AI Purple: teacher's guide

All courses / AI Purple / Teacher's guide

How to use this guide

The guide holds everything a teacher needs to run the course on AI Purple: the lecture of each module with a timed outline, the teaching plan of every lesson, the discussion questions, the exercises and the answers to the self-tests. The agendas of the three formats are on the course page; the slides are in the deck of the book.

Executive briefing (90 minutes): A briefing on what a management body should ask of its testing and detection when AI is on both sides. It covers the loop and its closure rule, why coverage is a claim with an age, what independence means, who may stop an emulation and what the body itself must decide. It ends with the questions to put at the next meeting.
One-day seminar (1 day): A working day that takes one finding around the loop and then tests the loop itself. The morning covers targeting, safe emulation, observation and verification with the artefacts of each stage. The afternoon covers the loop's own agents, independence, coverage and measures, and decision rights, and ends with the anti-patterns and a first-week plan. Participants leave with drafted artefacts for their own organisation.
Full course (7 weeks, one module a week): The full course follows the seven parts of the book, one module a week, with a lecture on each part and a lesson with an exercise on each of the 29 chapters. Every exercise produces an artefact of the kind the chapter describes, for the participant's own organisation or for Nordvik Region and Hansa Mutual, and the artefacts accumulate into the capstone: a loop charter with its evidence.

Keynote on the whole book · 45 minutes

The green dashboard problem: verifying defence when AI sits on both sides

For security leaders, practitioners on the red and blue sides, architects, auditors and supervisors

An emulation side that can vary and repeat adversary behaviour, and a detection side whose triage and drafting are done by agents, can close a loop between themselves that only agrees with itself. The keynote sets out the book's answer: purple is a loop of five stages held by named roles, a finding is closed only on a passed re-test with a variant, coverage is a claim with an age, and a check counts only where tester and tested can fail in different ways. Two fictional organisations, one that buys the loop and one that runs it, show what the design looks like after a year.

6 min	Two nights, one technique The same discovery technique, run by a contracted tester at Nordvik Region and by a pipeline at Hansa Mutual. Novelty with a dated, narrow result against repetition at the pace of change. The question for both: what can be proved later, and who checked it.
7 min	Why the annual rhythm no longer holds Six testing forms, each leaving a stage unfinished; the report was the end of the loop in practice. A shrinking exploitation window, an estate that changes fortnightly or daily, and detections that decay between tests. AI makes repetition, variation and drafting cheaper, not novelty, judgement, independence or safety.
8 min	The loop and its closure rule P1 Target, P2 Emulate, P3 Observe, P4 Improve and P5 Verify, each defined by a record. Closed means a passed re-test with a variant, attached evidence, a named signer and a date. Emulation runs inside a signed manifest enforced outside the agent, with a stop held by named people.
9 min	Independence Shared model family, data, authorship, vendor or time makes errors correlate and coverage look better than it is. Held-out scenarios, seeded gaps and reproduction by a person show that a check can fail. Hansa Mutual's planner and drafter shared a family; a held-out re-test moved two verified cells to failed. Machines alone can show that the known still works, not that coverage is real.
8 min	Coverage as a claim, and the people who make it Report the denominator, the reasons and the age: two of nine at Nordvik Region, 27 of 34 at Hansa Mutual. Measures that running more scenarios cannot improve, and never a measure of a named person. A protected share of human-led work and a designed route to the red craft.
7 min	The verdict and Monday No part of the thesis earned a plain held; six of twelve questions stay open. A bought loop is worth the terms on which its evidence can be inspected; a run loop is as good as its independence and its stop. One step for Monday: ask of one closed finding its re-test date, its variants and its signer.

What the audience takes away

Purple is the joint loop between the red team and the blue team, and its unit of work is the verified finding.
Coverage is a claim with a technique, an environment, a result, a date and an expiry; untested is not covered.
A check is evidence only where the side that tests and the side that is tested can fail in different ways, and a person can reproduce the result.

Module 1 · Part I · The Loop in Question

Part I sets the question of the book and the vocabulary for the rest of the course. Participants meet the working thesis in five parts, classify the six traditional testing forms by the stage each leaves unfinished, measure the pressure on an annual rhythm with the test-to-change ratio and the decay estimate, and leave with the definition of the purple loop: five stages, their records, the closure rule, the degrees of delegation and the independence principle.

Lecture · 45 minutes

From the report to the loop: why purple is not a team

The lecture carries the argument of Part I in one line: a test that ends in a report proves less than its name suggests, and the pressure on that rhythm is now measurable. It starts with two Thursday-night runs of one technique at Nordvik Region and Hansa Mutual, shows where the six traditional testing forms stopped, sets the shortening exploitation window and detection decay against the annual calendar, and ends with the loop the book defines: five stages named by their records, a closure rule with five states, ceilings on delegation and a principle of independence for the case where AI is on both sides of a check.

