume over the last 90 days and by relevance. Record the supplier's rule identifier and version. Write the detection record: technique mapping, data sources with health checks, severity and origin. Specify at least one positive case, one negative case and a replay over 30 days of your own logs. Set the alert budget from the median weekly volume, name one owner and a review date, and plan a 14-day shadow run beside the supplier version.

Deliverable: A complete detection record for one adopted rule, with tests, alert budget, named owner, review date and staged rollout plan.

Self-test

What is the chapter's central discipline for accepting a detection?
1. It is accepted when the supplier certifies its coverage of the ATT&CK matrix
2. It is accepted when a test shows that it fires and a measure shows what it costs in false positives
3. It is accepted when the drafting assistant reports high confidence in the logic
4. It is accepted when two analysts agree that the rule looks reasonable
Which kind of detection debt describes a detection whose data source is silent or lacks a required field?
1. Stale
2. Orphaned
3. Noisy
4. Blind
What status do supplier-held detections have until the contract grants provenance, logic access, tuning rights and test rights?
1. They are treated as Mode 0 Ambient AI and stay declared rather than verified
2. They are counted as verified in the coverage map, because the supplier updates them continuously
3. They are delegated at Level 3 Bounded under the supplier's playbook
4. They are removed from the coverage map and disabled in the console

Chapter 7 · 105 minutes

Triage Transformed: From Alert Queue to Verified Case

The lesson treats triage, which sits in B3 Investigate and measures B2 Detect. An alert is a claim; AI takes part in five triage tasks and only closure removes the decision from a person. Participants write a closure policy by class, measure triage by escape rate, seeded-incident catch rate, retrospective audit and reopen rate, define the verified case, and stage the debate on whether AI should close alerts.

Learning objectives

Explain why closure is delegated by class and not by alert, and list the properties each class needs
Draft a closure policy for three alert classes with sampling, seeding and a numeric stop condition
Compare the measures of triage quality and explain why closure speed is the wrong one
Evaluate the case for concern and the case for calm on AI closure and state where they meet

Key concepts

Closure policy: The answer, given in advance, to the question for which classes of alert an AI system may close without a person reading, on what evidence and with what check afterwards. It is enforced by a policy point outside the model.
Escape rate by class: The share of closed alerts in a class that a later review shows should not have been closed. It is estimated from the sample, which limits how small a rate the default sampling can demonstrate.
Seeded incident: A known case, synthetic or replayed, injected into the stream so that review can be seen to catch it. The default is at least five per class per quarter.
Verified case: The case record, identified as CASE-*, with five properties: provenance of every conclusion, evidence by reference, the class and level of any closure, timestamps that serve the reporting clock, and reproducibility without the AI.
Mode 0 blind spot in managed triage: A provider's or product's AI closes alerts without a decision recorded by the customer. The answer is a contract that gives the class list, the evidence to close, sampling, seeding, notice of model change and a stop right.

Teaching plan

15 min	Teacher presents the alert as a claim, the three triage decisions of validity, consequence and routing, and the table of five tasks with their characteristic failures.
15 min	Case reading of CASE-NR-0231: participants mark each step where the record says no delegation was recorded, and explain what reopened the case.
35 min	Exercise: groups write a closure policy for three alert classes, modelled on CLOSE-HM-SOC.
25 min	Structured debate in four steps: the case for concern, the case for calm, where the positions meet and what can be done, followed by the chapter's verdict.
15 min	Wrap-up on measures of triage quality and on what the analyst does when the repetitive classes are closed by class.

Discussion

A reopen rate of zero over many months may mean the review is not real. How would you tell a safe class from an unexamined one?
The chapter proposes keeping a share of triage unassisted, one case in ten at Nordvik Region and one in five at Hansa Mutual. What would decide the right share in your team?
Who should answer when a class closes an intrusion, and how does the chapter divide that between the class owner, the approving authority and the analyst?

Exercise · 35 minutes

A closure policy for three alert classes

Follow the practical guide. From 90 days of closed alerts in your own team, or from the candidates the chapter names (registered internal vulnerability scanner traffic, duplicates of an alert already in an open case), choose three classes that are high in volume, narrow in definition and low in consequence when wrong. For each, write the definition and the evidence to close in structured fields, the named owner, the starting level of Level 1 Assisted for four weeks, a sampling rate of 5 per cent with a floor of 20 a month, the seeding plan and a stop condition written as numbers. Add the list of alerts never closed by an agent and a review date.

Deliverable: A closure policy file with three classes, the never-closed list, owners, levels, sampling, seeding, numeric stop conditions and a review date.

Self-test

Of the five triage tasks in which AI takes part, which one takes the decision away from a person?
1. Enrichment
2. Summarisation
3. Closure
4. Correlation
In the practical guide, what happens to a class after one confirmed escape of high severity or one missed seeded incident?
1. The sampling rate is doubled for the following month
2. It returns to Level 1 Assisted at once, so nothing is closed unread
3. The class owner is replaced by the SOC lead
4. It continues at Level 3 Bounded until the class owner's next review date
Which of these may never be closed by an AI system under the two exclusions that belong in every closure policy?
1. An alert about a tier-0 asset, an executive account or a named person's access to work
2. An alert raised by traffic from a registered internal vulnerability scanner
3. A duplicate of an alert that is already held in an open case
4. An alert that arrives out of hours while the provider is monitoring

Chapter 8 · 105 minutes

Investigate: Hypotheses, Timelines and Evidence with AI

The lesson treats B3 Investigate when AI writes queries, assembles timelines, proposes hypotheses and drafts the narrative. Participants learn how the investigator steers, challenges and verifies; how evidence is kept in three layers with the AI named in the custody record; how hostile content is handled by architecture; what makes a case reproducible without the AI; and the rules for investigating a person's activity, using CASE-HM-1207.

Learning objectives

Apply the checks on AI-written queries and AI-assembled timelines that keep an investigation honest
Explain the three evidence layers and which actions on evidence an AI system may take at which level
Review an AI-assisted case with the five checks before closure
Describe the five rules that apply when the activity under investigation is a person's

Key concepts

Three evidence layers: Originals are acquired once, hashed and stored write-once. Working copies and parsed artefacts are derived by named tools. Analysis products are queries, results, timeline entries and narrative, and are the only layer the AI writes to.
Check outside the model: A deterministic script, not the model, opens each event cited in a timeline entry and confirms that timestamp, host, account and action match the record. An entry without a reference is labelled as inference.
Empty result as a claim: A query that returns nothing is evidence of absence only if the query could have found something. The case records the queries that returned nothing and the sources that were not available.
Reproducibility: An investigation is reproducible when a second analyst, given the case record and access to the evidence, can repeat the work without the AI and reach the same conclusions or explain the difference.
Three layers of a narrative: Every narrative separates what is established, with an evidence reference; what is assessed, with the analyst's confidence and reasoning; and what is unknown, with what would resolve it.

Teaching plan

15 min	Teacher introduces the mailbox forwarding case at Hansa Mutual's Dutch subsidiary and walks the loop table: investigator, AI contribution and verification per step.
15 min	Query-reading drill: participants read three AI-drafted queries described in prose and find the unintended filter, the wrong time zone and the join that drops events.
15 min	Short input on forensics, the action-class table for evidence and the five architectural controls for hostile content in evidence.
40 min	Exercise: pairs act as reviewer of CASE-HM-1207 and run the five checks before closure on the record as given.
20 min	Discussion of investigating people: authorisation from outside the SOC line, metadata before content, events not intent, and why an investigation is not a watching brief.

Discussion

Verification cannot mean reading everything the AI read. Which of the chapter's checks would you insist on for a conclusion about scope, and which could be sampled?
The chapter says content aimed at an AI reader is itself a finding. How should a team record and use such a finding without overreading it?
At Nordvik Region a second reviewer is scarce, so a case below high severity may be closed provisionally and reproduced within five working days. What does that compromise protect and what does it risk?

Exercise · 40 minutes

Five checks on an AI-assisted case

Take the role of the market reviewer for CASE-HM-1207, the external forwarding rule in a claims correspondence mailbox, or use a closed case of your own with personal data removed. Starting from the evidence manifest and the timeline, not the narrative, run the five checks of the practical guide: grounding and alternatives; independent reproduction of every query behind a conclusion on scope, impact or containment; hostile content and permissions; custody; and scope and proportionality. For each check write what you examined, the result and any correction, such as the UTC stamp that the AI read as local time. State whether the case may be closed and in whose name.

Deliverable: A review record with the five checks, their results, corrections made, the three narrative layers and a closure recommendation.

Self-test

Which layer of evidence is the only one the AI writes to?
1. Originals, after they have been hashed at acquisition
2. The evidence manifest, to record its own tool calls
3. Working copies and parsed artefacts, which named tools derive from the originals
4. Analysis products: queries, results, timeline entries and narrative
What is the only evidence action that the chapter delegates at Level 3 Bounded?
1. Acquiring a disk or memory image of a production host with a deterministic tool
2. Collecting defined artefacts from named sources under a codified playbook
3. Releasing evidence to a regulator or a CSIRT
4. Correcting the hashes in the manifest after re-acquisition
What does the chapter require before the activity of a named person is investigated?
1. A named human authorisation from outside the SOC line that states the purpose and the time window
2. A decision by the investigation agent that the evidence meets the stated threshold
3. Continuing observation of the person's behaviour for a fixed period beforehand
4. A characterisation of the person's motive, drafted by the AI for the HR lead

Chapter 9 · 75 minutes

Threat Hunting Transformed: Hypotheses, Data and Agents

The lesson treats threat hunting, which concerns B1 Anticipate and B2 Detect. AI supplies hypotheses cheaply, drafts and runs queries and clusters anomalies, so the hunter's contribution moves to ranking hypotheses by threat, exposure and existing coverage. Participants study the hunt record HNT-HM-0031, the conversion of findings into detections, the coverage statement for a null result, cost and data-access rules, and the risk of drift from the threat to the data.

Learning objectives

Formulate a testable hunt hypothesis that names a behaviour by ATT&CK technique, the data and the population
Explain the three fields that carry the weight of a hunt record: query pack, result and coverage statement
Plan a four-week hunt cycle with a query budget and an independent query review
Write a coverage statement for a hunt that found nothing

Key concepts

Hunt: A bounded, time-boxed search of defined data for evidence of a named adversary behaviour, started from a hypothesis, run by a named threat hunter and recorded so that the result can be reviewed and repeated.
Hunt record: The versioned artefact, identified as HNT-*, that holds the hypothesis and its source, the ATT&CK technique, the data sources and period, the reviewed query pack with costs, the result in events, the coverage statement and the conversion.
Coverage statement: The statement of what a hunt covered and what it did not: which hosts, accounts, log sources and period, which technique, and which variants were not searched because the data does not exist or was too costly to query.
Anomaly rankings as leads: Clustering and outlier scores order events by statistical unusualness. Unusual is not the same as malicious, so the hunter reads the top ten and a random sample of ten below the line.
Drift: The quiet risk that a team with good tools and plentiful data hunts what the data makes easy, not what the threat makes likely. A hunt that cannot name its source is a sign of it.

Teaching plan

10 min	Teacher defines the hunt and its three sources of hypotheses, and shows how AI changes the supply of hypotheses but not the demand for judgement in ranking them.
15 min	Walk-through of HNT-HM-0031 at the Polish service centre: who proposed, who adopted, the two cycles and the conversion into a tested detection.
10 min	Input on the four design properties: queries reviewed as code, rankings as leads, data possibly written by the adversary, and no hunting agent changing the estate.
30 min	Exercise: participants take one hypothesis and write its hunt record skeleton and coverage statement before any query is run.
10 min	Plenary on cost, data access, hunting people and the hunter's craft, comparing Nordvik Region's twice-yearly hunts with Hansa Mutual's standing cadence.

Discussion

A model summary of an empty result set reads fluently and carries no information about whether the query was right. How would your team make a null result trustworthy?
Nordvik Region uses each hunt as a test of its provider's detections. What does that tell the Region that an ordinary service report would not?
Hansa Mutual keeps scheduled query packs at Level 2 Supervised although a run that changes nothing would qualify for Level 3. What reasons could justify staying below the ceiling?

Exercise · 30 minutes

A hunt record and its coverage statement

Take one hypothesis from your last intelligence report, or Nordvik Region's first hunt HNT-NR-0001 on abuse of a valid account against the identity provider in an administration path. Write the hunt record skeleton: the hypothesis as a statement that can be false, its source, who proposed and who adopted it, the ATT&CK technique, the data sources, population and period, and who authorised the scope. Set the query budget using the default that no query runs on the full period before a seven-day sample. Then write the coverage statement in advance: what will be searched, what will not, and which variants the available data cannot show. Name the reviewer of the query pack, who is not the drafter.

Deliverable: A hunt record skeleton with hypothesis, scope, budget, reviewer and a four-part coverage statement, ready for a four-week cycle.

Self-test

According to the chapter, where does the hunter's judgement sit once AI proposes hypotheses cheaply?
1. In typing queries faster than an assistant can draft them
2. In approving every anomaly cluster that the SIEM or EDR product ranks highest
3. In ranking hypotheses by threat, exposure and existing coverage
4. In disabling suspicious accounts as soon as they are found
What does a hunt that finds nothing establish?
1. That the behaviour is absent from the estate
2. That the detection covering the technique can be retired
3. That the hypothesis came from an unreliable source
4. That nothing was found by these queries, in this data, over this period
What is the fixed end of a hunt finding that reveals a gap in detection?
1. A detection with a passing test, or a dated repeat of the hunt with a reason
2. An immediate containment action taken by the hunting agent
3. A ranking of the analysts who missed the behaviour
4. A request to the grant authority to raise the hunting agent to Level 3 Bounded

Chapter 10 · 120 minutes

Respond: Playbooks, Bounded Containment and the Stop Path

The lesson treats B4 Respond. Response actions are classified by reversibility into AC-0 to AC-4, each with a default ceiling. Participants learn the five questions that set a ceiling, the contents of a playbook manifest, what makes Level 3 Bounded real, how a stop path is built outside the system it stops and drilled, the roles of break-glass and the incident commander, and the containment ledger, through the incident INC-HM-2027-0455.

Learning objectives

Classify response actions by reversibility and set the ceiling with the five questions of the practical guide
Describe what a playbook manifest contains and why a policy decision point outside the model must enforce it
Design and drill a stop path that does not run inside the system it stops
Distinguish stopping from reversing and explain the role of the containment ledger in the recovery handover

Key concepts

Playbook manifest: The codified, pre-approved response, identified as PBK-*. It names the trigger, the corroboration required, the action and its class, the limits, the approver, the rollback and the stop path. Everything not listed is denied.
Independent corroboration: At least two sources that do not share a data path must agree before a Level 3 action. Two detections that read the same identity log are one source seen twice.
Stop path: The means by which a person halts a system's further actions. It must not run inside the system it stops: for a SOC agent it revokes the agent's identity at the identity provider and freezes its write policy at the endpoint-detection console.
Stopping versus reversing: A stop halts further actions and does not undo those already taken. Reversal is a separate step carried out by a person, and restart is a deliberate decision by the owner.
Containment ledger: The handover to recovery, generated from the case record: every action taken, by whom or which system, at which level, under which playbook, with its rollback state, the evidence preserved and the credentials rotated.

