All courses / AI Purple
About the course
The course follows AI Purple, Book 9 of The Transformed Architecture. It treats the purple team as the joint loop between the red team and the blue team and asks what happens when AI sits on both sides of it. Part I defines the five stages, P1 Target, P2 Emulate, P3 Observe, P4 Improve and P5 Verify, the closure rule and the independence principle. Part II works through each stage. Parts III and IV apply the loop to AI systems, to the defenders' AI and to the loop's own agents. Part V places it in the organisation: coverage, measures, roles, decision rights, regulation and suppliers. Parts VI and VII cover people, the future and a year at Nordvik Region and Hansa Mutual. A green dashboard is not evidence.
After the course the participant can
- Explain the five stages of the purple loop, the record each produces and why purple is a loop and not a third team
- Draft a priority list, a scenario record and a rules-of-engagement manifest that a policy decision point can enforce
- Classify emulated steps into the seven outcomes against a sealed expectation and raise findings that name the failed layer
- Apply the closure rule with a re-test, variants, a negative control and an evidence manifest that expires
- Design delegation profiles and mandate manifests with ceilings, budgets and a stop path outside the system stopped
- Review a chain of tester, tested and checker against the five kinds of independence and write an independence statement
- Replace a heat map with coverage records and a board page that running more scenarios cannot improve
- Assign decision rights, contract terms and staff safeguards for a loop that crosses organisational and legal boundaries
Three ways to run it
The same material in three lengths. Each row of an agenda names the lessons it draws on.
Executive briefing90 minutes
For boards, audit committees, management bodies and CISOs who must judge what their testing proves
A briefing on what a management body should ask of its testing and detection when AI is on both sides. It covers the loop and its closure rule, why coverage is a claim with an age, what independence means, who may stop an emulation and what the body itself must decide. It ends with the questions to put at the next meeting.
| 0:00 | Two nights, one technique: what a contracted run and a pipeline can each prove, and the five-part thesis Ch. 1, Ch. 3 |
| 0:15 | The loop defined: five stages, the closure rule and why a merged change is not a closed finding Ch. 4, Ch. 11 |
| 0:30 | Covered is a claim with an age: denominator, reasons and evidence age on one page Ch. 17, Ch. 18 |
| 0:45 | Independence when AI is on both sides, and the verdict on a loop closed by machines alone Ch. 15 |
| 1:00 | Decision rights, the stop, risk acceptance and what regulation places with the management body Ch. 20, Ch. 21 |
| 1:15 | Two organisations after a year, the three decisions asked of each management body, and questions for the next meeting Ch. 28, Ch. 29 |
One-day seminar1 day
For purple-team coordinators, red-team and detection leads, white-team leads and security architects
A working day that takes one finding around the loop and then tests the loop itself. The morning covers targeting, safe emulation, observation and verification with the artefacts of each stage. The afternoon covers the loop's own agents, independence, coverage and measures, and decision rights, and ends with the anti-patterns and a first-week plan. Participants leave with drafted artefacts for their own organisation.
| 09:00 | The question, the pressure on the annual rhythm and the loop defined Ch. 1, Ch. 3, Ch. 4 |
| 09:45 | P1 Target: priority techniques and the scenario record; workshop on a first priority list Ch. 5 |
| 10:45 | Rules of engagement, safety classes and the stop path; the campaign and the pipeline Ch. 6, Ch. 7, Ch. 8 |
| 11:45 | P3 Observe: a simulated purple session with a sealed expectation sheet and the seven outcomes Ch. 9 |
| 13:15 | P4 Improve and P5 Verify: routing a finding, the regression case and the evidence manifest Ch. 10, Ch. 11 |
| 14:15 | The loop's own agents, mandates and the independence statement; workshop on one coverage claim Ch. 14, Ch. 15, Ch. 16 |
| 15:15 | Coverage records, measures that mislead and a board page that activity cannot improve Ch. 17, Ch. 18 |
| 16:00 | Decision rights and a short tabletop: an exercise that becomes an incident Ch. 20 |
| 16:40 | Eight anti-patterns, the verdict and a first-week plan for each participant's loop Ch. 26, Ch. 29 |
Full course7 weeks, one module a week
For teams that run or buy the loop: red, blue, white team, coordinators, architects, procurement and governance roles
The full course follows the seven parts of the book, one module a week, with a lecture on each part and a lesson with an exercise on each of the 29 chapters. Every exercise produces an artefact of the kind the chapter describes, for the participant's own organisation or for Nordvik Region and Hansa Mutual, and the artefacts accumulate into the capstone: a loop charter with its evidence.