8 min	Two nights, one technique T1087.002 run by a contracted tester in Nordvik Region's test tenant and by an emulation runner from Hansa Mutual's library of 86 scenarios. The contracted run supplies novelty and a dated, narrow result; the pipeline supplies repetition at the pace of change. What matters in both is what the organisation can later prove, and who checked it.
9 min	Where the old forms stopped Six forms, each answering a different question, each leaving one stage unfinished in the common case. The report was the end of the loop in practice although the guidance had long advised retesting. Findings stalled because closure had no owner and no test; this is the book's own conclusion.
9 min	The pressure, measured Time-to-exploit reported as 63 days, then 32, then 5, against a test bought once a year. The test-to-change ratio: about 26 for Nordvik Region's benefits-triage service between two annual tests. Detection decay reported in three states, current, at-risk and expired, and never as one.
11 min	The loop defined P1 Target, P2 Emulate, P3 Observe, P4 Improve and P5 Verify, each defined by a record and not by a meeting. Closed and verified is the only closed state; implemented but unverified and risk accepted are reported separately. Ceilings per stage and action class, with Level 4 Autonomous never used for the four excluded classes. Closure is always a named person's signature; the runner proposes and never closes.
8 min	Independence and what the loop is not A check counts only if the side that tests and the side that is tested can fail in different ways. Five kinds of separation, one incentive rule between roles and three proofs. The loop is not a team, not an event and not a dashboard.

What the audience takes away

The unit of work is the verified finding, not the report, the session or the passing run.
An annual rhythm cannot follow an estate that changes fortnightly or daily; the test-to-change ratio shows by how much.
Purple is the joint loop between the red team and the blue team, held by named roles, and never a third team.

Chapter 1 · 75 minutes

Introduction: The Purple Loop with AI

The lesson states the book's question: when AI sits on both sides of the table, does the loop between the red team and the blue team still show whether an attack would have been seen and stopped? Participants work through the five-part working thesis, the evidence that would show it wrong, the three groups of usage modes in the loop and the European obligations that frame it, and draft a one-page inventory of AI in testing and in detection.

Learning objectives

Explain the five parts of the working thesis and what evidence would count against it.
Compare the contracted catalogue run at Nordvik Region with the pipeline run at Hansa Mutual by what each can later prove.
Classify uses of AI in the loop into the three groups of usage modes and say where the risk sits in each.
Draft a one-page inventory of AI in testing and in detection, marking where AI is on both sides of one check.

Key concepts

The purple loop: The structure that carries a finding from an adversary's behaviour to a defence that has been shown to work. The purple team in this book is that joint loop between the red team and the blue team, not a team beside them.
Working thesis: The author's own five-part claim: purple is a loop, not a team; AI moves the loop from the event to the pipeline and keeps the event; a loop closed by machines alone verifies nothing new; coverage is a claim that needs evidence; safe emulation is a design question.
Agreement without verification: The risk that an emulation agent and a detection agent share training data, a model family and blind spots, so that a passing result shows only that two similar systems agree.
Usage mode groups in the loop: Modes 1 to 3 assist a person under the person's identity; Mode 4 performs a loop function under a service identity bounded by a mandate; Mode 5 agents such as an emulation runner act with an identity of their own, in effect a privileged account.
Inventory of AI in the loop: A one-page list of every testing and detection activity, whether AI takes part, whose it is, its usage mode, its identity and its highest level, with the entries marked where AI is on both sides of one check.

Teaching plan

10 min	The teacher tells the two Thursday-night runs of T1087.002 and asks the room what each organisation can prove the next morning, and who checked it.
15 min	Teacher presents the three observable developments of 2026 and the five risks of a loop that two systems can close between themselves; participants match each risk to a part of the thesis.
10 min	Short input on the three groups of usage modes and on why Europe frames the question as obligation: DORA Articles 24, 26 and 27, NIS 2 Articles 20 and 21, AI Act Articles 15 and 55.
25 min	Exercise in pairs: draft the one-page inventory of AI in testing and in detection for the participant's own organisation or for Nordvik Region.
15 min	Plenary: pairs report their both-sides entries and their unknowns; the teacher closes with the two decision records AIDR-0800 and AIDR-0850 and what an answer must state.

Discussion

The book commits in advance to evidence that would show its thesis wrong. Which of the two kinds of disconfirming evidence would be hardest for your organisation to collect, and why?
Neither Thursday night is better in every respect. What would be lost if Nordvik Region copied Hansa Mutual's pipeline, and what would be lost if Hansa Mutual dropped its human-led work?
Where in your own testing and detection might a provider's AI already be on both sides of one check without the contract saying so?

Exercise · 25 minutes

A one-page inventory of AI in the loop

Following the practical guide of the chapter, list the testing activities (penetration tests, red-team engagements, threat-led tests, tabletops, purple sessions, simulation tools) and the detection and response activities (triage, correlation, detection drafting, playbook execution, out-of-hours monitoring) of your own organisation, or of Nordvik Region as the chapter describes it. For each entry record who runs it, whether AI takes part, whose AI it is, the usage mode, the identity it uses and the highest level at which it acts, writing not stated where the contract is silent. Mark every entry where AI is on both sides of one check, and give each unknown entry a date by which the provider must answer.

Deliverable: A one-page inventory with an owner, a mode and a status for every entry, the both-sides entries marked, and a review date six months ahead.