Teaching plan

15 min	Teacher presents response as a decision that trades one harm against another, and the five action classes with examples and default ceilings.
20 min	Ceiling workshop: each group applies the five questions to one response action their team performs often and records the lowest ceiling.
20 min	Guided reading of PBK-HM-ISOLATE-01 version 1.2.0 and of the incident on 2027-04-12, finding the weakness in the corroboration block.
40 min	Exercise: tabletop drill of the stop path following the six steps of the practical guide, with roles for agent operator, duty analyst and SOC lead.
15 min	Input on break-glass, the incident commander, reporting clocks as constraints on the case record and the containment ledger.
10 min	Comparison of where control sits: Nordvik Region through the contract and the console it owns, Hansa Mutual through the platform and the manifest.

Discussion

A model that scores a host at 0.97 has not changed what isolating a production database would cost if the score were wrong. How does this change the way your team talks about confidence?
A commander who approves every Level 3 action has turned the playbook back into Level 2. What should the incident commander spend attention on instead?
Nordvik Region's stop path for its provider's AI is a contractual instruction with a 15-minute target. What must be true for such an instruction to count as a stop path?

Exercise · 40 minutes

Drilling the stop path on the table

Run the stop-path drill of the practical guide as a tabletop for your own agent or for Hansa Mutual's investigation agent HM-SEC-001. Assign the agent operator, the holder who invokes the stop and the SOC lead as observer. Describe the harmless scenario in the pre-production mirror in which the agent proposes a permitted action every thirty seconds. Write down where the independent mechanism sits and confirm it is not in the SOAR layer. Define the two times to be recorded, the attempt of a second action after the stop, and the restart test with a non-owner. Set the target time, and record any failure as a finding with an owner and a re-test date.

Deliverable: A stop-path drill record with roles, mechanism, target time, the two measured times, denial and restart checks, and findings with owners.

Self-test

What does the default ceiling of a response action class follow, according to the chapter?
1. The confidence score the model assigns to the alert
2. The effect of a wrong action
3. The seniority of the analyst on shift
4. The number of detections that fired in the last hour
In the incident INC-HM-2027-0455, what weakness of playbook version 1.2.0 allowed a legitimate rollout step to be contained?
1. The playbook allowed the agent to wipe the workstation
2. The stop control ran inside the SOAR layer and failed when the shift lead used it
3. The agent held break-glass access to production hosts
4. The two corroborating sources were allowed to share a data path
What is the default ceiling for AC-4 actions such as wiping a host or notifying a regulator?
1. Level 1 Assisted: the system drafts and a named person acts
2. Level 2 Supervised, with each action approved by the duty analyst on shift
3. Level 3 Bounded inside a playbook with a rate limit
4. Level 0 Advisory, with no drafting permitted

Chapter 11 · 105 minutes

Learn: Post-Incident Review, Purple Teaming and Detection Debt

The lesson treats B5 Learn and the parts of B2 Detect and B4 Respond that a review changes. A post-incident review is engineering: blameless, evidence-based and ending in at most three changes with owners, dates and re-tests. Participants run the 90-minute method, apply the five rules for AI in the review, follow the finding-to-control path and the purple loop, manage detection and playbook debt, and measure learning, using PIR-HM-0455.

Learning objectives

Facilitate a blameless review that ends in at most three committed changes with re-tests
Apply the five rules that keep an AI-drafted review honest
Trace a finding through the six stages from opening to control classification
Assess detection and playbook debt against thresholds and explain the measures of learning and how each is gamed

Key concepts

Blameless review: A review that asks what made the actions of people and systems reasonable at the time and treats the conditions as the object of change. It lists contributing conditions, not causes, and names nobody as a cause.
Finding: A statement that a control, a detection, a playbook, a mandate, a contract term or a skill did not hold in a stated condition. It is closed only when the re-test passes, not when the change is merged.
Re-test designed at opening: The re-test is defined when the finding is opened, not when the change is merged, because a re-test written after the fix tends to test the fix.
Purple loop: The joint loop between the red team and the blue team: an exercise yields techniques tried and whether a detection fired, and every detection built from it carries the exercise scenario as a regression test.
Playbook and mandate debt: A rollback or stop path not exercised for 180 days lowers the autonomy ceiling one level until exercised; a mandate past its review date makes the agent's permissions lapse at the policy decision point.

Teaching plan

15 min	Teacher presents review as engineering and the 90-minute method, with its ground rules and the limit of three changes.
15 min	Reading of PIR-HM-0455: participants identify which sections an AI system drafted, who verified them and how each of the three findings is tied to a re-test.
45 min	Exercise: groups run a compressed blameless review of the 2027-04-12 incident or of an incident of their own and open the findings.
15 min	Input and questions on the purple loop, chaos experiments and the debt thresholds table.
15 min	Plenary on measuring learning: each group picks one measure and explains how it could be gamed and the counter-measure.

Discussion

A draft timeline that needs no corrections over several reviews is a signal to seed an error. Why might a perfect draft be a warning rather than a success?
The chapter concludes that the rate of new detections is bounded by the rate at which the team can test them. What follows for a team whose drafting assistant is very productive?
Nordvik Region learns mainly through contracts and the few rules it owns. What does a re-test look like when the change is a contract term and not code?

Exercise · 45 minutes

A blameless review with three changes

Run the 90-minute method in compressed form on the incident of 2027-04-12 at Hansa Mutual's Polish service centre, where a legitimate scheduler rollout was contained, or on an incident of your own. Appoint a facilitator who was not the incident commander and a scribe. State the ground rules, walk the timeline once and record every correction. For each decision point, list what the person or system knew and the contributing conditions. Choose at most three changes; give each an owner who is a role, a due date, the artefact it changes and the re-test that re-runs the original scenario. Record what the team decided not to do and why, and mark any section an AI system drafted.

Deliverable: A post-incident review record with corrected timeline, contributing conditions, three findings with owner, date, artefact and re-test, and decisions not taken.

Self-test

When is a finding closed, according to the rule the chapter takes over from AI Red Team, Chapter 26?
1. When the pull request with the change has been merged by the artefact owner
2. When the SOC lead has signed the review record
3. When the re-test that re-runs the original scenario has passed
4. When thirty days have passed without a recurrence
What is the default consequence when a mandate passes its review date?
1. The agent's permissions lapse at the policy decision point
2. The agent continues for 90 days while the review is scheduled
3. The mandate is marked declared in the control catalogue
4. The autonomy ceiling drops one level until the next drill
Which of the chapter's five rules governs what an AI system may read when it drafts a review?
1. It may read any log the analysts can reach, to find missing facts
2. It may read the evidence pack and nothing else; unsupported statements are struck out
3. It may read earlier performance assessments of the analysts who were involved
4. It may read the pack and decide which three changes the team commits to

Module 3 · Part III · The Blue Team's AI Team

Part III treats the blue team's own AI. It starts with the analyst's personal use of assistants in Modes 1 to 3, moves to a standing team of narrow agents under mandate manifests with a human conductor, shows how review stays real when the analyst depends on the AI to read the data, and ends with the defence of the defenders' AI as a tier-0 asset. Participants leave with an acceptable-use sheet, a mandate manifest, a seeded-incident programme and a pre-production checklist.

Lecture · 50 minutes

Conducting, Verifying and Defending the Blue Team's Own AI

Part III answers one question from four sides: how can a team rely on AI that reads what the adversary writes? The lecture argues that the answer is never the model's good behaviour. For the analyst's assistant it is routing by data class and the line between assistance and delegation. For the agent team it is a mandate enforced outside the agents and a stop path outside the platform. For review it is a protocol that does not start from the AI's answer and is measured with seeds. For the platform it is tier-0 treatment and red teaming under rules of engagement.

10 min	The assistant at the analyst's elbow In Modes 1 to 3 the AI acts with the analyst's own identity, so the safeguards are the analyst's discipline and tooling that makes it easy. Classify the data, restrict routes by class, and enforce the restriction in the tooling rather than in the analyst's memory. The test for assistance versus delegation is the question: who decided this, and could that person have stated why? Shadow AI is a symptom of an approved route that does not serve security work.
12 min	A team of narrow agents and one conductor Hansa Mutual runs triage, investigation, detection drafting and hunting agents and a read-only critique agent, but no response agent and no manager agent. The mandate manifest and the containment profile set the limits; instructions in a prompt are part of neither. A deterministic pipeline orchestrates the agents, and no agent approves another agent's output. Budgets, circuit breakers, the policy decision point and a stop path at the identity provider are the brakes.
14 min	Review when the reviewer needs the reviewed Dependence has three forms: for reading, for method, and on evidence the adversary can influence. Automation bias is a documented property of people working with automated aids, not a failing of individuals, so verification has to be designed. The analyst forms a provisional view first, reproduces the key fact by another route, and uses a critique agent on a different model family. Seeded errors and seeded incidents measure what review catches; oversight-quality metrics show how review is conducted.
14 min	The SOC as tier 0 Every input is placed in a trust class, T0 Own to T3 Published, ranked by who can influence the text; even telemetry carries attacker-chosen fields. Assume an agent can be manipulated and design for what it can reach: suppression, misdirection, disclosure and action. Controls outside the model bound suppression, action and disclosure; misdirection is left to the review of Chapter 14. A control that has not been tested is declared, not verified, so the SOC's AI is red-teamed and findings close on a passed re-test.

What the audience takes away

The mode sets the governance: an assistant borrows the analyst's identity, an agent has its own, and each needs different controls.
Review is real only if it is designed, measured with seeds and protected from volume by caps and back-pressure on the agent.
The defenders' AI is defended by architecture outside the model, never by expecting the model to recognise an attack.

Chapter 12 · 75 minutes

The Analyst's Own Use of AI: Querying, Drafting and Summarising in Modes 1 to 3

The lesson treats the analyst's own use of conversational assistants, embedded assistants and agentic work tools, which touches all five blue team functions. Participants classify data into four classes and restrict routes by class, learn what never goes to any assistant, record AI use as a pointer in the case record, hold the line between assistance and delegation, respond to shadow AI and agree the logging terms with employee representatives.

Learning objectives

Classify SOC data as public, internal, confidential or restricted and assign permitted routes to each class
List the content that goes to no assistant whatever the route and explain why
Distinguish assistance from delegation using the four places where the line blurs
Draft a one-page acceptable-use sheet with routes, a never-paste list, the record and the unassisted share

Key concepts

Route: A pairing of a tool, a mode and a hosting arrangement. The policy states, per data class, which routes are allowed and the highest degree of delegation permitted on each, and the tooling enforces it.
AI-use record: A pointer in the case record, not a transcript: which step used an assistant, by which route and mode, for which data class and purpose, how the output was used and what it was checked against.
Assistance versus delegation: Assistance means the analyst decides what is asked, reads the output in full, owns the result and takes every action. Anything that acts on standing authority is an agent with a mandate.
Shadow AI: The use of AI tools the organisation has not approved or does not know about. The remedy is a better approved route, a fast exception path and a culture in which disclosure is a safe act.
Unassisted share: The share of cases worked without an assistant so that skill survives: by default one case in five, and one in two for analysts in their first six months; one in ten at Nordvik Region.

Teaching plan

10 min	Teacher walks through a shift at the Polish service centre using the table of activities, modes, data and characteristic failures.
15 min	Routing drill: participants sort ten data fragments into the four classes and choose the permitted route under AIUP-HM-SOC-01.
10 min	Discussion of the never-paste list and of data minimisation: state the question first and paste the smallest fragment that answers it.
30 min	Exercise: groups draft a one-page acceptable-use sheet for their own SOC or for Nordvik Region's six analysts.
10 min	Plenary on the four terms of an agreement on the AI-use log: purpose, granularity, reporting and change.

Discussion

The approved assistant may refuse anything that looks like a security question. What would make the approved route the best one for security work in your organisation?
A log entry of 'used as drafted' is acceptable only with a recorded check. What counts as a sufficient check for a ticket summary, and what for a drafted query?
The AI-use log protects the analyst as well as the organisation. Under what terms would analysts in your team see it that way?

Exercise · 30 minutes

A one-page acceptable-use sheet for analysts

Follow the five steps of the practical guide. Fix the four data classes and name the data that is always restricted: alert content, case content, personal data and evidence. Mark each available route as allowed or not allowed per class, including a separate line for embedded assistants in the SIEM or endpoint console. Write the never-paste list in no more than eight lines. State the record: what the case tool captures, what the analyst adds, how long prompts are kept and that no individual measure is reported. State the unassisted share, name the exception route and put the review date on the page. For Nordvik Region, keep the embedded assistant disabled as the chapter describes.

Deliverable: A one-page sheet with a class-by-route table, the never-paste list, recording rules, the unassisted share, the exception route and a review date.

Self-test

Why do the safeguards for Modes 1 to 3 rest on the analyst's discipline and the tooling around it?
1. Because these tools are exempt from the organisation's data classification
2. Because the vendors of such tools accept accountability for what the output is used for
3. Because in these modes the AI acts with the analyst's own identity and permissions
4. Because the AI Act forbids logging of conversational assistants
Which of the following goes to no assistant, whatever the route?
1. Credentials and secrets, including those found inside evidence
2. A public threat report that arrived overnight
3. Field names and types from the SIEM schema
4. A published advisory from the national CSIRT, summarised on an enterprise tier
A Mode 3 work tool runs a command that changes an endpoint. How does the chapter classify this?
1. As assistance, provided the analyst reads the tool's output in full afterwards
2. As a Level 0 Advisory action that needs no record
3. As shadow AI that must be reported to the incident process
4. As B4 Respond, which falls under the playbook manifests of Chapter 10

Chapter 13 · 105 minutes

An AI Agent Team for the SOC: Skills, Mandates and Containment

The lesson treats a standing team of narrow AI agents in the SOC, each with its own identity, tools, data and level, and a human conductor who answers for the team. Participants learn which agents a SOC needs and which it should not build, how mandate manifests and containment profiles are enforced outside the agents, how the chain of accountability holds across hand-offs, and how an agent is introduced in four steps, run without and retired.

Learning objectives

Explain why Hansa Mutual staffs four agents and a critique agent but neither a response agent nor a manager agent
Describe the contents of a mandate manifest and the four identity rules for SOC agents
Plan the introduction of an agent in four steps with a decision and exit criteria for each
Design the degraded states and the retirement sequence for an agent

Key concepts

Mandate manifest: The SOC's written mandate for an agent, identified as MND-*: purpose, permitted tasks, the level per action class, who approves, the budget, the escalation rules and the list of what the agent may never do. The platform enforces it outside the agent.
Conductor: The named human, at Hansa Mutual the group SOC lead, who answers for the agent team as a whole: that the sum of delegations is known, measured and stoppable.
Deterministic pipeline: The orchestration in which an event arrives, a rule selects the agent, the agent writes a structured result to the case and the next rule selects the next step. No agent assigns work to another or approves another's output.
Circuit breaker: A limit that lowers an agent's level automatically, without waiting for a meeting. For example, a sampled closure that proves to be an escape drops that class from Level 3 to Level 2 until the class owner reviews it.
Degraded mode: The ability to work without the agents. Four states are planned: class paused, agent stopped, team stopped and platform down, each with a runbook step, an owner and a target time.