| Week 1 | The loop in question: the thesis, the baseline of six testing forms, the pressure and the loop defined Ch. 1, Ch. 2, Ch. 3, Ch. 4 |
| Week 2 | The stages of the loop: target, rules of engagement, emulate, emulate continuously, observe, improve and verify Ch. 5, Ch. 6, Ch. 7, Ch. 8, Ch. 9, Ch. 10, Ch. 11 |
| Week 3 | The loop meets AI systems: purple for AI systems and agents, and testing the defenders' AI Ch. 12, Ch. 13 |
| Week 4 | The loop's own AI: the agent team, independence and the tier-0 set Ch. 14, Ch. 15, Ch. 16 |
| Week 5 | The loop in the organisation: coverage, measures, operating models, decision rights, regulation and boundaries Ch. 17, Ch. 18, Ch. 19, Ch. 20, Ch. 21, Ch. 22 |
| Week 6 | People and career: incentives and wellbeing, competences and the red craft, and the future of the loop Ch. 23, Ch. 24, Ch. 25 |
| Week 7 | Experience and conclusions: anti-patterns, a year in the loop, two-year plans, the verdict and capstone presentations Ch. 26, Ch. 27, Ch. 28, Ch. 29 |
Modules and lessons
One module for each part of the book and one lesson for each chapter. A lesson has learning objectives, key concepts, a teaching plan, discussion questions, an exercise and a self-test.
Module 1 · Part I · The Loop in Question
Part I sets the question of the book and the vocabulary for the rest of the course. Participants meet the working thesis in five parts, classify the six traditional testing forms by the stage each leaves unfinished, measure the pressure on an annual rhythm with the test-to-change ratio and the decay estimate, and leave with the definition of the purple loop: five stages, their records, the closure rule, the degrees of delegation and the independence principle. Lecture: From the report to the loop: why purple is not a team
- Chapter 1Introduction: The Purple Loop with AI75 min
- Chapter 2What the Loop Did Before: Penetration Tests, Red Teams, Tabletops and Purple Sessions75 min
- Chapter 3The Pressure on the Loop: Machine-Speed Adversaries, Detection Decay and the Annual Test70 min
- Chapter 4The Purple Loop Defined: Five Stages, Evidence and the Independence Principle90 min
Module 2 · Part II · The Stages of the Loop
Part II takes the loop stage by stage. Participants build a priority list and a scenario record at P1 Target, write rules of engagement that a policy decision point can enforce, plan a human-led and AI-assisted campaign and a continuous pipeline at P2 Emulate, classify outcomes against a sealed expectation at P3 Observe, turn a finding into a reviewed change at P4 Improve, and close it at P5 Verify with a regression case and an evidence manifest that expires. Lecture: One finding through five stages: the craft of the purple loop
- Chapter 5Target: Threat-Informed Scenarios, Risk and Priority Techniques90 min
- Chapter 6Rules of Engagement and Safe Emulation: Scope, Blast Radius and the Stop Path90 min
- Chapter 7Emulate: Adversary Emulation Plans, Human-Led and AI-Assisted75 min
- Chapter 8Emulate Continuously: Breach-and-Attack Simulation, Atomic Tests and Automated Red Teaming90 min
- Chapter 9Observe: Telemetry, Detection and Response Compared with Expectation90 min
- Chapter 10Improve: From Finding to Change in Detections, Controls, Playbooks and Mandates90 min
- Chapter 11Verify: Re-test, Regression and Evidence90 min
Module 3 · Part III · The Loop Meets AI Systems
Part III turns the loop on AI itself. Participants apply all five stages to the organisation's own AI systems and agents, choosing scenarios by ATLAS technique against four classes of target and building detections from the agent's manifest, and then to the defenders' AI: SOC agents, playbooks, the stop path and a provider's AI, tested with seeded incidents, benign twins and an injected-test clause in the contract. They leave able to write both artefacts. Lecture: When the target and the defender are both AI systems
Module 4 · Part IV · The Loop's Own AI
Part IV treats the AI that the loop itself uses. Participants design a team of narrow agents with mandate manifests, permission ceilings, budgets and a drilled stop; apply the independence principle where AI sits on both sides of a check, with held-out scenarios, seeded gaps and reproduction by a person; and protect the findings register, the scenario library and the emulation agents as tier-0 assets. They leave with a mandate manifest, an independence statement and a classification policy. Lecture: Can machines close the loop? Mandates, independence and the tier-0 set
Module 5 · Part V · The Loop in the Organisation