Self-test

Which statement is the third part of the book's working thesis?
1. A purple team should be staffed and budgeted as a third team beside red and blue.
2. A loop closed by machines alone verifies nothing new.
3. Continuous emulation makes the human-led exercise redundant within a few years.
4. Coverage is proved once every catalogued scenario has passed at least once.
In the chapter's grouping of usage modes, where does the risk sit for a Mode 5 emulation runner?
1. In over-reliance on a draft, because the person who asked for it remains accountable for the output.
2. In a meeting tool that summarises a tabletop and assigns actions without review.
3. In a shared service identity that only has read access to the telemetry.
4. In an agent with its own identity and permissions, in effect a privileged account.
What must an answer to AIDR-0800 and AIDR-0850 state, according to the worked example?
1. What was tested, when and with what result, and not a count of findings or of scenarios.
2. The number of findings closed in the quarter and the share of green results.
3. The names of the tools used by the tester and by the managed provider.
4. The budget needed to move from two catalogue runs a year to a pipeline.

Chapter 2 · 75 minutes

What the Loop Did Before: Penetration Tests, Red Teams, Tabletops and Purple Sessions

The lesson describes the loop as it was before AI: the penetration test, the red team engagement, the threat-led test, the tabletop, the purple session and breach-and-attack simulation. Participants compare the forms by the question each answers, who knows, who acts and what each can and cannot show, identify the stage each usually leaves unfinished, and build a testing-forms register of the kind the chapter gives for Nordvik Region and Hansa Mutual.

Learning objectives

Classify a testing activity as one of the six baseline forms using the chapter's four questions.
Identify the stage of the loop that each form usually leaves unfinished.
Explain why findings stalled, separating what the sources report from the book's own conclusion.
Draft a testing-forms register with an owner for each unfinished stage and an evidence age for each result.

Key concepts

Six testing forms: The penetration test, the red team engagement, the threat-led test, the tabletop, the purple session and breach-and-attack simulation. They differ in the question answered, who knows, who acts, the output and the cadence.
Stage usually left unfinished: In the book's classification of the common case, the penetration test, the threat-led test and the purple session leave P5 Verify, the red team engagement and the simulation leave P4 Improve, and the tabletop performs no P2 Emulate and leaves P5 Verify.
White team or control team: The group that referees an exercise: it sets rules and metrics, observes and derives lessons. The 2018 TIBER-EU framework says White Team; the current ECB text and the Delegated Regulation say control team. The book uses white team for the control group that governs an exercise.
Trusted agent: One named person on the defended side who knows of the exercise, so that real incidents are not mistaken for it and the stop can be reached. No verified source uses the term in this sense; it is the book's usage.
Testing-forms register: A register (TFR-NR-01, TFR-HM-01) that states for every testing activity its form, cadence, who it informed, what it proved and the stage it left unfinished, with an owner for that stage and an evidence age.

Teaching plan

10 min	The teacher sketches the history of the terms, from the tiger teams of the 1972 study to CBEST, TIBER-EU and the threat-led testing of DORA Article 26.
20 min	Participants fill in a blank version of the map of testing forms in small groups, then compare it with the chapter's table and its column of unfinished stages.
10 min	Teacher-led reading of the table of what each form can and cannot show, with the question to ask of a claim for each form.
25 min	Exercise: build a testing-forms register for the participant's own organisation or extend the Nordvik Region and Hansa Mutual registers.
10 min	Debrief on why findings stalled: the backlog, ownership not matched to the test, and closure with no owner and no test.

Discussion

Hansa Mutual has every testing form and still left P5 Verify to the end. What does that say about adding more forms as a remedy?
A blue team that is unaware measures real detection and response; a blue team in the room learns faster. How should an organisation choose between the two for a given question?
The chapter uses one vendor's dataset only as an indication of a mechanism. How should a team treat a statistic of that kind when it presents its own case to a board?

Exercise · 25 minutes

A testing-forms register

Using the seven steps of the chapter's practical guide, list every activity of the last 24 months in your organisation that was called a test, assessment, exercise, simulation or review of the defence. Classify each as one of the six forms by asking who knew, who acted, whether a technique was actually run and whether the result was a document, a changed control or a shared record. Record the last run, the cadence and the scope, trace where the findings of the last run went, and name the stage each form left unfinished. Participants without access to such records extend the registers TFR-NR-01 and TFR-HM-01 from the chapter's description of Nordvik Region and Hansa Mutual.

Deliverable: A register with a form, a date and an owner per activity, a named unfinished stage per form with its owner, and an evidence expiry, by default 180 days.

Self-test

Which stage does a breach-and-attack simulation usually leave unfinished, in the chapter's classification?
1. P1 Target, because the catalogue has no scenarios at all.
2. P2 Emulate, because no behaviour is ever executed.
3. P4 Improve, because a failure is recorded with no one to act on it.
4. P3 Observe, because the tool cannot record a pass or a fail.
What can a tabletop show, according to the chapter's evidence table?
1. That the people, roles and plan hold together on paper.
2. That a named vulnerability was exploitable at a given date.
3. That a detection still catches a variant of the technique.
4. That a control blocked a catalogued behaviour on a tested path.
Which cause of stalled findings does the chapter put above the others, as its own conclusion?
1. Testers wrote reports that the system owners could not read.
2. Budgets for penetration tests were cut after the first year.
3. Supervisors never asked for a remediation plan.
4. Closure of a finding had no owner and no test to prove it.

Chapter 3 · 70 minutes

The Pressure on the Loop: Machine-Speed Adversaries, Detection Decay and the Annual Test

The lesson measures the pressure that makes the traditional rhythm inadequate: a shrinking exploitation window, an estate that changes faster than the test, detection decay, the finding half-life, scarce talent and a calendar that rewards a report. Participants calculate a test-to-change ratio, read a decay estimate in three states, and separate what AI makes cheaper, repetition, variation and drafting, from what it does not: novelty, judgement, independence and safety.