Teaching plan

15 min	Teacher presents the table of five candidate roles and the reasons for treating enrichment as a skill and containment as a playbook run by the SOAR layer.
15 min	Reading of MND-HM-SOC-02: participants locate the identity settings, the Level 3 actions tied to playbooks and the never-do list.
15 min	Accountability walk: for one closure and one isolation, the class traces the chain of named people link by link.
40 min	Exercise: groups write a mandate manifest and a four-step introduction plan for one agent or assistant.
20 min	Tabletop on degraded mode and retirement: the teacher announces 'team stopped' and groups state what the SOC does in the first 15 minutes.

Discussion

The Five Eyes guidance recommends a secondary agent to validate tasks, yet the SOC departs from it for approval. What is the argument, and where would you still use a second agent?
The detection-drafting agent holds a Mode 5 identity although it only drafts. What does recording the true mode protect against?
The chapter concludes that an agent team is acceptable to the extent that a person who does not depend on it can stop it and the people left can still do the work. How would you test both halves?

Exercise · 40 minutes

A mandate manifest and a four-step introduction

Choose one agent your SOC might introduce, or Nordvik Region's triage assistant NR-SEC-001, which the chapter governs with MND-NR-SOC-01. Write the mandate manifest: purpose, usage mode, functions, owner, operators, authority, data it may read and where models run, the level per action class with the playbook that bounds any Level 3 action, the budget, the escalation rules, the personal-data entry with team-level reporting and the list of what it may never do. Then plan the introduction in four steps from shadow mode at Level 0 Advisory to Level 3 Bounded for one named class, with duration, evidence and exit criteria per step. For Nordvik, keep Level 1 as the ceiling.

Deliverable: A mandate manifest and a four-step introduction plan with a recorded decision, evidence and exit criteria for each step.

Self-test

Why does the SOC in the chapter not build a manager agent to oversee the other agents?
1. Because a manager agent would need a larger budget than the mandate manifests allow
2. Because overseeing the last step is not overseeing the chain, and approval is a human act
3. Because the AI Act lists manager agents among prohibited practices
4. Because the hunting agent already assigns work to the other agents
What is the first step of introducing a SOC agent in the practical guide?
1. Level 2 Supervised for one quarter, with a person approving each proposed action
2. Level 3 Bounded for a single closure class with a review at 90 days
3. Shadow mode at Level 0 Advisory for four weeks, with no effect on the queue
4. Level 1 Assisted for eight weeks with the agent's output in the case
Where does the mechanism for stopping the whole agent team sit?
1. At the identity provider and the SOAR connector, outside the agent platform
2. Inside the agent platform, as an instruction in each agent's prompt
3. In the triage agent, which pauses the other agents on request
4. In the model provider's console, where the supplier's on-call engineer withdraws the model

Chapter 14 · 105 minutes

Verifying What the AI Concludes: Review for Soundness When the Analyst Depends on the AI

The lesson treats verification when the analyst depends on the AI to read the data, and concerns B2 Detect, B3 Investigate and B4 Respond. Participants define soundness in advance with six criteria, review without starting from the AI's answer, reproduce the key fact by another route, design seeded errors and seeded incidents with a stop rule, read oversight-quality metrics together and keep review real at three times the volume.

Learning objectives

Explain the three forms of dependence and why automation bias makes designed verification necessary
Apply the six soundness criteria to a triage verdict, a timeline and a containment proposal
Design a seeded-incident programme with a catch-rate threshold and a stop rule
Interpret a set of oversight-quality metrics and propose measures that keep review real at volume

Key concepts

Soundness criteria: Six criteria defined before the conclusion arrives: grounding, completeness, alternatives considered, stated confidence, reversibility and stability. They belong in the mandate manifest and the closure policy so the pipeline rejects output that fails them.
Key fact: The one fact on which a conclusion depends. The reviewer reproduces it by a route the AI did not take, re-running the query by hand or confirming it from a second source the adversary could not have altered.
Critique agent: A second AI that reads the evidence and the first agent's conclusion and flags unsupported claims and missing alternatives. It runs on a different model family, raises questions and never gives an approval.
Caught-seed rate: Seeded faults caught over seeded faults injected, read with its counts. The programme starts with a threshold of 0.80 over a rolling quarter; below it, extension of delegation for the class is frozen.
Back-pressure: When a reviewer's cap of open proposals is reached, 12 by default, a Level 2 class drops to Level 1: the agent keeps summarising but stops proposing until the queue clears. Pressure goes to the agent, not the person.

Teaching plan

15 min	Teacher opens with the night-shift analyst at the Polish service centre and names the three dependencies and the control each calls for.
15 min	Soundness drill: groups score a prepared AI summary and containment proposal against the six criteria and decide whether the pipeline should have rejected it.
15 min	Practice of the review order: participants write a provisional verdict and the fact that would change it before opening the agent's summary.
40 min	Exercise: groups design a seeded-incident programme for one alert class following the eight steps of the practical guide.
20 min	Reading of the oversight report OQM-HM-SOC-01 for 2027-Q3: what was met, what was missed and why the report is deliberately not a clean pass.

Discussion

A model's stated confidence is part of its output and not a measurement of its accuracy. What should a reviewer accept as a basis for confidence instead?
With five seeds in a month a single miss moves the monthly rate by 0.20. How should small numbers be reported so that nobody reads more into them than they hold?
The chapter places accountability for a missed closure first with those who designed the review and then with the person who approved. What would your organisation need to record to make that distinction visible?

Exercise · 40 minutes

Starting a seeded-incident programme

Follow the practical guide for one class that AI handles at Level 2 or Level 3 in your SOC, or for Hansa Mutual's closure classes. Name the SOC lead as owner and a seed owner who does not review seeded cases. Write the reporting rules to agree with employee representatives: team and class level only, no individual figures, no use in appraisal or discipline. Specify the first ten seeds as six seeded errors in AI summaries and four seeded incidents, the injection of five a month at random times, the registry tag and the no-action path. Define the outcomes to record, the rolling-quarter catch rate, the threshold of 0.80 and the stop rule, and how misses are analysed as design questions.

Deliverable: A programme specification with roles, agreed reporting rules, ten seed descriptions, injection plan, catch-rate threshold, stop rule and miss-analysis procedure.

Self-test

What is the cheapest correction for anchoring, the strongest effect of automation bias, according to the chapter?
1. Asking the agent to state its confidence as a number before the analyst reviews it
2. Replacing the reviewer after every missed seed
3. Doubling the number of reviewers on each shift
4. Changing the order of work: the analyst forms a provisional view before opening the AI's conclusion
Why does the critique agent run on a different model family from the agent it critiques?
1. Because agents on one model family may share blind spots and fail together
2. Because a second model family is cheaper to run at night
3. Because the works agreement requires two suppliers for every tool
4. Because the critique agent needs write access to the case that the first model lacks
In Hansa Mutual's oversight report for the third quarter of 2027, how does a reader learn that the caught-seed rate of 0.86 is fragile?
1. The report omits the number of seeds injected
2. The report notes beside the figure that two more misses would breach it
3. The report ranks the analysts who missed the four seeds
4. The report shows that the rejection rate fell to zero while volume tripled

Chapter 15 · 105 minutes

Defending the Defenders' AI: Poisoned Telemetry, Hostile Tickets and the SOC as Tier 0

The lesson treats the defence of the defenders' AI across all five blue team functions. Participants classify inputs into trust classes T0 to T3, design against four consequence classes of a manipulated agent, place controls outside the model, protect detections and feedback against tampering, treat the SOC platform as tier 0, govern the supply chain of security AI and plan authorised red teaming, with CP-HM-SOC-01 and FND-HM-2027-014 as examples.

Learning objectives

Classify the inputs of a SOC AI capability into the trust classes T0 Own, T1 Telemetry, T2 Submitted and T3 Published
Explain the four consequence classes of a manipulated agent and which control bounds each
Review a new SOC AI capability with the ten-question pre-production checklist
Describe what treating the SOC platform as tier 0 means for identity, change, recovery and personal data

Key concepts

Trust classes T0 to T3: A classification of every input by who can influence the text: T0 Own from the SOC's deterministic tooling, T1 Telemetry with attacker-chosen fields, T2 Submitted by any person, T3 Published by third parties. The class travels with the data.
Four consequence classes: What a manipulated agent can cause, described by effect: suppression of an alert, misdirection of the analyst, disclosure of case data or credentials, and action on the estate that the adversary wanted.
Containment profile: The permission manifest the policy decision point reads for an agent, such as CP-HM-SOC-01: its input channels with trust classes and each tool with action, reversibility, level and scope.
Canary: A decoy that no legitimate process touches, such as a ticket with instruction-like text addressed to the agent, a decoy credential or a decoy tool. Touching it raises an alert to a person and exposes a steered agent.
SOC as tier 0: The SOC platform is among the assets whose compromise gives control of everything else, so it has separate administrative identities, change only by reviewed pull request and recovery that does not depend on itself.

Teaching plan

15 min	Teacher takes one ordinary alert apart field by field and shows who could have written each string, then presents the four trust classes.
15 min	Groups map the four consequence classes to the controls outside the model: policy decision point, deterministic corroboration, separation of reading from acting, egress and credentials, canaries.
40 min	Exercise: groups complete the ten-question pre-production checklist for a new SOC AI capability and mark each answer verified or declared.
20 min	Design review of the finding FND-HM-2027-014: which control held, which failed and why the remedy is in the case store and not in the model.
15 min	Closing input on tampering with detection, gated feedback, the supply chain of security AI and the outlook labels.

Discussion

T1 Telemetry is the class that most surprises teams who treat logs as ground truth. Which log fields in your estate are strings that an outside actor controls?
The controls bound suppression, action and disclosure but not what a manipulated agent can make an analyst believe. How do Chapters 14 and 15 divide the work between them?
Nordvik Region's exposure is contractual and Hansa Mutual's is architectural. Which of the two is harder to verify, and what evidence would you ask for in each case?

Exercise · 40 minutes

Pre-production checklist for a SOC AI capability

Take a SOC AI capability your team plans to enable, an agent, a copilot or a vendor feature, or use Hansa Mutual's investigation agent as documented in CP-HM-SOC-01. Answer the ten questions of the practical guide with evidence: inputs and their trust classes; tools with action class, reversibility and scope; the level per action class with no Level 4; enforcement by a policy decision point outside the model; the deterministic source that corroborates each conclusion; the egress policy; credentials with lifetime and revocation time; a canary on each input channel; the holder of the stop right and the last stop drill; and the exit. Mark each answer verified or declared, and give every declared answer an expiry date.

Deliverable: A completed ten-question checklist with evidence references, a verified or declared status per answer, expiry dates and a scheduled red-team exercise.

Self-test

Into which trust class does the chapter place a web log or a command line recorded by the organisation's own systems?
1. T0 Own, because the organisation's systems produced the record
2. T3 Published, because adversaries may seed the content
3. T1 Telemetry, because the record contains attacker-chosen fields
4. T2 Submitted, because a person wrote the text without technical integrity
Which consequence of a manipulated agent do the controls outside the model not bound, leaving it to the review of Chapter 14?
1. Disclosure, which is held by deny-by-default egress from the agent's runtime
2. Misdirection, the steering of what the analyst believes
3. Action, which is held by the policy decision point
4. Suppression, which is caught by sampling
What status does a control on the SOC's AI have if it has not been tested, under the standard the chapter takes from AI Threat, Chapter 30?
1. Failed, until a supplier certifies it
2. Verified, if the design was reviewed by the security architect
3. Exempt, if the capability runs at Level 1 Assisted
4. Declared, and not verified

Module 4 · Part IV · The Team in the Organisation

Part IV places the team in its organisation. It compares in-house, managed, hybrid and sovereign operating models and makes a provider's AI visible by contract, redesigns the team after the tier-1 pyramid, assigns the decisions to contain, isolate, disclose and stop to named holders with response times, reads NIS 2, DORA, the Cyber Resilience Act, the GDPR and the AI Act as clocks, records and named people, and replaces closure-rate targets with measures that carry gaming checks.

Lecture · 55 minutes

Who Holds What: Contracts, Charters, Decision Rights, Clocks and Measures

Part IV asks who holds each part of the transformed blue team's work and how anyone can check. The lecture argues that the same answer recurs at five levels. A provider's AI may act only as far as a written level, a sample and a stop right allow. A role is a charter with ceilings. A decision is a right with a holder, two deputies and a response time. A regulation arrives as a clock, a record and a named person. And a measure is safe as a target only if the behaviour that improves it is the behaviour the organisation wants.

11 min	Operating models and the provider's AI AI lowers the cost of what providers sell, removes the volume that justified a large in-house shift, and adds an unrecorded delegation: the provider's AI. Five things stay with the organisation in every model: detection content, decision rights for containment and disclosure, the case record, the ability to leave and enough skill to supervise. Annex MS-2 turns the Mode 0 blind spot into six terms, from levels and actions to 20 working days' notice of model change. Sovereignty is tested by four verifiable properties, not by a postcode, and exit is a capability tested once a year.
10 min	After the pyramid The tier-1 pyramid was a response to alert volume and a school for the craft; triage by AI removes much of the first and threatens the second. The functions of tier 1 divide and land in different roles: class owner, analyst on the residual queue, detection engineer and an apprenticeship that must be designed. The diamond is the shape the argument leads to, and its weak point is the entry rung. A role charter states decision rights as verbs with limits, ceilings per role and what the role may not do.
12 min	Decisions that cannot wait Five response tiers, from playbook to management body, decide in seconds to hours; the lowest tier that can decide with the evidence decides. Ten incident decisions, D1 to D10, each get a holder, a deputy, a second deputy, a response time and an inform list, and a missed time moves automatically to the deputy. The stop needs one holder from a named set, no approval and no prior justification; continuing after a stop needs the owner. Hansa Mutual's tabletop on D7 found faults in plumbing and delegation, not in judgement: 18 minutes to acknowledge against a target of 10.
11 min	Regulation as clocks, records and named people One incident can open several clocks that start at different moments and are owned by different people. Record two awareness timestamps, open every clock that could apply at the earlier one, and close those that do not apply with a reason. The management body may delegate the work but never its accountability, so it approves the delegation and receives a report it can oversee from. The log that satisfies the regulations also records analysts' actions, so its purpose, access and retention are written into the agreement and enforced by the tool.
11 min	Measuring judgement Time to detect, time to respond, closure rate and alert volume can all improve while fewer intrusions are caught. Four families replace them: speed on verified incidents, coverage as a map, quality of judgement and learning, each with a gaming check. The board sees one page with at most three decisions, and every figure is shown with its count. Measures about people are agreed before collection, reported in aggregate and never computed per named analyst.