Part V puts the loop into the organisation. Participants replace a technique heat map with coverage records that carry age and expiry, design a board page that activity cannot improve, choose an operating model per stage with role charters and exit criteria, assign ten decision rights and test them in a tabletop, map legal obligations to controls and evidence, and write the consent, notice, sharing and disclosure protocols for a loop that crosses organisational boundaries. Lecture: Covered, measured, decided: the loop as an organisational claim
- Chapter 17Coverage as a Claim: Technique Maps, Evidence Age and Detection Decay90 min
- Chapter 18Measuring the Loop: Cycle Time, Yield, Re-test Pass Rate and the Metrics That Mislead90 min
- Chapter 19Operating Models and Team Design: In-House, Contracted, Hybrid and Sovereign Loops90 min
- Chapter 20Decision Rights, Authorisation and the White Team105 min
- Chapter 21Regulation as Constraint: DORA, TIBER-EU, NIS 2, the AI Act, the GDPR and Employee Rights90 min
- Chapter 22Across Boundaries: Suppliers, Managed Providers, Sector Exercises and Authorities90 min
Module 6 · Part VI · People and Career
Part VI turns to the people of the loop. Participants examine what red and blue are rewarded for and design a shared target and a blameless purple session, protect staff who are exposed to exercises, build a competence framework and an apprenticeship route that survives the automation of routine emulation, and keep a horizon register on whether red and blue will be separate teams in 2036, with every trend labelled observable, expected or speculation. Lecture: Two professions, one loop: incentives, craft and the next ten years
Module 7 · Part VII · Experience and Conclusions
Part VII tests the design against experience. Participants recognise eight anti-patterns of the loop from public cases, composites and illustrative records, follow Nordvik Region and Hansa Mutual through a year with a failure and a recovery at each, turn a year of records into a two-year plan with at most six measures and three decisions, and weigh the author's verdict on the five-part thesis, the two operating rules and the twelve questions. Lecture: What a year in the loop proves, and what it does not
Final assignment
Capstone
A loop charter with evidence for one service
Design the purple loop for one service of your own organisation, or for the benefits-triage service of Nordvik Region or the claims estate of Hansa Mutual, and carry one finding through all five stages on paper. The work is defensive and authorised by construction: adversary behaviour appears only by ATT&CK or ATLAS identifier, every emulation is scoped by written rules of engagement against the organisation's own or the fictional organisations' systems, and every finding ends in a defensive improvement. The result is a package a CISO could sign and an auditor could check: who targets, who emulates under which rules, how outcomes are observed, how a finding becomes a change, how it is verified, how independence is shown, and what is reported as covered and as not tested.
Steps
- Build a priority list of 20 to 40 techniques for the service and write three scenario records, one of them held out and human-authored.
- Write the rules-of-engagement manifest with safety classes, exclusions, third-party consent, stop conditions and named stop holders, and a delegation profile with ceilings per stage.
- Take one scenario through a paper purple session: sealed expectation sheet, classified outcomes and one finding naming the failed layer.
- Write the finding-to-change decision, the regression case with variants and a negative control, and the fields of the evidence manifest with its expiry.
- Write an independence statement for the resulting coverage claim and a coverage page with denominator, reasons and evidence age.
- Add a decision-rights file for the ten decisions and a one-page board report with at most three decisions.
Deliverables
- A loop charter with priority list, scenario records, rules of engagement and delegation profile
- A finding file: session record, finding, change decision, regression case and evidence manifest outline
- An independence statement and a coverage page with ages and honest not tested lines
- A decision-rights file and a one-page board report with at most three decisions
Assessment criteria
- Every stage has a record, an owner and a date, and the five stages are named exactly
- The finding is closed only by a re-test with a variant, attached evidence and a named signer who did not author the fix
- Emulation is defensive only: identifiers and parameters, signed scope, a stop outside the system stopped and nothing irreversible delegated
- Coverage is stated with what was tested, when and with what result, and independence is declared across the five kinds
- No measure or record ranks a named person, and staff safeguards are stated where an exercise involves people