Learning objectives

Explain the assumptions of the annual rhythm and the evidence the chapter cites against each.
Calculate a test-to-change ratio for a priority technique from change and evidence records.
Classify a detection as current, at-risk or expired from its last passing test and its dependency changes.
Compare what AI makes cheaper in the loop with what stays costly.

Key concepts

Test-to-change ratio: For a given technique, the number of production changes that touch what the technique depends on, between two passing tests. A ratio of one means every change was followed by a verification; a ratio of twenty means twenty changes accumulated before anyone looked.
Detection decay: The loss of a detection's effect between tests as its dependencies change. It is measured by age since the last passing test, set against the evidence expiry, together with the count of dependency changes since that test.
Current, at-risk, expired: The three states of a decay estimate: current if a test passed within expiry and no dependency changed since; at-risk if within expiry but a dependency changed; expired if the last passing test is older than the expiry.
Finding half-life: The time a finding spends between P3 Observe and P5 Verify, in two parts: the wait for a change at P4 Improve and the wait for the proof of that change.

Teaching plan

15 min	The teacher presents the shrinking window with the chapter's figures (63, 32 and 5 days) and stresses which statements are the sources' and which the book's own conclusion.
10 min	Worked example at the board: Nordvik Region's fortnightly releases against an annual test give a ratio of about 26.
25 min	Exercise: participants estimate the test-to-change ratio and the decay state for three techniques from a supplied or their own change log.
10 min	Groups read the usage-mode table and argue why Modes 1 to 3 leave the rhythm as it was while Modes 4 and 5 change it.
10 min	Plenary on what AI does not make cheaper, and on the remedies of the two organisations: terms for Nordvik Region, a platform for Hansa Mutual.

Discussion

Age alone misleads in both directions. Which of your detections would look healthy by age and unhealthy by dependency changes, or the reverse?
The chapter says a calendar set by regulation or procurement rewards a report. What would have to change in a contract or a testing programme for it to reward a verified finding instead?
If AI makes variation and repetition cheaper but not novelty, judgement, independence or safety, where does the bottleneck of your own loop move?

Exercise · 25 minutes

Test-to-change ratio and decay estimate

Choose three priority techniques. For each, write down the dependency path: the service or identity it targets, the log source, the detection record and the playbook. From the change log of the last 12 months, count the changes that touched anything on that path, list the dates of passing tests in the same period and divide changes by passing tests. Mark any technique whose ratio exceeds 10 or whose last passing test is older than its evidence expiry, classify its detection as current, at-risk or expired, and choose a remedy per technique: a trigger after a change on the path, a schedule, or an accepted gap recorded as such.

Deliverable: A dated table with one row per technique: changes, passing tests, ratio, last passing test, decay state and the chosen remedy.

Self-test

A priority detection at Hansa Mutual passed its last test 53 days ago, and its log connector was upgraded after that test. Which state does the chapter's decay estimate give it?
1. Current, because 53 days is inside the 90-day expiry.
2. At-risk, because it is within expiry but a dependency has changed.
3. Expired, because any dependency change voids the evidence.
4. Retired, because the connector upgrade replaced the detection.
What does a test-to-change ratio of twenty mean for a technique?
1. Twenty passing tests were run for each production change on the technique's dependency path.
2. Twenty analysts would be needed to verify the technique.
3. Twenty changes accumulated on its dependency path before anyone verified it.
4. Twenty per cent of the scenario library covers the technique.
According to the chapter, which of the following does AI not make cheaper in the loop?
1. Independence between the side that tests and the side that is tested.
2. Repetition of a catalogued, reversible scenario on a schedule.
3. Variation of a scenario's parameters such as account and hour.
4. Drafting of scenario variants and of result summaries.

Chapter 4 · 90 minutes

The Purple Loop Defined: Five Stages, Evidence and the Independence Principle

The lesson defines the purple loop: P1 Target, P2 Emulate, P3 Observe, P4 Improve and P5 Verify, each with its record; the closure rule and its five finding states; ceilings on delegation per stage and action class; the independence principle with five kinds of separation, one incentive rule and three proofs; and the roles that hold the loop. Participants write a delegation profile and learn why the loop is not a team, an event or a dashboard.

Learning objectives

Explain each of the five stages by the question it answers and the record it produces.
Classify findings into the five states of the closure rule and say which may be reported as closed.
Draft a delegation profile with a ceiling, a decider and a stop holder for each action class.
Review a loop's independence declaration against the five kinds of separation, the incentive rule and the three proofs.

Key concepts

Stage records: Each stage is defined by its record: a scenario record (SCN) at P1, an emulation plan and run log (EMU) bounded by rules of engagement (RoE) at P2, a finding (FND) and purple session record (PRP) at P3, a change at P4, and a regression case (REG) with an evidence manifest (EVD) at P5.
Closure rule: A finding is closed only when the re-test and its variant pass, the evidence manifest is signed and attached, and a named person signs the closure with its date. The five states are open; implemented, unverified; re-test failed; closed and verified; risk accepted.
Delegation ceiling: The highest autonomy level, from Level 0 Advisory to Level 4 Autonomous, allowed for an action class at a stage. The lowest ceiling governs, and Level 4 is never used for an emulation action that is irreversible, leaves the signed scope, touches personal data beyond authorisation or targets a named person.
Independence principle: A check counts only where the side that tests and the side that is tested can fail in different ways. It is declared as five kinds of separation (model, data, authorship, vendor, time), one incentive rule between roles and three proofs: held-out scenarios, seeded gaps and reproduction.
Purple-team coordinator: The role that runs the loop: it schedules, makes sure findings reach their owners in a usable form and tracks the age of open findings. It is accountable for the flow and legibility of the register and is never a third team.