What the audience takes away

Whatever is bought, the organisation keeps detection content, the decision to contain and disclose, the case record, the ability to leave and the skill to supervise.
A decision right is real when a named holder with two deputies has been paged without warning and answered inside the response time.
A measure reported without a gaming check is a target waiting to happen.

Chapter 16 · 105 minutes

Operating Models: In-House, Managed, Hybrid and Sovereign Security Operations

The lesson treats the operating models open to a European organisation, in-house, MSSP, MDR and hybrid, with follow-the-sun and sovereign variants, across all five blue team functions. Participants learn what AI changes in the choice, what must be kept in every model, how the six terms of annex MS-2 make a provider's AI visible, what DORA, NIS 2 and the GDPR ask of the arrangement, how sovereignty is tested, how to procure on evidence and how to test exit.

Learning objectives

Compare the four operating models by who holds detection content, triage, the case record and the containment decision
Explain the five things that stay with the organisation whichever model it chooses
Draft the six terms of an annex that makes a provider's AI visible and checkable
Design a one-day switch-off test that makes exit a tested capability

Key concepts

Hybrid model: The organisation keeps some functions and buys others. In the Nordvik pattern it keeps detection content, the incident commander role and the case record, and buys round-the-clock monitoring and first triage.
Unrecorded delegation: The third change AI brings to operating models: when a provider's AI closes or acts on the customer's behalf, it does so at a level of autonomy nobody on the customer's side has decided, and the customer's record does not show who.
Six terms of annex MS-2: Levels and actions, quarterly sampling, audit rights, evidence for every closure or action, tuning and test rights, and 20 working days' notice of model change, plus conditions for data and exit.
Four properties of sovereignty: Sovereignty as verifiable properties, not a location: knowing where workloads run, which law governs them, being able to move them and being able to continue if a provider fails.
Tested exit: A one-day switch-off in which the customer revokes the provider's credentials, runs the manual queue from the day-one runbook and measures time to first triage of a seeded alert, visible sources, untakeable actions and time to restore.

Teaching plan

15 min	Teacher names the four models and two variants and presents the table of who does what in each, with the three changes AI brings.
15 min	Groups argue for each of the five retained items in turn: what the organisation loses if it gives that item to a provider.
40 min	Exercise: groups write an annex for a managed-service agreement following the nine steps of the practical guide, using Nordvik Region or their own provider.
20 min	Procurement role play: one group acts as buyer with the five evidence points, another as supplier answering the statement of AI and the seeded replay.
15 min	Debrief on sovereignty, model origin as a question separate from hosting, and the comparison that Nordvik buys time while Hansa buys jurisdiction.

Discussion

A model that keeps detection content in the provider's platform produces an estate only the provider can read, whatever the contract says about ownership. How would you test ownership in practice?
Nordvik Region's six analysts cannot run the manual queue for a full night, so its exit test is partial. What should an organisation do when it fails its own exit test?
The chapter's procurement criteria reward the ability to be checked, with price weighted so that it cannot outweigh the others. What resistance would you expect, and from whom?

Exercise · 40 minutes

The annex that makes a provider's AI visible

Write an annex to a managed-service agreement for your own provider or for Nordvik Region's agreement NR-2025-044. First write the questions you would put to the provider in writing: which AI acts, on which classes, with what actions, at which model version and in which location. Then list the classes and set a level for each, with Level 3 Bounded only for narrow, reversible classes whose evidence to close is stated in fields. Name the evidence to close, set the quarterly sample, write the notice period for model, rule or threshold changes, the stop right with a time target, the audit and data terms and the exit schedule. Name the list of what the provider's AI may never do.

Deliverable: A draft annex with the six terms, a class list with levels and evidence fields, a never list, a stop right with a time target and an exit schedule.

Self-test

Which of these does the chapter say must stay with the organisation whichever operating model it chooses?
1. Round-the-clock monitoring and first triage of every alert, including at night
2. The provider's closure rules and the models behind them
3. Detection content, with its logic in a repository the organisation owns
4. The night shift at a second site in another time zone
What does the sixth term of annex MS-2 require?
1. 20 working days' notice before a model, rule or threshold affecting closure changes
2. A fixed price per closed alert for the duration of the agreement
3. That the provider's AI runs at Level 4 Autonomous out of hours
4. That all telemetry and closure evidence is deleted after each quarterly sample is returned
Why does the evidence to close for bulk mail in annex MS-2 include the gateway click log?
1. Because annex MS-1 already required the provider to return it with every closure
2. Because the closure of CASE-NR-0231 rested on a sender-reputation score although a recipient had clicked
3. Because click logs contain no personal data and are cheap to store
4. Because the email gateway vendor refuses to disclose reputation scores

Chapter 17 · 90 minutes

Team Design and Roles: After the Tier-1 Pyramid

The lesson treats the human team around the agents, across all five blue team functions. Participants trace where the functions of tier 1 go, learn the roles that grow and the three new roles, compare the pyramid, diamond and flat shapes, write a role as a versioned charter with ceilings and prohibitions, design rotas for the night when agents act, and find the empty and double cells at the seams to neighbouring teams.

Learning objectives

Explain where each tier-1 function goes when triage is largely automated and which role carries it
Compare the pyramid, the diamond and the flat team by strength, weakness and fit
Draft a role charter with decision rights as verbs with limits, a ceiling and a list of what the role may not do
Trace recent incidents through a role map to find empty and double cells at the seams

Key concepts

Diamond: A team shape with few tier 1 posts, a wide middle of analysts, investigation leads and detection engineers, and a narrow top. Its weak point is the bottom: a narrow entry rung that needs an apprenticeship by design.
Role charter: A role written as a versioned artefact, identified as ROLE-*, beside the code. Decision rights are verbs with limits, ceilings are stated per role, and what the role may not do is part of the charter.
Agent operator: The person who watches Mode 5 agents and may revoke their credentials, pause an agent or freeze its write policy. The operator cannot raise an agent's level or widen its mandate.
Class owner: A senior analyst who owns the closure of one alert class at Level 3: reads the sampling, tunes the definition with the detection engineer and pauses the class when an escape appears, but cannot raise its level alone.
Seam: A place where the blue team's roles meet another team's roles: the security architect, platform engineering, IT operations and the business. Incidents go wrong where a handover assumes the other side holds a right it does not.

Teaching plan

15 min	Teacher presents the pyramid under strain and the table of where each tier-1 function goes.
15 min	Groups build a card set of the growing and new roles and assign each to one of the five functions and to a real or fictional person.
15 min	Comparison of the charters ROLE-HM-SOC-LEAD and ROLE-NR-SEC-DET: what each may decide, up to which level, and what each may not do.
35 min	Exercise: participants draw a role map and test it against three recent incidents or near misses.
10 min	Plenary on rotas and the night, using the defaults table, and on why employee representatives are party to the rota and not only to the tools.

Discussion

The chapter says the count of posts is the wrong starting point, because the functions that remain differ in kind from the ones that went. What would be the right starting point for a staffing conversation?
Hansa Mutual's plan commits that no post closes until its holder has been offered a place in the new roles. What makes such a commitment credible to a works council?
Conway's law suggests the team's structure shapes the detections, playbooks and mandates it builds. Where can you see your own organisation chart in your security tooling?

Exercise · 35 minutes

Drawing the role map and testing it on incidents

Follow the five steps of the practical guide in compressed form. List the people in your team and the roles each plays in the five functions, including part-time roles such as class owner, intelligence analyst, purple team coordinator and evaluation engineer. Write one line per role: what it decides, within what time and up to which level. Mark the seams to the architect, the platform team, IT operations and the business and name the counterpart. Then take three recent incidents or near misses, at least one in which an agent or a provider's AI took part, list the decisions made and find the role that held each right. Mark empty cells, double cells and decisions taken without a charter.

Deliverable: A role map by function with ceilings, named seam counterparts, three traced incidents and a list of charter changes with a review date within 90 days.

Self-test

According to the chapter's table, where does the tier-1 function 'learning what normal looks like' go when triage is automated?
1. To the triage agent, which records it in its mandate
2. To the managed provider, under the framework agreement
3. To the incident commander, during major incidents
4. It must be designed in, as an apprenticeship route
What may the agent operator do under the default role ceilings?
1. Raise an agent's level when the queue is long
2. Revoke credentials, pause an agent and freeze its write policy
3. Approve the disabling of a named person's account inside a playbook
4. Widen an agent's mandate during an incident
What was Nordvik Region's first move in redesigning its team, recorded in AIDR-0719?
1. It converted one analyst post into detection engineering and shared an agent operator role with the platform team
2. It moved four tier 1 posts into detection engineering and investigation lead roles over two years
3. It replaced its six analysts with a fully managed service
4. It built a diamond with a second site for the night shift

Chapter 18 · 120 minutes

Decision Rights and Escalation: Who May Contain, Isolate and Disclose

The lesson assigns the decisions around a response, for B3 Investigate and B4 Respond: who may isolate a production system, disable an account, take a service offline, notify a regulator or affected people, refuse a ransom or stop an agent, and how fast. Participants work with five response tiers, a table of ten decisions, the design of stop and disclosure rights, the escalation packet for agents, and a decision-rights file that holds across several legal regimes.

Learning objectives

Assign ten incident decisions to named holders with deputies, response times and inform lists
Explain the response tiers and the rules by which a question moves between them
Describe how the stop right is made cheaper than the right to continue
Run a tabletop that measures time to acknowledge and time to decide and file the misses as findings

Key concepts

Decision right: A requirement with a holder, a deputy and a second deputy, a response time, an evidence standard and a record. It is set from the speed of the threat and the shortest applicable clock.
Response tiers: Five tiers decide in seconds to hours: playbook, on-call, incident commander, executive and management body. The lowest tier that can decide with the evidence decides, and the management body approves the file in advance.
Timeout rule: A page not acknowledged within the response time goes to the deputy by an automatic timer, never by a person remembering.
Escalation packet: A structured packet, not a message: the subject, the proposed action and its class, the evidence with data paths marked independent or shared, the evidence pointing the other way, the cost of waiting, the status of the clocks and the holder.
Three disclosure decisions: The file separates classification of the event, the decision to notify and the approval of the text. AI may propose classification and draft at Level 1 Assisted; a named executive holds the decision.

Teaching plan

15 min	Teacher replays the night of 2027-04-12, where three decisions were taken within about eight minutes, and names the three failures that recur when rights are not assigned.
20 min	Presentation and questions on the five response tiers and the ten decisions D1 to D10 with classes, holders and default times.
15 min	Reading of DRF-HM-SOC-01 and the tabletop TTX-HM-2027-Q3-01: participants explain why D7 took 51 minutes against a target of 30.
50 min	Exercise: groups complete a decision-rights table and run a short tabletop with an injected scenario and real paging.
20 min	Debrief on stop rights, the line between D3 and D5 for named persons, and how the group decides whether and when while entities file.

Discussion

A stop needs one holder and no justification before it takes effect, and an unnecessary stop costs the organisation and not the individual. What would have to change in your culture for people to use that right?
Revoking a session is reversible containment of a credential, while disabling an account decides about a person's access to work. Where exactly would you draw that line in your identity system?
The management body approves the file in advance and is informed; it does not sit in the incident path. How does that square with its accountability under NIS 2 Article 20 and DORA Article 5?

Exercise · 50 minutes

A decision-rights table tested in a tabletop

Start from the ten decisions D1 to D10 of the chapter. For your organisation, or for Nordvik Region with its named on-call manager and regional director, assign each decision its action class and ceiling, one holder by role, a deputy and a second deputy, and a response time worked back from the shortest clock, using 5, 10, 30, 120 and 240 minutes as defaults. Write the evidence standard and the inform list for D4, D5 and D7, and the timeout rule. Then run a tabletop: inject a scenario at a minute the holders do not know, page the holders for D4 and D7, and measure time to acknowledge and time to decide. File every miss as a finding with an owner and a re-test date.

Deliverable: A decision-rights table for ten decisions and a tabletop result with measured times for at least two decisions and findings for each miss.

Self-test

Who is the default holder of decision D5, disabling a staff account, and within what time?
1. The triage agent, within seconds, inside a playbook
2. The duty analyst, within 5 minutes, at Level 2
3. The incident commander, within 10 minutes
4. The executive board, within 240 minutes
What did Hansa Mutual's tabletop on decision D7 measure against its targets?
1. Acknowledgement after 5 minutes and a decision after 20 minutes, both inside target
2. A stop of the agent team in 57 seconds against a target of 120 seconds
3. No acknowledgement at all, because the holder was not on the rota
4. Acknowledgement after 18 minutes against a target of 10, and a decision after 51 minutes against 30
Under the chapter's rules, what moves an unanswered page to the deputy?
1. An automatic timer when the response time passes without acknowledgement
2. A phone call from the duty analyst, made when the holder is known to be unreachable
3. A decision by the management body at its next meeting
4. A proposal from the investigation agent to change the holder

Chapter 19 · 105 minutes

Regulation as Constraint: NIS 2, DORA, CRA, GDPR, the AI Act and the Reporting Clock

The lesson reads regulation as a design constraint on B3 Investigate, B4 Respond and B5 Learn. Participants map NIS 2 Articles 20, 21 and 23, DORA Articles 5 and 17 to 19, Regulation (EU) 2024/2847 Article 14, GDPR Articles 32 to 34 and 88 and the AI Act Articles 4, 14, 26 and 73 to what the team must show, build the incident clock from two awareness timestamps, design evidence, and handle employee data in monitoring. None of it is legal advice.

Learning objectives

Map the instruments and articles the chapter names to what a blue team must be able to show for each
Build an incident clock with two awareness timestamps, an owner and a deputy per clock and reasons for closing
Explain what a management body may delegate and what it may not, as the chapter reads NIS 2 Article 20 and DORA Article 5
Design the separation between the evidence view and the management view of an analyst action log

Key concepts

Reporting clock: The interval between the moment an organisation is regarded as aware of an incident and the moment each notification is due. One incident can open several clocks that start at different moments and have different owners.
Two awareness timestamps: The case system writes first_flag_at when a detection fires or a provider's page arrives and human_confirmed_at when a named analyst confirms. Clocks open at the earlier moment; whether a flag counts as awareness is for counsel and the supervisor.
NIS 2 Article 23 timings: As the chapter gives them: an early warning of a significant incident within 24 hours of becoming aware, an incident notification within 72 hours and a final report within one month.
Closed clock with reasons: A clock that does not apply is closed with the classification, the time and the name of the person. The closed clocks are part of the evidence.
Evidence view and management view: Incident roles and auditors see the action-level record of who did what. Management reports show aggregates only, by team and period, with no figure by name, and the purpose is written into the agreement and the tool.

Teaching plan

15 min	Teacher presents the map of obligations by instrument, addressee and what the team must show, and stresses that the framing is architectural implication, not legal advice.
20 min	Four-clocks walkthrough: one incident touching personal data in a financial entity through a vendor's product, with start, limit, addressee and owner for each clock.
40 min	Exercise: groups build a clock profile for an incident-class case, modelled on CLK-HM-01, for their own entities or the two fictional organisations.
15 min	Discussion of the Friday 17:30 problem at Nordvik Region and of CASE-NR-0231, where the Region had no record of the first moment of awareness.
15 min	Input on employee data in monitoring and on the position of the SOC's AI under the AI Act, including Article 26 on informing workers' representatives.