Teaching plan

15 min	The teacher walks the five stages on the figure, asking for each: what question, what record, who writes it and who accepts it.
15 min	Card sort: participants place ten short finding descriptions into the five states of the closure rule and argue the borderline cases, in particular implemented, unverified.
15 min	Teacher presents the ceiling table and the two worked profiles, LOOP-NR-2028-01 and DLG-HM-LOOP-01, and the weakness that Karin Lund holds both the detection and the closure role.
30 min	Exercise in groups: write a delegation profile for a loop, including the independence declaration for rows where AI is on both sides.
15 min	Groups exchange profiles and review them against the definition of done; the teacher closes with the three misreadings: a team, an event, a dashboard.

Discussion

A white-team sample at Hansa Mutual found 6 of 20 closed findings had been closed when the change merged. Why is that state so easily reported as closed, and who has an interest in the difference?
Nordvik Region signs only P2, P3 and P5 with its counterparties and keeps P1 and P4 internal. What does that choice say about which decisions can be bought and which cannot?
The book says a kind of separation that is not shown is treated as shared. Which of the five kinds would your organisation find hardest to show, and what would compensate for it?

Exercise · 30 minutes

A delegation profile for a loop

Following the chapter's practical guide, list the action classes for each of the five stages, starting from the chapter's table. For each class ask the four questions: is the action reversible, does it stay inside the signed scope, does it touch personal data beyond what the exercise is authorised to touch, and does it target a named person. Set the ceiling at the lowest level any answer permits and no higher than your organisation has evidenced. Name the decider, the person who delegated and the stop holders with deputies. Write the conditions as numbers, and add an independence declaration for every row where AI sits on both sides of a check. Use Hansa Mutual's agents if you have none of your own.

Deliverable: A one-page delegation profile in which every row has a ceiling, a decider and a stop holder, and the closure row names a person.

Self-test

A change has been merged for a finding but the re-test has not yet run. How is the finding reported under the closure rule?
1. As closed, because the change was reviewed and merged by its owner.
2. As risk accepted, because no evidence exists either way.
3. As re-test failed, because the absence of a pass counts as a failure.
4. As open, in the state implemented, unverified.
What is the recommended ceiling for declaring a finding closed and verified at P5 Verify?
1. Level 3 Bounded, enforced by the regression case outside the runner.
2. No delegation: the runner proposes and a named closure owner signs.
3. Level 2 Supervised, with the purple-team coordinator sampling results.
4. Level 4 Autonomous, provided the scenario is benign and reversible.
Which set names the three proofs of the independence declaration?
1. A signed manifest, a stop path and a white-team approval.
2. Model, data and vendor separation between the two sides.
3. Held-out scenarios, seeded gaps and seeded errors, and reproduction.
4. A re-test, a variant and a dated signature on the closure.

Module 2 · Part II · The Stages of the Loop

Part II takes the loop stage by stage. Participants build a priority list and a scenario record at P1 Target, write rules of engagement that a policy decision point can enforce, plan a human-led and AI-assisted campaign and a continuous pipeline at P2 Emulate, classify outcomes against a sealed expectation at P3 Observe, turn a finding into a reviewed change at P4 Improve, and close it at P5 Verify with a regression case and an evidence manifest that expires.

Lecture · 60 minutes

One finding through five stages: the craft of the purple loop

The lecture follows a single finding around the loop to show why each stage has the record it has. It begins with the choice of what to test and the hazard of a library that grows towards what is easy to emulate, moves through the signed manifest and the stop path that make emulation safe, the campaign and the pipeline, the sealed expectation and the seven outcomes, the routing of a finding to the right change, and the re-test with variants that decides closure. Nordvik Region's spray-then-success finding, detected by the Region and closed by its provider's AI, runs through the whole hour.

8 min	P1 Target: choosing by risk, not by ease Four inputs: intelligence, the threat register, risk assessment and the organisation's own incidents and findings. Priority techniques ranked by impact, relevance and uncertainty about the defence, in coarse tiers. The party that proposes scenarios is not the party that selects them; a curator proposes at Level 1 Assisted.
10 min	Rules before scenarios Three documents kept apart: rules of engagement, mandate manifest and decision record; the lowest ceiling governs. Scope as code: default deny, exclusions win, the manifest outside the agent's reach, refusal tested by three dry runs. Safety classes S1 to S4 decide what may run where and at which level. The stop path denies, revokes and cleans up, and the emulating system takes no part in it.
10 min	P2 Emulate: the campaign and the pipeline The emulation plan binds scenarios to the signed scope and gives the blue team ground truth without the plan. People contribute judgement that depends on consequence and context; AI adds breadth, speed and lower cost. A pipeline is exposed to Goodhart's law; the held-out share and the generalisation gap are its honest number.
10 min	P3 Observe: expectation first The expectation sheet is written from the detection catalogue and sealed before the result is shown. Seven outcomes ordered by layer; detected demands the whole chain through triage and action. Nordvik Region's step 2: the rule fired at 02:17 and the provider's AI closed the alert at 02:21.
10 min	P4 Improve: the right change, owned and reviewed Routes by the layer that failed: detection, control, playbook, mandate or recorded risk acceptance. The tester who authored a scenario does not tune the detection that answers it. Review is the bottleneck by design; cost is counted by replay, shadow and an alert budget.
12 min	P5 Verify: closure with an age The exact re-test is necessary and insufficient; variants, a held-out variant and a negative control test the technique. Nordvik Region's exact re-test passed in November 2027 and an out-of-hours variant failed in January 2028. Evidence is generated, hashed, versioned, signed and minimised, and it expires by clock and by condition. Report the denominator, the reasons and the age: 25 of 34, not 74 per cent.

What the audience takes away

Each stage is defined by a record that the next stage can use without the meeting that produced it.
Safety and independence are decided in the manifest, the plan and the regression case, not left to the care of an operator or an agent.
A merged change is not a closed finding; closure needs a passed re-test with a variant, attached evidence, a named signer and a date.

Chapter 5 · 90 minutes

Target: Threat-Informed Scenarios, Risk and Priority Techniques

The lesson covers P1 Target: how intelligence, the threat register, risk assessment and incidents become scenarios, how ATT&CK and ATLAS serve as a vocabulary of identifiers and not procedures, and how priority techniques are ranked by impact, relevance and uncertainty about the defence. Participants build a first priority list, write a scenario record, and learn the guards against a library that fills with what is easy to emulate.

Learning objectives

Explain what each of the four inputs to a scenario supplies and why the proposer is not the selector.
Rank candidate techniques by impact, relevance and uncertainty about the defence into priority tiers.
Draft a scenario record with source, expected outcome per layer, safety class, evidence rule and exclusions.
Review a scenario library for selection bias and record exclusions in an exclusion register.

Key concepts

Priority technique: A technique chosen for regular testing by the sum of three coarse tiers: impact on critical assets, relevance to this organisation or sector, and uncertainty about whether the defence would stop it. The result is an order and a tier, with reasons.
Scenario record: The testable statement built from one or more techniques and held as code (SCN-NR, SCN-HM): identity and owner, source, technique set and parameters, expected outcome per layer, safety class and environment, evidence rule, exclusions and sensitivity.
Scenario curator: An agent or drafting assistant that reads intelligence, register entries and incident reviews and proposes scenario drafts at Level 1 Assisted. A named person accepts each draft, sources are treated as untrusted input, and the reviewer's work is measured.
Selection bias: The tendency of a library to fill with scenarios that are cheap to run. The guards are gaps reported as gaps, a reserved share for hard techniques, a check of the curator's mix and a protected class of human-authored scenarios.
Exclusion register: The record of what is deliberately not tested: out of scope, unsafe, unauthorised or not worth testing, each with the reason, the decider and a review date. An excluded technique is untested, and untested is not covered.

Teaching plan

15 min	The teacher presents the four inputs and the four vocabulary rules, using T1110.003 and T1110.001 to show why sub-techniques matter where the detection differs.
15 min	Worked reading of PRI-NR-2028-01 and of the two scenario records SCN-NR-0001 and SCN-HM-0007; participants name what each record says and what it deliberately omits.
35 min	Exercise in groups: build a first priority list for one service and write one scenario record from its top entry.
15 min	Groups check one another's lists for selection bias: which entries can run benign and tagged, which need a mirror or the red team, and which are reported as gaps.
10 min	Plenary on the curator at Hansa Mutual: 17 drafts, six accepted, none on T1486 or T1490, and what that confirms about drafts drawn from public reporting.

Discussion

At Hansa Mutual the detection-engineering team may nominate techniques but cannot remove one. What would the priority list look like after two years if the tested side could remove entries?
Nordvik Region reported T1190 and T1486 as untested when their mirror evidence had expired. What pressures push an organisation to report such techniques differently?
The curator's proposals favoured well-documented techniques. How would you design the review so that a reviewer who sees mostly good drafts still reads each one?

Exercise · 35 minutes

A first priority list and one scenario record

Choose one service of your own organisation, or Nordvik Region's benefits-triage service. Following the practical guide, collect candidate techniques from intelligence tags, your own incidents and findings, and the exposure of the service. Give each candidate an impact tier, a relevance tier and an uncertainty tier from 1 to 3, sort by the sum, break ties by uncertainty and cut the list. For the first twenty entries record how the technique can be emulated safely and mark the hard ones. Then write a scenario record for the top entry by ATT&CK identifier only: source, parameters, expected outcome per layer, safety class, evidence rule and exclusions. Include no procedure.

Deliverable: A priority list with tiers, reasons, owners, emulation routes and a review date, plus one scenario record at the level of identifier and parameter.

Self-test

Which three factors does the chapter combine to rank priority techniques?
1. Novelty, ease of emulation and the number of public reports.
2. Cost of the test, tester availability and the audit calendar.
3. Impact, relevance and uncertainty about the defence.
4. Severity, exploitability and the age of the vulnerability.
What is the ceiling for AI at P1 Target, and who decides what enters the scenario library?
1. Level 1 Assisted; a named owner accepts or rejects each draft.
2. Level 2 Supervised; the curator adds drafts and a person samples them.
3. Level 3 Bounded; the policy decision point accepts catalogued drafts.
4. Level 0 Advisory; the detection-engineering team selects the scenarios.
How does the chapter treat a priority technique that has been placed on the exclusion register?
1. As covered by the compensating controls of the wider estate.
2. As removed from the priority list until the next six-monthly review.
3. As low risk, because the exclusion was approved by a named person.
4. As untested, and untested is not covered.