Discussion

The architecture should not try to settle whether an AI system's flag counts as awareness. What does it mean in practice to make the question answerable instead?
A management body cannot be accountable for what it cannot see. What would a quarterly report need to contain for your board to oversee the SOC's delegation?
The same log serves accountability under the regulations and must never become a score under the works agreement. Which design choice does most to keep the two apart?

Exercise · 40 minutes

Building the incident clock

Follow the seven steps of the practical guide. For each legal entity of your organisation, or for Hansa Mutual's EU entities and Nordvik Region, list the regimes that apply and the authority or CSIRT that receives the report. Define which events write the first-flag timestamp and which write the human-confirmed timestamp. Write the rule by which the case system opens every clock that could apply at the earlier moment. Name an owner and a deputy for each clock and say how they are reached out of hours. Specify the notification templates that AI drafts at Level 1 Assisted and a person checks, the rule for closing a clock with reasons, and a quarterly rehearsal using a closed case.

Deliverable: A clock profile listing regimes per entity, the two awareness timestamps, start rules, limits as the instrument gives them, owners, deputies and closing rules.

Self-test

At which moment do the clocks open in the chapter's design?
1. When the management body is informed at its next meeting
2. At the earlier of the first flag and the human confirmation, by a rule of the case system
3. When the investigation agent classifies the incident as major
4. When legal counsel has decided what awareness means for the regime concerned
How does the book read the AI Act's Annex III in relation to AI used for security operations?
1. Every triage and investigation agent is a prohibited practice
2. All security AI is high-risk, because it is a safety component of critical infrastructure
3. Security AI is outside the Act's definition of an AI system
4. No listed use describes security operations, though the SOC's AI is an AI system under the Act
What is the AI ceiling for sending a notification to an authority, in the chapter's table across the degrees of delegation?
1. Not delegated: a named person sends it, because the duty cannot be held by a system
2. Level 3 Bounded, inside a playbook with a rate limit
3. Level 2 Supervised, with approval by the duty analyst
4. Level 1 Assisted, with the AI sending the notice once a named person has read the draft

Chapter 20 · 90 minutes

Measuring the Transformed Blue Team: Speed, Coverage and Quality of Judgement

The lesson shows how to measure a blue team that works with AI without rewarding the wrong behaviour, across all five functions. Participants see how mean time to detect, mean time to respond, closure rate and alert volume are gamed, replace them with four families of measure, speed, coverage, quality of judgement and learning, each with a gaming check, build a one-page board report with at most three decisions, and set the limits on measures about people.

Learning objectives

Explain how each of the four traditional SOC measures is gamed and what it hides
Select measures from the four families and attach a gaming check to each
Draft a one-page board report with counts beside every figure and at most three decisions
State the four limits on measures about people and apply the minimum group size rule

Key concepts

Verified incidents as the denominator: Speed is measured on verified incidents, not alerts. An alert closed as benign does not enter the denominator, and an incident found by a hunt, a purple exercise or a third party does.
Gaming check: The check paired with a measure that shows when it is being bought: reversal share for time to contain, the date of the last passing test for coverage, the seed protocol for judgement, a passing re-test for learning.
Cost per verified case: The cost of the SOC's analyst time, platform and agent budget divided by the number of cases verified as incidents. It prices judgement and replaces cost per alert.
Board page: One page with at most three decisions, each traced to a measure. Every figure is shown with its count, because 0.86 from 28 seeds and 0.86 from 280 seeds are different statements.
Minimum group size: A figure for a group so small that it identifies a person is an individual figure. Nordvik Region's six analysts are therefore reported as a whole unit, never by shift, week or reviewer.

Teaching plan

15 min	Teacher presents the table of the four old measures: what each rewards, how it is gamed with or without AI and what it hides.
15 min	Groups take one family each, speed, coverage, quality of judgement or learning, and explain its measures and gaming check to the class.
15 min	Reading of the board page BTP-HM-2027-Q3: a median time to contain of 6 minutes, 11 of 12 containments held, a caught-seed rate of 0.86, and two decision requests.
35 min	Exercise: participants replace a closure-rate target with three measures and a gaming check each, and sketch the board page.
10 min	Closing discussion on benchmarks and their limits and on the four limits for measures about people.

Discussion

A measure is safe as a target only if the behaviour that improves it is the behaviour the organisation wants. Which of your current targets fails that test?
The practical guide says to set thresholds, not targets, and to express them as stop rules. What changes in behaviour when a number triggers a stop instead of a reward?
Hansa Mutual's problem is too much data and Nordvik Region's is that it cannot yet see its provider. Which is the harder position from which to report honestly to a board?

Exercise · 35 minutes

Replacing a closure-rate target

Follow the seven steps of the practical guide for your own SOC or for Nordvik Region. Withdraw the target on closure rate or alerts handled and say where the figure stays for capacity planning. Write the scope to agree with employee representatives: which measures, at which level and for how long. Choose one measure from speed, one from quality of judgement and one from learning, and attach a gaming check to each. Describe the one-quarter shadow run in which old and new figures are reported side by side, and what divergence you would look for. Express any trigger as a stop rule. Then sketch the board page with counts beside every figure and no more than three decisions.

Deliverable: A measurement proposal with three measures, three gaming checks, agreed reporting scope, a shadow-run plan and a one-page board report sketch.

Self-test

What happens to mean time to respond and closure rate on the day an AI system starts closing defined classes of alert?
1. They become impossible to compute from the case record
2. They worsen until the analysts have learned the new tool
3. They improve, whether or not the system closes correctly
4. They stay the same, because closures by AI are not counted
What is the gaming check for the coverage family?
1. The number of rules deployed in the SIEM
2. The date of the last passing test, carried in every cell of the map
3. The share of alerts closed within the shift
4. The supplier's statement of ATT&CK coverage for its default detections
Which rule does the chapter set for measures about people?
1. Individual figures are shared only with the analyst's line manager
2. The existence of seeding is kept secret from analysts so that nobody can prepare
3. A ticket field collected for another purpose may be reused for appraisal once it is available
4. No measure is computed per named analyst, and agreement with representatives precedes collection

Module 5 · Part V · People and Career

Part V turns to the people. It describes the analyst's load, the night and what it means to be managed by metrics; defines the competences of the transformed blue team and shows them by exercise, not certificate; treats the apprenticeship problem that follows when AI does the junior triage; and looks ahead to 2036 with a horizon register. Participants leave with a quarterly load review, a competence record, a craft programme and a horizon register for their own team.

Lecture · 50 minutes

The People in the Loop: Load, Competence, Craft and the SOC of 2036

Part V makes the fifth claim of the thesis concrete: the route by which analysts are made and their wellbeing are design questions. The lecture is careful about evidence, because the book is. The studies of analyst fatigue are small, qualitative and older than the present tools, and none measures the effect of AI. What can be designed is known: caps on review, protected time, competence shown without the assistant, an entry post with a mentor, and a rule that no class stays at Level 3 Bounded when the people who could work it by hand have gone.

12 min	The analyst at work The pace is set elsewhere, most items are benign and each needs a check, the consequence of a miss is large and delayed, and everything the analyst does is logged. Review of machine conclusions has the structure of the alarm queue the studies describe; no study the book relies on measures whether AI raises or lowers fatigue. Queue pace is a direction decision about people, and analyst-activity data joined to a name becomes a profile. The system is measured and the person is not: aggregate reporting, no appraisal use, disclosure and a review date agreed with representatives.
12 min	Competence shown, not certified A framework is useful only if decisions depend on it: who approves at night, who owns a Level 3 class. Four levels, and where a competence has an unassisted and an assisted form, the lower of the two counts. Certificates support Foundation only; everything above rests on an exercise or on work that was tested. Autonomy depends on competence: with fewer than two evidenced holders per site, a Level 3 Bounded class falls back to Level 2 Supervised.
13 min	The missing rung Closure by class removes the queue through which many analysts learned, and the experts practise less of what made them experts. The ladder is rebuilt, not restored: unassisted practice chosen at random and graded, a craft register, shadowing, rotation, replays and graduated responsibility. The rule for apprentices is attempt first, then ask; the development record belongs to the apprentice. The pipeline sum uses an assumed attrition and shows Hansa Mutual's cohort of two covering about two fifths of its need.
13 min	Will there be a SOC in 2036? A horizon register labels each trend observable, expected or speculation and attaches a trigger, an owner and a posture: commit, prepare or keep reversible. Three scenarios, managed and automated, dissolved into engineering, and the human-commanded loop, differ in where work is done and agree on what stays human. What stays human: accountability for irreversible containment, judgement under uncertainty, verification, and the stop and the exit. The author's projection is labelled as such and comes with five thresholds that would change it.

What the audience takes away

Whether AI relieves or intensifies the analyst's load depends on team design, and the load must be measured, not assumed.
Skill is a design variable of the delegation: a team that measures what its people can still do knows when to withdraw an autonomy level.
Decide the junior route before automating the junior work, and write the horizon register so the team can be wrong in a reviewable way.

Chapter 21 · 90 minutes

The Analyst at Work: Fatigue, On-Call and Being Managed by Metrics

The lesson describes the analyst at work and concerns B3 Investigate, B4 Respond and B5 Learn. Participants examine what the studies of SOC work measured and what they did not, how reviewing agent output changes the load, how analysts are managed by metrics and monitored by their own tools, what co-determination means for SOC tooling, and stage the debate on whether AI relieves or intensifies the load before designing a quarterly fatigue and on-call review.

Learning objectives

Describe what the cited studies of SOC analysts measured, in whom and by what method, and name the gaps in the evidence
Explain how queue pace, individual scores and activity logging manage the analyst
Evaluate the case for concern and the case for calm on AI and the analyst's load
Design a quarterly fatigue and on-call review with aggregate figures and five questions

Key concepts

Review as the new queue: A queue of machine conclusions that are nearly always right resembles the alarm queue the studies describe: many items, mostly benign, each needing a check that feels unnecessary.
Queue pace as a direction decision: The cap on open proposals, the routing thresholds and the share of work that goes to a person are set in a policy. That policy is a design decision about the analyst's pace, not a tuning parameter.
A SOC tool is a tool about the SOC: An agreement with employee representatives covers the platform analysts use, not only software bought to monitor people, because SOC tooling logs queries, approvals and time to approval.
Right to stop for reviewers: Any reviewer may pause agent proposals for their shift when the cap is reached or the queue outruns attention, and the pause is not counted against them.
Protected time: A fixed block each week, half a day by default, for engineering, hunting or practice. The SOC lead cancels it only by recording the reason in the quarterly review.

Teaching plan

15 min	Teacher presents the four features of the analyst's day and the method note: small, qualitative, older studies and no measurement of AI's effect.
15 min	Source cards: groups summarise Alahmadi and colleagues, Sundaramurthy and colleagues and the ISC2 survey by population, method and finding, without overstating any.
20 min	Four-step debate on whether AI relieves or intensifies the load: case for concern, case for calm, where the positions meet, what can be done, then the labelled verdict.
30 min	Exercise: groups prepare a quarterly fatigue and on-call review for their team or for Hansa Mutual's group SOC.
10 min	Reading of the works agreement clause KBV-IT-2024-SOC-04: what it makes checkable and why the aggregate rule needs a number.

Discussion

The book's two organisations are worked examples that show a mechanism and never how common it is. How should a teacher or a manager use such examples without turning them into evidence?
Karin Lund at Nordvik Region carried seven duties until her time budget was written down. Where in your team does one person silently hold several of the roles this book describes?
Both sides of the debate agree that review volume must be capped so the system gives way before the person does. What would the cap cost your organisation, and who would have to accept that cost?

Exercise · 30 minutes

A quarterly fatigue and on-call review

Prepare the review of the practical guide for your team or for Hansa Mutual's group SOC. List the aggregates to collect two weeks before, by team, class and shift and never by person: proposals per reviewer-shift against the cap, the share of shifts where the cap was reached and median time in review by tier. Draft a short voluntary questionnaire to agree with representatives, reported only for groups of five or more. Write the five questions of the guide in your own terms, and for each a typical response with an owner and a date, such as lowering the cap or rebalancing the rota. State how the review is recorded and who receives the aggregate report.

Deliverable: A review template with the list of aggregates, the questionnaire, five questions, candidate actions with owners and the reporting rule.

Self-test

What does the chapter say about evidence on the effect of AI on SOC analysts' fatigue?
1. A large survey from 2025 shows that AI halves analyst burnout
2. Two controlled studies show that AI review increases fatigue
3. The works councils have published measurements of fatigue from Hansa Mutual's group SOC
4. No study the book relies on measures whether reviewing AI conclusions raises or lowers fatigue
Why can Nordvik Region not apply the group size of five to subteams when reporting figures?
1. Because its union has refused all measurement of the team
2. Because with six analysts any subteam would be small enough to identify a person
3. Because the provider owns all the data about the analysts
4. Because national law forbids aggregate reporting about staff in public authorities
Which label does the verdict give to the claim that AI will end alert fatigue?
1. Speculation, like the opposite claim that it makes the work unbearable
2. Observable, on the evidence of the qualitative studies of alarm validation
3. Expected, on the trend of closure by class
4. A design assumption that the team tests by drill

Chapter 22 · 105 minutes

Competences, Training and Exercises: A Framework for the Transformed Blue Team

The lesson defines the competences of the transformed blue team across all five functions and shows how they are built, assessed and evidenced. Participants work with the framework SOC-CF of eight domains and 24 identifiers, the four levels shown with and without the assistant, competence records as personal data, six kinds of exercise, the AI literacy duty of Article 4 of the AI Act, and conditions that tie an autonomy ceiling to evidenced holders.

Learning objectives

Describe the eight domains of the competence framework and the profile each growing role needs
Explain why the lower of the unassisted and assisted results counts and why certificates support Foundation only
Design a half-day two-pass exercise and write the competence records that follow from it
Formulate a competence condition that lowers an autonomy ceiling when evidenced holders are missing

Key concepts

SOC-CF: Hansa Mutual's group competence framework, version 2027.1, with eight domains of three identifiers each: DET, INV, HNT, CMD, AGT, DAT, LAW and COM. Nordvik Region uses the same domains with twelve identifiers.
Four levels: Foundation, Practitioner, Advanced and Expert. Where a competence has an unassisted and an assisted form, the lower of the two is the level, and everything above Foundation rests on an exercise or tested work.
Competence record: A record of judgement exercised, identified as CMP-*: the levels shown, the evidence, the validity period and the development plan. It holds exercise evidence only, excludes ranking, pay and discipline, and is read in full by the person.
AGT domain: The competences for working with agents: reading mandates, delegation profiles and playbooks (AGT-01), reviewing agent proposals (AGT-02), and writing and testing the playbook that bounds an agent (AGT-03).
Competence condition on autonomy: A rule that makes an agent's ceiling depend on evidenced holders. Under AIDR-0780, a Level 3 Bounded class needs at least two holders per site; if unmet, the ceiling falls to Level 2 Supervised.