Chapter 6 · 90 minutes

Rules of Engagement and Safe Emulation: Scope, Blast Radius and the Stop Path

The lesson treats rules of engagement as the first design question of the loop. Participants separate the rules of engagement from the mandate manifest and the decision record, express scope as code that a policy decision point enforces, assign safety classes S1 to S4, record third-party consent and the handling of personal data, and design a stop path that runs outside the emulating system and is drilled. The white team owns the manifest.

Learning objectives

Explain why the rules of engagement, the mandate manifest and the decision record are kept apart and which ceiling governs.
Classify scenarios into safety classes S1 to S4 and state the environment and level each allows.
Draft a rules-of-engagement manifest whose every sentence a policy decision point can evaluate.
Design a stop path with machine-detectable abort conditions, named holders and a drill.

Key concepts

Rules-of-engagement manifest: A signed, versioned file (RoE) that says what may be done to which systems, when, with whose consent and under what stop conditions. It belongs to the exercise or programme and is enforced by a policy decision point outside the agent.
Scope as code: Scope in a form read at every action: default deny, exclusions checked before inclusions, the manifest outside the agent's reach, and refusal tested by three dry runs against an out-of-scope target, after the window and with a stop flag set.
Safety classes S1 to S4: S1 is benign, reversible and tagged; S2 is reversible with bounded side effects; S3 needs realistic state or may disturb service and never runs in production; S4 has impact or irreversible effect, or involves staff or third parties.
Stop path: The mechanism, held by named people outside the emulating system, that denies further actions at the policy point, revokes the system's credentials and egress, and invokes the clean-up. It needs no approval to use and is drilled.
White team: The control group that governs the exercise: it owns the manifest and its versions, holds or delegates the stop path, runs deconfliction and keeps the record. It lies outside both the red team and the SOC so that it can stop either.

Teaching plan

15 min	The teacher explains why the rules come before the scenario and walks through the three documents, with the rule that the lowest ceiling governs.
15 min	Participants sort twelve short scenario descriptions, given by technique identifier only, into safety classes S1 to S4 and state the environment and ceiling for each.
35 min	Exercise: draft a rules-of-engagement manifest for a three-scenario exercise at Nordvik Region or in the participant's own organisation.
15 min	Tabletop on the stop path: the teacher raises a synthetic stop condition and groups say who acts, what is revoked and what is cleaned up, without the emulating system.
10 min	Close on third parties, personal data and staff: consent in contracts and notices, synthetic data by design, and S4 for any scenario involving people.

Discussion

The chapter says a control that has never refused anything has not been shown to work. Which controls around your own testing have never been seen to refuse?
Nordvik Region's risk is a manifest signed once and treated as a formality; Hansa Mutual's is a pipeline running inside rules nobody has re-read. Which is closer to your organisation, and what keeps the rules alive?
A managed provider is on the blue side of an exercise and also holds a stop path. How should the two roles be reconciled in a contract?

Exercise · 35 minutes

A manifest a policy point can enforce

Write a rules-of-engagement manifest for an authorised exercise of three scenarios against your own organisation's systems or Nordvik Region's benefits-triage service. Follow the ten steps of the practical guide: name the question and the scenario identifiers; list exclusions first, then inclusions with their owners; give permitted techniques by ATT&CK identifier with a safety class each; set the window, the blackouts and who may shorten the window; set the autonomy ceiling per class; require short-lived credentials, tagging and synthetic accounts; record third-party consent; write machine-detectable stop conditions with named holders and deputies; and state data classification, legal basis and the rule for real personal data met by accident. Write every line so that a policy point could evaluate it.

Deliverable: A signed-ready manifest of one to two pages, with the three dry-run refusals and the stop-path test listed as conditions of its definition of done.

Self-test

A manifest allows Level 3 Bounded for class S1 scenarios, but the agent's mandate allows only Level 2 Supervised. At which level does the agent run?
1. Level 3 Bounded, because the manifest belongs to the exercise.
2. Level 2 Supervised, because the lowest ceiling governs.
3. Level 4 Autonomous, once the white team has signed both documents.
4. Level 1 Assisted, because any conflict falls back to the minimum.
What does the stop path do, in order, when a halt is called?
1. It asks the emulating system to finish its current step and report.
2. It notifies the red-team lead, who decides whether the run continues.
3. It pauses the schedule, opens a ticket for the red-team lead and waits for the system owner to approve the halt.
4. It denies further actions, revokes credentials and egress, and invokes the clean-up.
Which safety class does the chapter assign to a scenario that involves staff, such as a social-engineering test?
1. S4, with AI limited to Level 0 Advisory and named people acting.
2. S1, provided every action is tagged and reversible.
3. S2, with white-team approval for each run in production.
4. S3, run on a range or mirror at Level 3 Bounded.