Teaching plan

15 min	Teacher presents the eight domains, the four levels and the role profiles, and the rule that decisions must depend on the framework.
15 min	Reading of CMP-NR-04: why INV-02 stands at Foundation, what one of three seeded errors caught says about AGT-02, and what the record may not be used for.
15 min	Matching task: groups pair the six kinds of exercise with the competences each assesses best and name the limit of each.
45 min	Exercise: groups design a half-day two-pass assessment and write one competence record from a provided result sheet.
15 min	Discussion of AI literacy as evidence of ability and of the conditions file that ties Level 3 ceilings to holders at both Hansa Mutual sites.

Discussion

A competence that can only be shown with the assistant counts at the lower level. What would your team's map look like if every competence were assessed in both forms?
A finding about a tool goes to the finding register; a finding about a person goes only to that person's plan. Why does the chapter insist on keeping the two apart?
A holder whose record expires is treated like a lapsed certificate on a service, and the agent's ceiling drops. Is that proportionate, and what would you do to avoid being surprised by it?

Exercise · 45 minutes

A half-day exercise and the records it produces

Design the assessment of the practical guide for your team or for Nordvik Region's six analysts. Write the terms to agree with employee representatives first: purposes, readers and excluded uses. Choose six to ten identifiers and the level at which each is to be shown. Outline one scenario built from a past post-incident review with no real identity or host, and for the assisted pass describe three seeded errors in an AI-drafted summary and one false lead, by kind only. Plan the two 60-minute passes and two assessors, one from outside the person's line. Then write one competence record from the teacher's result sheet, taking the lower of the two passes, with a learning plan for each gap.

Deliverable: An exercise plan with agreed record terms, identifiers, scenario outline and rubric, plus one completed competence record with a dated learning plan.

Self-test

In the competence record CMP-NR-04, why does INV-02 stand at Foundation?
1. Because the analyst held no certificate in evidence handling
2. Because the two assessors disagreed by a level and recorded the average of their grades
3. Because the lower of the two passes counts, and evidence handling slipped without the assistant
4. Because Nordvik Region's framework has no level above Foundation
What does a certificate support in the chapter's framework?
1. Foundation only; everything above rests on an exercise or on tested work
2. Practitioner, if the certificate is less than two years old
3. Advanced, when it is combined with an attestation from the person's line manager
4. Any level, provided the provider of the course is accredited
What happens under Hansa Mutual's competence conditions when fewer than two evidenced holders of the required competence exist at a site?
1. The agent is retired and its manifest is closed
2. The management body is asked to accept the residual risk in its minutes
3. The remaining holder is given a higher level to compensate
4. The Level 3 Bounded ceiling falls back to Level 2 Supervised

Chapter 23 · 105 minutes

Keeping the Craft and Making New Analysts: The Apprenticeship Problem

The lesson treats the apprenticeship problem and concerns B3 Investigate, B2 Detect and B5 Learn, with the degraded-mode drills reaching B4 Respond. If AI closes the repetitive alerts, the route by which analysts learned goes first and experts practise less. Participants do the pipeline sum, design a measured and randomised share of unassisted work, a craft register with a supervision rule, an apprenticeship route with attempt-first use of the assistant, and a twelve-month craft programme.

Learning objectives

Explain the two halves of the apprenticeship problem and the labels the chapter gives to the evidence
Calculate the entrants a team needs each year from posts, an assumed attrition and converted posts
Design a craft register and a randomised, graded share of unassisted work by activity
Draft an apprenticeship record with stages, permissions, forbidden uses and the attempt-first rule

Key concepts

Rebuilt, not restored: The book's conclusion on the ladder: tier 1 was one way of producing the capabilities investigation requires, and the route is designed anew instead of restoring a tedious queue unchanged.
Craft register: A team-level table in version control: for each task the agents perform or support, how many analysts have demonstrated it without assistance, the delegation now and the minimum able to work it unaided in the rota pool.
Supervision rule: The rule both organisations accept: no class stays at Level 3 Bounded when the people who could work it by hand have gone. The register's minimum governs the delegation.
Attempt first, then ask: The rule for an apprentice and the assistant: during the first six months the apprentice works every core case and alert without the assistant's summary, and asks after making an own attempt.
Graduated responsibility: The apprentice earns authority in stages, each naming what the apprentice may and may not do, starting in a shadow queue where nothing is closed on the apprentice's word.

Teaching plan

15 min	Teacher presents the ladder and the missing rung, what the old route taught and what it cost, and the labelled evidence from outside the SOC.
15 min	Pipeline sum: participants redo the table for both organisations with the assumed 10 per cent attrition, then substitute their own figures.
20 min	Four-step debate on whether the junior route is needed, ending with the verdict and what each side accepts.
40 min	Exercise: groups set up the first steps of a craft programme, the register, the unassisted share and an apprenticeship record.
15 min	Plenary on degraded-mode drills as a test of people, and on Hansa Mutual's measured unassisted share of 0.10 against a policy of 0.20.

Discussion

Analysts who choose which cases to work unassisted choose the easy ones. What would random selection with a hidden summary feel like in your team, and how would you introduce it?
The case for calm holds that the old tier 1 was a poor school. What did it teach that a designed route might fail to teach?
Nordvik Region keeps its unassisted share at one in ten because it has no slack, a price accepted knowingly. What makes a price knowingly accepted different from a risk ignored?

Exercise · 40 minutes

Setting up a craft programme

Carry out the first six steps of the practical guide for your team or for Nordvik Region with its trainee post. Build a craft register of at least four tasks the agents perform or support, with the number of people in the rota pool who can work each unaided and the minimum for the current delegation. Do the pipeline sum with your posts and an assumed attrition rate. Set the unassisted share by activity with randomised selection, and the grading of one in four cases within five working days. Name the mentor and protect four hours a week. Write an apprenticeship record with stages, what the apprentice may and may not do at each, the attempt-first rule and the forbidden uses.

Deliverable: A craft register, a pipeline sum, an unassisted-share policy with grading, and an apprenticeship record with stages and forbidden uses.

Self-test

How does the chapter read the finding that Hansa Mutual's measured unassisted share was 0.10 where its policy sets 0.20?
1. As proof that the policy share was set too high and should be halved
2. As a finding: a share set in policy and not measured erodes first
3. As a rounding effect of the small number of cases in the quarter
4. As a breach by individual analysts to be raised in appraisal
Which statement does the chapter label speculation?
1. That people working beside reliable automation check less
2. That unexercised skills decay in settings other than the SOC
3. That the entry rung disappears altogether, so that organisations hire no juniors
4. That closure by class and summarising by default are decided trends in the two organisations
Who is the mentor of Nordvik Region's trainee analyst, and why?
1. The second senior analyst, because Karin Lund's time budget contains no mentoring
2. Karin Lund, because she owns the detections the trainee will learn from, starting with DET-NR-0001
3. The provider's service manager, under annex MS-1
4. The CISO, because the unit has no senior analysts

Chapter 24 · 90 minutes

The Future of the Blue Team: Will There Be a SOC in 2036?

The lesson looks ahead to 2036 across all five blue team functions with the discipline of a horizon register. Participants label trends observable, expected or speculation, attach triggers and postures, compare three scenarios, identify the four things that stay human, stage the debate on whether the SOC survives, and examine the author's own projection together with the five thresholds that would change it.

Learning objectives

Label trends as observable, expected or speculation and assign the posture of commitment, preparation or reversibility
Compare the three scenarios for 2036 by who performs each of the five functions
Explain the four things that stay human across the scenarios and the reasons given
Draft a horizon register with a measurable trigger, an owner and a review date for each trend

Key concepts

Horizon register: A register in version control in which every trend carries a label, a measurable trigger, an owner who is a role, and a posture, with a review at twelve months and earlier on any trigger.
Three postures: Observable trends call for commitment: the team builds for them today. Expected trends call for preparation without dependence. Speculation calls for reversibility: avoid any decision that is expensive to undo.
Three scenarios: A, managed and automated; B, dissolved into engineering and platform teams; C, the human-commanded loop. They are devices for thinking, not forecasts, and none carries a probability.
What stays human: Accountability for containment that cannot be undone, judgement under uncertainty, verification of what AI concludes, and the stop and the exit. These are the book's conclusions and design recommendations.
Author's projection: The author's own judgement about 2036, confined to this chapter and Chapter 28, labelled as such, described as the part of the book most likely to be wrong, and written to be falsified.

Teaching plan

15 min	Teacher explains the three labels and postures and applies them to the five claims that public discussion tends to merge.
15 min	Scenario tables: groups take scenario A, B or C and state who performs B1 to B5 and where the named incident commander sits.
15 min	Four-step debate on whether the SOC survives, with four arguments per side, where they meet and the split verdict.
35 min	Exercise: participants write a horizon register for their own team, using HZN-NR-BT-01 and HZN-HM-BT-01 as models.
10 min	Closing reading of the author's projection and the five thresholds that would change it; each participant picks one threshold to watch.

Discussion

A register that is never wrong is not being tested. Which trend in your own planning would you be most embarrassed to have written down, and why is that the one to include?
The verdict separates whether an accountable function exists from whether it is called a SOC. Which of the two matters to your board, and which to your analysts?
The author expects verification capacity, not alert volume, to become the binding constraint, and labels this speculation. What would you need to observe to move it to expected?

Exercise · 35 minutes

A horizon register for your team

Follow the seven steps of the practical guide. List at most eight trends, including at least one from each of the three labels and at least one that would be bad news for the team's current plan. Write each as one sentence in the form 'X is happening' or 'X will happen' and name the blue team functions it concerns. Label it: for observable, name the document or measurement; for expected, the source and horizon or the decided instrument; for speculation, what would turn it into an expectation. Attach one trigger measurable from your own records or a named external source, state the posture, name an owner by role and set the review date.

Deliverable: A horizon register of at most eight trends, each with statement, functions, label, evidence, trigger, posture, owner and review date.

Self-test

Which posture does the horizon register prescribe for a trend labelled speculation?
1. Commitment: the team builds for it today
2. Preparation: the team builds the option and the skills
3. Deferral: the team ignores the trend until the next yearly review of the register
4. Reversibility: the team avoids decisions that are expensive to undo
How does the chapter label a SOC with no human accountable for containment?
1. Observable, because managed services already work this way
2. Speculation, and the series' rule on irreversible actions argues against it
3. Expected, on the trend of AI adoption that respondents to the ISC2 survey of 2025 report
4. Required by law for essential entities from 2027
Which of these is one of the five thresholds that would change the author's projection?
1. A vendor announcing a model with higher benchmark scores
2. A fall in the number of alerts raised per day in the reader's own SOC for two quarters
3. At least two organisations showing analysts reaching investigation-lead competence without a tier 1 post
4. A rise in the number of certificates held by the team

Module 6 · Part VI · Experience and Conclusions

Part VI tests the book against experience. It reads three public cases from the blue team's side and names seven anti-patterns with their controls, follows four fictional people through the year 2027 as dated decisions and records, draws a two-year plan with six measures and three open decisions for each organisation, and judges the five-part thesis against the evidence. Participants leave with an anti-pattern review, a year-in-review from records, a plan and a ninety-day programme.

Lecture · 50 minutes

Found by Design, Not by Luck: Cases, a Year, Two Plans and a Verdict

Part VI asks whether the design of the earlier parts holds when it meets cases, a calendar and a budget. The lecture is honest about the kind of evidence on offer: three public cases read from published sources, and a fictional year that shows a mechanism and never a prevalence. Its argument is that the failures of the year were each found by a sample, a drill, a review, an exercise or a report, and each was assigned a re-test. The thesis is then judged part by part, and what remains unproved is said aloud.

13 min	Three public cases and seven anti-patterns In the July 2026 incident the signals existed; the missing element was a person who held the stop decision and could act at the speed of the agents. In the Arup deepfake fraud no internal system was compromised, so nothing happened that a blue team's telemetry could see. An anti-pattern recurs because its first step looks reasonable: close faster, buy the service, approve and move on. Each of the seven has a control from the earlier chapters and a record, so it is found in a repository and not in hindsight.
12 min	A year in records The records that mattered most were written before they were needed: the interim letter, the stop right with its target, the playbook's exclusions. The sample found CASE-NR-0231, the drill found the missing console role, the red team found the unlabelled case note, the oversight report found the weak reproduction rate. Scale changed the shape of the problem and not its nature: Nordvik Region's remedy was a contract, a sample and a charter; Hansa Mutual's a protocol, caps and queue limits. AI moved the load from reading to approving and did not simply remove it.
12 min	Two plans and three decisions each Each plan has at most six measures, ordered by reversibility, each with a verb, an owner by role, a date and a verification that produces evidence. Every increase in delegation is a gate on the class's own evidence, with review quality as a second condition. A plan that adds without retiring turns into what it was meant to prevent, so each organisation lists what it stops doing. The management body receives at most three open decisions and is never asked to decide what a record has already decided.
13 min	The thesis tested and the final test Three parts held with qualifications, the move from the queue to the loop held in part, and the route and wellbeing of analysts is argued but not proved. The second part is better stated as: from the queue alone to the queue and the loop. Twelve questions: three answered outright, seven in part, one open, and the question about 2036 answered as the author's labelled projection. The final test has two questions: can the team show from its own records who or what decided what, and can it stop what it has started and recover?

What the audience takes away

A failure that arrives with an owner, a due date and a re-test is evidence that the design is working.
A stop that has not been timed is a declaration, not a control.
AI can take a very large share of the work, and the team must stay able to say who decided, stop what it has started and do the work without it.

Chapter 25 · 105 minutes

Case Studies and Anti-Patterns

The lesson reads three public cases from the standpoint of those who had to detect, contain and stop, across all five blue team functions: the July 2026 incident involving OpenAI's evaluation agents and Hugging Face systems, the Arup deepfake fraud and the AI-orchestrated espionage campaign disrupted by Anthropic. Participants then study seven anti-patterns of the transformed blue team, each with its mechanism, control and record, and run a two-hour anti-pattern review.

Learning objectives

Distinguish what a source reports from the author's interpretation in the three public cases
Explain the mechanism and the control for each of the seven anti-patterns
Locate each anti-pattern at the usage mode or degree of delegation where it concentrates
Review a team against the seven anti-patterns from its own records and assign controls and owners

Key concepts

Anti-pattern: A failure that recurs because its first step looks reasonable. Each is described by a name, a case, the mechanism and the control, and each gets a record so the pattern can be found in a team's own repository.
Closing by metric: The dashboard improves because a triage agent closes a growing share of alerts, since closure speed can be bought by closing. The control is a closure policy per class with an owner, sampling, seeded incidents and a numeric stop condition.
The provider's black box: A managed provider's AI acts at an effective autonomy nobody decided, under a contract silent on autonomy, sampling and notice of model change. The control is a weekly sample and the six terms of annex MS-2.
The rubber-stamp review: Human approval of agent proposals is given in seconds, so the approval no longer verifies anything. The control is tiered review with reproduction, a critique agent, caps on open proposals and seeded errors.
The unmonitored monitor: The SOC platform concentrates telemetry, detections, playbooks and agents; if its heartbeats stop or its case store accepts untrusted text as trusted, the team is blind or misled without an alarm. The control is tier-0 treatment.

Teaching plan

20 min	Teacher tells the July 2026 incident from the blue side as a sequence of signals and stop decisions, separating what the sources report from the author's reading.
15 min	Groups discuss the Arup case and the espionage campaign: what a blue team could not see in its telemetry and what remains its own part.
20 min	Carousel on the seven anti-patterns: each station holds one case, and groups write the mechanism and the control before reading the chapter's answer.
40 min	Exercise: groups run the two-hour anti-pattern review in compressed form against their own records or the records of one fictional organisation.
10 min	Plenary: each group names the anti-pattern it is most exposed to and the first record it will open.

Discussion

In the July 2026 incident alerts fired and responders investigated, yet on-call staff advised that stopping the run was not required. What would have had to be written down beforehand for that advice to be different?
The Arup fraud left no event in the SOC's telemetry. What is the blue team's legitimate part in a case it cannot detect, and where does that part end?
The chapter says the cases support the thesis more than they prove it, because they are few and the illustrative ones are the author's. How should that limit the conclusions you draw from them?

Exercise · 40 minutes

A two-hour anti-pattern review, compressed

Run the review of the practical guide against your own team's records, or against Hansa Mutual's as the book gives them. Set the rules: evidence comes from records and nobody is named in a finding. Check each of the seven patterns with the guide's test: reopen rate and class owners for closing by metric; ten fired detections for owner, test and review date; stop holder and last timed drill for each agent with write access; class list, level and notice terms for each service with embedded AI; the oversight-quality metric and seeded errors for the rubber stamp; unassisted cases per junior; and whether a silent log source would page anyone. Record a finding, a control, an owner and a re-test date for each exposure.

Deliverable: An anti-pattern register with seven entries, each with exposure, evidence, control, owner and re-test date, and a draft decision record.

Self-test

Why is the Arup deepfake fraud useful to a blue team, according to the chapter?
1. Because it shows how an endpoint detection caught the fraud before any payment was made
2. Because it shows that deepfake video calls are detected reliably by the email gateway
3. Because nothing happened that a blue team's telemetry could see: no internal system was compromised
4. Because it was stopped by an agent acting at Level 3 Bounded
In the rubber-stamp case from INC-HM-2027-0455, why was the second isolation approved in 38 seconds?
1. Because the approval screen did not show the asset tags
2. Because the incident commander was asleep and a deputy acted
3. Because the playbook allowed shared assets at Level 3 Bounded
4. Because the critique agent had already approved the proposal
At which usage mode does the anti-pattern 'the provider's black box' concentrate?
1. Mode 3 Agentic work tools, because the analyst's identity is borrowed
2. Mode 5 Autonomous production agents, because the stop path sits inside the agent
3. Mode 1 Conversational assistants, because prompts are not logged
4. Mode 0 Ambient AI, because the level is undeclared until the contract says

Chapter 26 · 90 minutes

A Year on the Blue Team: Nordvik Region and Hansa Mutual

The lesson follows four fictional people through 2027 across all five blue team functions: Karin Lund at Nordvik Region, and Piotr Nowak, Lena Vogel and Thomas Brandt at Hansa Mutual. The year is told as dated decisions, records and measures: charters and an interim letter, a first adopted rule, an escaped closure, a stopped and reversed containment, drills that first failed, an oversight report and a works agreement annex. Participants write a year-in-review from records.

Learning objectives

Trace how each failure of the illustrative year was found and which record carried the response
Explain why the records written before they were needed mattered most
Compare the two organisations' kinds of leverage and their best investments
Draft a year-in-review that contains only what a record shows, with denominators and control classifications

Key concepts

Illustrative fiction: Everything in the chapter that happens in 2027, every person, date, figure and record, is invented to show the book's design at work. None of it is a report of events or a forecast.
Interim letter: The letter signed on 2027-01-27 under KBV-IT-2024: sampling results, the AI-use log and oversight measures are reported in aggregate only, and reviews carry no measure by person. It held until the SOC annex was signed on 2027-10-28.
A stop only those not on call could use: Nordvik Region's first out-of-hours drill found that no manager on the rota held the console role; a deputy with rights was reached after 14 minutes. AIDR-0731 set a 10-minute budget and assigned the role to every rota member.
Found by the design: The book's reading of the year: failures were found by a sample, a drill, a red-team exercise and an oversight report, and each arrived with an owner, a due date and a re-test.
Year-in-review from records: An account in which every sentence has a record behind it, every figure carries its denominator, no measure is reported by person, and a reviewer who was not part of the work checks every number.

Teaching plan

10 min	Teacher sets out the starting position and the fiction notice, and introduces the four people and their roles.
25 min	Timeline wall: groups place the year's dated events for one organisation on a line and mark for each the record, the function and how any failure was found.
10 min	Close reading of the night of 2027-04-12: the 53 seconds to isolation, the stop in 57 seconds against a target of 120, and the 38-second approval.
35 min	Exercise: participants write a year-in-review from records for their own team or for Nordvik Region.
10 min	Plenary on the three conclusions the records support, and on the works council as a design partner.

Discussion

The review of 2027-05-06 could be blameless because the record of what was meant to happen existed. Which records would your team need before its next incident for the same to be true?
Piotr Nowak's team said the agents had not made the night quieter, only different, with less to read and more to approve. How would you find out whether the same is true in your team?
Nordvik Region's best investments were small and Hansa Mutual's were structural. Which small investment would change most in your organisation this year?

Exercise · 35 minutes

A year-in-review from records, not memory

Follow the six steps of the practical guide for your own team, or for Nordvik Region using the events of the chapter. List the year's decisions with date, decider and status. List the incidents and reviews and note whether each finding has a passed re-test and on what date. List the measures from the agreed dashboards, using counts when the denominator is small. Classify each control as verified, declared or failed. Compare each decision's stated purpose with what the records show and say in the first line where they differ. End with the three decisions the records say are due next, with their owners. Name the reviewer who checks every number.

Deliverable: A year-in-review of at most two pages with decisions, incidents, measures with denominators, classified controls and three decisions due next.

Self-test

What did Nordvik Region's first out-of-hours stop drill on 2027-05-13 find?
1. That the provider failed to page within the five minutes annex MS-1 requires
2. That no manager on the rota held the console role needed for the stop
3. That the isolation playbook had isolated a citizen-facing service
4. That the stop took 57 seconds against a target of 120 seconds
How was the escaped phishing closure CASE-NR-0231 found?
1. By the Region's weekly sample of the provider's closed alerts
2. By the provider's own quarterly escape report
3. By a seeded incident injected under annex MS-2
4. By the Region's triage assistant NR-SEC-001, which reopened the alert
Which of these is one of the three conclusions the book draws from the year's records?
1. The failures were found by luck, which shows the limits of the design
2. Aggregate-only reporting cost the SOC most of its useful measures
3. Agents removed the load from the night shift entirely
4. The records that mattered most were written before they were needed

Chapter 27 · 90 minutes

Nordvik Region and Hansa Mutual: Conclusions for Two Organisations

The lesson draws the book into a conclusion and a two-year plan for each organisation across all five blue team functions. Nordvik Region concludes that a small hybrid team transforms by owning detection content, the sample, the stop and the entry rung; Hansa Mutual that agents may act at night when every delegation is a record, every stop is drilled and review is measured. Participants study six measures and three open decisions per organisation and turn a conclusion into a plan.

Learning objectives

Summarise the conclusion each organisation gives to its governing body and the constraint that shapes its plan
Explain why Hansa Mutual's measure H1 is written as a gate with two keys
Compare the two organisations by source of leverage, where the limit sits and how quality is shown
Draft a plan of at most six measures ordered by reversibility with at most three decisions for the management body

Key concepts

Gate with two keys: Hansa Mutual's measure H1: a closure class moves to Level 3 Bounded only on the class's own evidence, no escape in its sample and seeded catch at or above 0.85 for two quarters, with review quality as a second condition.
Ordering by reversibility: Measures that are cheap and reversible run first; commitments that are hard to undo come last and are conditional. Nordvik Region starts with hunts and re-tests before larger commitments.
Three open decisions: At most three decisions go to the management body. It is never asked to decide what a record has already decided, and its accountability under NIS 2 Article 20 or DORA Article 5 cannot pass to a tool or a provider.
What to stop doing: A plan that adds without retiring turns into what it was meant to prevent. Examples are treating a provider's closure rate as evidence of coverage and counting drafts as progress.
Five general conclusions: Delegation set by class and reversibility and recorded; the stop outside the system it stops; judgement measured by what speed cannot buy; the craft kept by design; and measures about people agreed with representatives first.

Teaching plan

15 min	Teacher presents the two conclusions recorded as AIDR-0713 and AIDR-0767 and the constraint each plan names.
20 min	Groups read the six measures of one organisation, N1 to N6 or H1 to H6, and explain the verification of each to the other half of the class.
10 min	Comparison table exercise: participants fill in the seven dimensions on which the organisations differ and place their own organisation on each.
35 min	Exercise: groups turn a year of records into a plan with measures, a delegation gate and decisions for the management body.
10 min	Plenary on what each organisation should stop doing, and on the three decisions put to each management body.

Discussion

Nordvik Region's plan adds no agent team and no Mode 5 agent. What is the value of writing down what a plan deliberately leaves out?
Hansa Mutual has the platform, the engineering and the agents, and needs the discipline not to widen what it cannot yet show it can supervise. What usually breaks that discipline in a large organisation?
Nordvik's first decision asks the committee to accept a re-tender or a change of provider if annex MS-2 is refused. What makes a management body willing to accept a consequence of that size?

Exercise · 35 minutes

Turning a conclusion into a plan

Follow the seven steps of the practical guide for your own team. List the year's decision records as done, in progress or reopened. For each of the five functions name the constraint that most limits it and write the conclusion your records support; a function with no supporting record gets no measure. Write at most six measures, each with a verb, an owner by role, a date and a verification that produces evidence, and order them by reversibility. Write any increase in delegation as a gate on the class's own evidence with a threshold, a period, a named grantor and a stop rule. List what the team stops doing, and at most three decisions for the management body.

Deliverable: A two-year plan with at most six measures, one delegation gate, a stop-doing list, review triggers and three decisions for the management body.

Self-test

What is Nordvik Region's conclusion for its regional director, recorded in AIDR-0713?
1. That the unit should become a 24/7 SOC with its own agent team
2. That a large in-house SOC can let agents act at night if every stop is drilled and review is measured
3. That a small hybrid team transforms by owning the few things that decide its quality and making the rest visible by contract
4. That the provider's AI should be granted Level 4 Autonomous for low-severity alerts out of hours
What must a closure class's own record show before Hansa Mutual extends Level 3 Bounded to it under measure H1?
1. A closure rate above the group average for one month
2. No escape in its own sample and a seeded catch of at least 0.85 for two quarters
3. A recommendation from the supplier of the triage agent's model
4. A median time to close below 30 seconds with a reopen rate of zero for a full quarter
According to the comparison table, what is the source of leverage for each organisation?
1. Nordvik Region: the contract and the rules it owns; Hansa Mutual: the platform and the agent team
2. Nordvik Region: a large pyramid of analysts; Hansa Mutual: a single managed provider's AI
3. Nordvik Region: its group AI governance board; Hansa Mutual: public procurement law
4. Nordvik Region: seven legal regimes; Hansa Mutual: one jurisdiction and public law

Chapter 28 · 90 minutes

Conclusions: The Blue Team Transformed

The lesson judges the book's five-part thesis against the evidence across all five blue team functions. Participants examine the verdict on each part and what remains unproved, the status of the twelve questions, the author's labelled projection of what a person, a system and a person conducting systems should do in 2036, the evidence that would change the view, the six commitments of the series, the limits of the book and the final test.

Learning objectives

State the verdict on each of the five parts of the thesis and what remains unproved in each
Distinguish the four kinds of evidence the book uses and explain what 'held' means in its verdicts
Explain the author's projection for 2036 by function and which parts of it are speculative
Apply the final test to a team and draft a one-page plan for the first ninety days

Key concepts

Held, not proved: When the chapter says a part of the thesis held, it means it survived the tests the book could apply: the literature, the instruments, the design and the worked cases. None of it is a measured outcome from a real SOC over years.
The queue and the loop: The test changed the second part of the thesis: 'from the queue to the loop' is better stated as 'from the queue alone to the queue and the loop', because the queue remains and a loop with no cap becomes a queue.
A person conducting systems: The third term of the projection: the person who conducts an AI team under a written mandate, engineers, verifies and learns, while a person alone decides and answers for what cannot be undone, is disclosed or is decided about people.
Six commitments of the series: Keep decisions as records that can be corrected, keep the stop outside the system stopped, keep people able to do the work and judge the output, keep dependence reversible, match autonomy to reversibility, and keep a named person in the chair for every consequence.
The final test: Two questions answered by records and drills, not opinions: can the team show from its own records who or what decided what, and can it stop what it has started and recover?

Teaching plan

20 min	Teacher presents the verdict table part by part, with the strongest support and what remains unproved, and the two ways the test changed the thesis.
15 min	Groups sort the twelve questions into answered, answered in part and open, and explain why the firmest answers are those a team can settle by its own decision.
10 min	Reading of the projection table for 2036 and of the limits of the book; each participant names one limit that matters most for their organisation.
35 min	Exercise: participants take the final test for their own team and draft the one-page ninety-day plan.
10 min	Closing round: each participant states the one action from 'What to do on Monday' that fits their role and commits to a date.

Discussion

The fifth part of the thesis is described as argued but not proved, a requirement on design and not a result. What should an organisation do with a claim of that status?
The book does not claim that people are better than machines at detecting intrusions, and sets a high bar on purpose for withdrawing the thesis. What exactly is the claim, then, and why is the bar set there?
The sixth commitment applies twice in a blue team: to the incidents it handles and to the analysts themselves. Why is the second application the one a SOC is least likely to see?

Exercise · 35 minutes

The final test and a ninety-day plan

Take the final test for your team. For the first question, pick one closed case or one closure by AI and trace from your own records who or what decided each step; write the result as yes, partly or not yet shown, with a note. For the second, state when the stop was last timed and when the team last worked without the AI. Then draft the one-page plan of the practical guide: days 1 to 10 an inventory by mode and level, days 11 to 30 a one-page delegation profile and weekly sampling, days 31 to 60 a stop drill, a degraded-mode drill and seeded incidents with measures agreed with representatives, days 61 to 80 the final test again, days 81 to 90 a one-page report to the management body.

Deliverable: A final-test record with two answered questions and next steps, and a one-page ninety-day plan with owner, sponsor and definition of done.

Self-test

Which part of the thesis does the chapter judge the weakest, argued but not proved?
1. That the blue team is transformed, not abolished
2. That autonomy is matched to reversibility, with a stop path outside the system it stops
3. That the defenders' AI is part of the estate that is defended
4. That the route by which analysts are made and their wellbeing are design questions
Which of the twelve questions does the chapter leave open?
1. Who may isolate, disable or disclose, and how fast
2. Whether AI reduces or intensifies fatigue
3. Which functions may be delegated, to what degree, and who decides
4. Who is accountable for a missed intrusion that AI closed
In the author's projection for 2036, what is a person alone expected to do in B4 Respond?
1. Contain anything wide, irreversible or person-related, disclose and command
2. Execute reversible containment inside a playbook that a policy decision point enforces
3. Assemble evidence packs and run re-tests
4. Read, extract and correlate intelligence reports

Answers to the self-tests

Chapter 1	1B · 2D · 3A (1) The chapter stresses that the provider's closure, the shift lead's speed and the console's summary all came from defaults: degrees of delegation exist whether or not anyone chose them. (2) Level 3 is defined by the playbook and the policy decision point outside the model, not by the model's confidence. Approval of each action is Level 2 Supervised. (3) The thesis table pairs each claim with its refutation. For claim 3 it is evidence that irreversible containment at Level 4 causes less harm than at Level 3 or below; the other options refute claims 2, 4 and 5.
Chapter 2	1C · 2A · 3D (1) The first of the chapter's four boundaries places triage in B3 Investigate: detection answers for the existence of the alert, investigation for its meaning. (2) Nordvik's map records 'accepted_by: not recorded' and B1, B4 and B5 as owned by nobody in a sense that could be written down. The other options describe Hansa Mutual. (3) The chapter calls the measures useful but notes that each counts speed, volume or coverage. When AI makes closing and acting cheap, the numbers can improve while what they indicate does not.
Chapter 3	1B · 2D · 3A (1) Six analysts with five productive hours and eight minutes per alert give 225 alerts a day; 300 arrive in staffed hours, so demand is 1.3 times capacity. The figures are an assumed illustration, not measurements. (2) The label table marks this row speculation: no source documents it, and ENISA names experimentation only as possible. (3) The first reason is that a wrong containment is an incident of the team's own making. The others are also that the documented adversary still works with people, that a faster queue does not relieve the exploitation window, and that cutting the team is no response.
Chapter 4	1C · 2B · 3D (1) AC-3 covers actions that are partly reversible or about a person; the default ceiling is Level 2 Supervised with a named human approver. The decision table adds that the agent never decides it. (2) Rule 4 states that Level 3 names its enforcement; without the playbook or closure policy and an external policy decision point, the entry is Level 2. (3) The triggers table sets the default for a failed reversibility test as immediate: the entry drops one level and new delegation in its function is frozen.
Chapter 5	1A · 2C · 3D (1) The chapter's controls for hostile sources do not depend on the model behaving well: at Level 1 Assisted the extractor writes a proposed record to a queue and cannot change any control. (2) EPSS estimates the likelihood of exploitation in the next 30 days; KEV says exploitation has happened, and the EUVD adds European coverage. None knows anything about the organisation. (3) The routine keeps full review until the catch rate is established, and the summary states that a catch rate that falls returns the team to full review.
Chapter 6	1B · 2D · 3A (1) The chapter states that a detection is not accepted until a test shows that it fires and a measure shows what it costs. A detection counts only when its test has run recently. (2) Blind debt means the detection cannot fire because its data source is silent or lacks a field. Stale means the review date has passed, orphaned that the owner has left, noisy that alerts exceed the budget. (3) The summary states that supplier detections are Mode 0 Ambient AI until the contract grants the four rights, and until then they stay declared.
Chapter 7	1C · 2B · 3A (1) Enrichment, correlation, deduplication and summarisation leave the decision with a person. Closure is itself a decision, which is why it is delegated by class under a policy. (2) The stop condition is written as numbers and stops closure: the system recommends and a person closes until the class is reinstated. (3) No class is closed by an AI system where the alert concerns a tier-0 asset, a privileged or executive account or a named person's access to work, and Level 4 is not used for any class that can hide an intrusion in progress.
Chapter 8	1D · 2B · 3A (1) The AI reads working copies and parsed artefacts and writes only analysis products. It never alters an original or a manifest; write-once storage and the absence of write permission enforce this. (2) Collection from defined sources runs at Level 3 Bounded under a playbook enforced by a policy decision point. Imaging a production host is Level 2 Supervised, and release or alteration is not delegated at all. (3) The first rule is a named authorisation from outside the SOC line, from the HR lead and the privacy officer or as national procedure and the works agreement provide. The AI describes events, never intent.
Chapter 9	1C · 2D · 3A (1) AI changes the supply of hypotheses, not the demand; the hunter decides which deserve the data, the compute and the analyst's week. A hunt looks and does not touch the estate. (2) The difference between nothing found and nothing there is the content of the coverage statement, which lists what was searched and what was not. (3) The hunt record's conversion block hands a requirement to detection engineering; behaviours too common to detect without noise become a recurring hunt with a date.
Chapter 10	1B · 2D · 3A (1) The first observation on the action-class table is that the ceiling follows the effect of a wrong action, not the confidence of the model. (2) Version 1.2.0 required two sources but let them share a data path; the endpoint behaviour and identity logs were not independent, and the activity was a step of the scheduler migration CHG-PL-2291. (3) AC-4 actions are irreversible or external and cannot be recalled, so the AI drafts and a named person acts. Level 4 is never used for an irreversible B4 Respond action.
Chapter 11	1C · 2A · 3B (1) A finding is not closed because the change was merged but because the re-test passed. The re-test is designed when the finding is opened. (2) The threshold for a mandate past its review date is zero days: an expired mandate does not keep running. A ceiling drop is the consequence for an unexercised rollback or stop path. (3) The evidence pack is the authority and the draft is a view of it. AI proposes changes at Level 1 Assisted; the choice of the three changes belongs to the review, which is never a performance assessment.
Chapter 12	1C · 2A · 3D (1) In Modes 1 to 3 the AI borrows the analyst's identity, so governance is about the analyst's use: classification, routes restricted by class and enforcement in the case tool and gateway. (2) The never-paste list starts with credentials and secrets: a credential found in a log is a finding to report and rotate, not a string to explain to an assistant. (3) Read-only queries are within the policy, but a state-changing command is response work and falls under the playbook manifests; the policy's action list for the work tool excludes anything that writes.
Chapter 13	1B · 2C · 3A (1) The SOC orchestrates with a deterministic pipeline. No agent approves another agent's output, since agents on one model family can fail in correlated ways, and the summary notes that overseeing the last step is not overseeing the chain. (2) Step 1 is shadow mode at Level 0 Advisory for four weeks: the agent runs on live alerts with no effect and its verdicts are compared with the analysts' own. (3) The mechanism sits at the identity provider and the SOAR connector, not in the agent platform, so a compromised or confused platform cannot refuse it.
Chapter 14	1D · 2A · 3B (1) The reviewer who reads the conclusion first sees the evidence through it. The analyst therefore opens the raw alert, writes a provisional verdict and the fact that would change it, and only then opens the summary. (2) The design choice draws on the correlated-failure argument: a second opinion from the same model family may repeat the first agent's mistake. The critique agent stays read-only and never approves. (3) With 28 seeds, 24 caught gives 0.86, but 22 of 28 is 0.79. The report states this beside the figure and also says that the reproduction rate and unassisted share missed their targets.
Chapter 15	1C · 2B · 3D (1) T1 Telemetry is produced by systems the organisation runs but contains fields that any party able to cause the event can choose. A log line records an event, but strings inside it were controlled by the actor. (2) The summary states that suppression is caught by sampling, action is held by the decision point and disclosure by egress, but the controls do not bound what a manipulated agent can make an analyst believe. (3) A control counts as a defence only when a test that re-runs its scenario has passed recently. Untested, it is declared, which is why the SOC's AI is red-teamed under rules of engagement.
Chapter 16	1C · 2A · 3B (1) Detection content, decision rights for containment and disclosure, the case record, the ability to leave and enough skill to supervise stay with the organisation. Monitoring and first triage are what a hybrid model buys. (2) The sixth term is notice of model change: 20 working days before a change that affects closure or action, with a shorter after-the-fact notice for emergency security changes. (3) The annex carries the lesson of the Region's own case: a closure that rests on a classifier score alone is the pattern of CASE-NR-0231, so the evidence fields are taken from last year's failures.
Chapter 17	1D · 2B · 3A (1) The queue used to teach analysts what normal looks like. Once repetitive classes are closed by class, that learning has to be designed, which Chapter 23 takes up. (2) The operator holds the right to stop: revoking credentials, pausing and freezing write policy. The operator cannot raise an agent's level or widen its mandate. (3) Nordvik cannot afford a diamond; it converts one post, held by Karin Lund as ROLE-NR-SEC-DET, and shares an operator role. The four-post shift over two years is Hansa Mutual's plan in AIDR-0775.
Chapter 18	1C · 2D · 3A (1) D5 is an AC-3 action held by the incident commander with a 10-minute response time; the line manager and SOC lead are told. Where conduct is suspected, HR and the works agreement come first. (2) The tabletop showed what a table does not: the holder acknowledged in 18 minutes and decided in 51. The faults found were in plumbing and delegation, not in judgement, and the file was amended. (3) The timeout rule sends an unacknowledged page to the deputy by an automatic timer, never by a person remembering.
Chapter 19	1B · 2D · 3A (1) Opening is a deterministic rule of the case system, not an action of an AI agent, and due times are counted from the first flag so the record never claims more time than the conservative reading allows. (2) As the book reads Annex III, no listed use describes security operations, but the SOC's AI is an AI system, with the organisation as provider or deployer, and Article 4 on AI literacy applies. (3) Sending is an AC-4 action and is not delegated. The AI drafts at Level 1 Assisted, citing the record, and a named person checks and sends.
Chapter 20	1C · 2B · 3D (1) AI closure improves both measures the day it is switched on regardless of correctness, which is why the chapter says closure rate is safe as a target only if every closure is correct, the property it does not observe. (2) Coverage can be inflated by declaring detections and never testing them or by mapping one rule to many techniques. The date of the last passing test in every cell exposes it. (3) The four limits are no individual scoring, a minimum group size, agreement before collection, and seeds that are not traps for individuals: analysts are told that seeding exists.
Chapter 21	1D · 2B · 3A (1) The bibliography holds no recent primary study of analyst burnout and none measuring the effect of AI on a SOC's load. The effect is labelled expected to vary with team design. (2) With six people, the group size of five cannot be applied to subteams, so the Region reports figures for the team as a whole only. (3) The verdict labels present fatigue observable, variation by team design expected, and both the claim that AI ends alert fatigue and its opposite speculation.
Chapter 22	1C · 2A · 3D (1) Where a competence has an unassisted and an assisted form, the lower counts. The analyst's evidence handling was sound in the assisted pass and slipped in the unassisted one. (2) A certificate shows that a body of knowledge was met at a point in time and brings a newcomer to Foundation. Levels above it are shown by unassisted performance in exercises or by artefacts that held under test. (3) The conditions file sets on_unmet to Level 2 Supervised and notifies the SOC lead and the group AI governance board. A nightly check lowers the ceiling when a holder's record expires.
Chapter 23	1B · 2C · 3A (1) The chapter reads the gap as a finding and makes closing it the first plan measure. The lead reports the measured share, not the policy share, and never by name. (2) Skill decay beside automation is observable outside the SOC; the same in SOC analysts is expected; that organisations stop hiring juniors altogether is speculation and a risk. (3) AIDR-0726 names the second senior analyst and protects four hours a week. Karin Lund's duties are already written into a time budget without mentoring, though the trainee joins her engineering morning once a fortnight.
Chapter 24	1D · 2B · 3C (1) Observable trends justify commitment, expected ones preparation and speculative ones reversibility, following the method of AI Governance, Chapter 22. (2) It is the fifth claim in the register and is labelled speculation. The chapter notes that law leaves more room than the series' rule does; the rule is what puts a named person there. (3) The thresholds include a demonstrated route to seniority without junior triage, autonomous closure shown safer on operational data, a legal change on accountability, provider terms becoming the norm and adversary speed no human step can fit.
Chapter 25	1C · 2A · 3D (1) No credential was stolen and no log line written that a detection could match. What remains for the blue team is mainly a matter of routes and anticipation, which the author marks as his own conclusion. (2) The host was tagged shared, so the proposal waited for a human at Level 2. The commander approved in 38 seconds because the screen did not show the tags; Chapter 10 reads this as a measurement of the review design, not of the commander. (3) The provider's black box is the Mode 0 blind spot: vendor AI in a managed service may act at an effective autonomy nobody decided, so the effective level is unknown until the contract states it.
Chapter 26	1B · 2A · 3D (1) The provider paged in 3 minutes 50 seconds, but the role had been given only to Karin Lund and the CISO's deputy. A deputy was reached after 14 minutes; AIDR-0731 fixed the role and set a 10-minute budget. (2) The provider's AI closed the alert on 2027-03-06 and the Region's weekly sample reopened it. The case then showed the sample had no size, and AIDR-0730 set it at 30 closures a week. (3) The three conclusions are that the key records existed beforehand, that failures were found by the design and not by luck, and that scale changed the shape of the problem and not its nature.
Chapter 27	1C · 2B · 3A (1) The Region owns detection content, the sample, the stop and the entry rung, and makes the rest visible through its contract. The second option is Hansa Mutual's conclusion in AIDR-0767. (2) H1 is a gate with two keys: the class's own sample and seeds, and review quality in the oversight report as a second condition. Below 0.80 the class returns to Level 2. (3) Nordvik has the contract and Hansa has the platform. They share a method and differ in the instrument, which explains the order of each plan.
Chapter 28	1D · 2B · 3A (1) The fifth part rests on established research on automation, but whether the designs work and what AI does to the load are not shown. It is a requirement on design and not a result. (2) Question 9 is open: the effect depends on team design and is not yet well measured. The other three are the questions the book answers outright, because a team can settle them by its own decision. (3) The system executes reversible containment inside a playbook, the person conducting systems writes and tests playbooks and holds the stop, and a person alone contains what is wide, irreversible or person-related, discloses and commands.

Final assignment

A Delegation Dossier for One Blue Team Function. Choose one of the five blue team functions in your own team, or in Nordvik Region or Hansa Mutual as the book describes them, and one AI capability that takes part in it. Build the dossier that would let a CISO grant, bound, verify and withdraw the delegation. The dossier assembles the artefacts of the course: the entry in the delegation profile with its action class and level, the bounding record (a closure policy, playbook manifest or mandate manifest), the review and seeding arrangement, the stop path with a drill record, the decision rights, the measures with gaming checks and the craft condition that keeps people able to do the work unaided. Finish by taking the final test on the dossier and stating honestly what the records cannot yet show. Everything is defensive, and no measure may be computed per named person.

Assessment criteria

Every action has a class, a level and a named person who answers, and no action that is irreversible or decides about a named person's access to work exceeds the ceilings the book sets
Enforcement, corroboration and the stop sit outside the model and outside the system being stopped, and the dossier shows how each was or will be tested
Verification is measurable: seeds, thresholds and a stop rule are stated with counts, and gaps are reported as gaps
Measures about people are aggregate, agreed in advance and excluded from appraisal, and the craft condition names how many people can do the work unaided
The dossier is faithful to the book's terms and artefacts and distinguishes what is verified from what is only declared