Chapter 7 · 75 minutes

Emulate: Adversary Emulation Plans, Human-Led and AI-Assisted

The lesson turns a scenario into a campaign. Participants learn what the emulation plan record contains, why the red team, the white team, the trusted agent and the blue team that does not know are separate roles, what a person and what AI each contribute to planning and execution, and how a tamper-evident event log and a sealed hand-over give P3 Observe its ground truth without giving the blue team the plan.

Learning objectives

Draft an emulation plan record that binds scenarios to the signed scope and names measurable abort conditions.
Explain the four groups of people in a live exercise and what each can and cannot do.
Compare what a person contributes to a campaign with what AI adds in planning and variation.
Design an event log that is tagged at the source and that testers cannot rewrite.

Key concepts

Emulation plan record: The plan as code (EMU): the manifest it runs under, ordered scenarios with techniques and safety classes, expected outcomes copied from the scenarios, target scope by reference, window, abort conditions, roles, delegation profile, tag scheme and event-log store. It contains no exploit detail.
Blue team that does not know: Everyone on the defending side who is not told of the exercise, so that it measures what they would do on an ordinary day. They are measured in aggregate and never by name.
Event log: A timestamped, tamper-evident record of every action taken, written as it happens to an append-only store held by the white team. It includes any agent's actions and records the unexpected, such as side effects and stops.
Ceiling and boundary for execution: An agent executes only catalogued, benign, reversible scenarios inside the signed scope at Level 3 Bounded, and the agent that executes does not decide what to execute: a person chooses the scenario from a catalogue.

Teaching plan

10 min	The teacher contrasts a scenario with a plan and presents the fields of the emulation plan record using EMU-NR-2027-02.
15 min	Role cards: participants take the red team, white team, trusted agent and unaware blue team and answer who knows what, who can stop the exercise and what can be undone.
10 min	Short input on what a person adds and what AI adds, and the four planning uses: gap listing, variation, tooling choice and drafting.
30 min	Exercise: write an emulation plan for three to eight scenarios, including one human-only scenario and one variant.
10 min	Debrief on the hand-over: sealing the event log and the plan, and recording a scenario that was planned but not run.

Discussion

The plan asks for one scenario written by a person and shown to no assistant. What does that scenario test that a library scenario cannot?
The white-team lead's signature, not the red team's own approval, opens the window. What goes wrong when the red team authorises itself?
Nordvik Region demands the event log, the plan and the drilled stop path as contract deliverables. What would you add to a tester's contract after this lesson?

Exercise · 30 minutes

An emulation plan with ground truth

Using the nine steps of the practical guide, write an emulation plan for an authorised two-week window against your own organisation's systems or the benefits-triage service of Nordvik Region. Select three to eight scenarios by identifier from a priority list, copy the expected outcome per layer from each, and add one scenario written by a person and shown to no assistant and one variant of a known scenario. Bind targets by reference to the manifest's scope, write abort conditions that someone other than the testers can measure, name two stop-path holders outside the red team, define the tag scheme and the event-log store, and state who knows and who does not. Give techniques by ATT&CK identifier only.

Deliverable: A plan record ready for the white-team lead's signature, with measurable abort conditions, named stop holders, a tag scheme and a list of who knows.

Self-test

How does the emulation plan state the targets of a campaign?
1. As a new list of hosts chosen by the red-team lead for the window.
2. As whatever the emulation agent discovers during the first day.
3. As a reference to the scope in the signed manifest, never as a wider list.
4. As a description agreed verbally with the system owners beforehand.
Which contribution does the chapter attribute to a person in a campaign, as distinct from AI?
1. Judgement that depends on consequence and context.
2. Breadth across the scenario library at low cost.
3. Speed in drafting the plan record from the scenarios.
4. Listing the techniques in a report that lack a scenario.
Where is the event log of an exercise written, according to the chapter's design rules?
1. To the testers' own workstations, to be cleaned up after the report.
2. To an append-only store held by the white team, which testers cannot rewrite.
3. To the SIEM of the blue team, alongside the production detections.
4. To the emulation agent's memory, exported when the window closes.

Chapter 8 · 90 minutes

Emulate Continuously: Breach-and-Attack Simulation, Atomic Tests and Automated Red Teaming

The lesson treats P2 Emulate as a pipeline: breach-and-attack simulation, atomic tests and automated red teaming, triggered by change, schedule and intelligence. Participants decide what runs where, set triggers and cadence, design variation and a held-out set against overfitting and Goodhart's law, and work through the chapter's debate on whether continuous automated emulation makes the quarterly human-led session unnecessary, ending in its three-level verdict.

Learning objectives

Compare breach-and-attack simulation, atomic tests and automated red teaming by what each is good for.
Design triggers and a cadence that keep evidence for priority techniques inside its expiry.
Explain the four overfitting failures and how a held-out set and the generalisation gap expose them.
Review the debate on the human-led session and state the verdict with its observable, expected and speculation labels.

Key concepts

Three kinds of trigger: Change triggers answer a detection that worked yesterday and not today; schedule triggers answer decay when nothing changed; intelligence triggers answer a world that moved. Hold-backs during a freeze or a major incident are logged with the evidence age.
What runs where: Every new scenario and variant runs first on the red-team range; scenarios above S1 run in a pre-production mirror; production carries S1 on the pipeline's authority and S2 only with white-team approval per run; shadow replay tests a detection change against stored telemetry.
Overfitting failures: Marker leakage, where a rule fires on the telemetry tag; signature fitting to the public form of a test; catalogue closure, where detections converge on the library; and dashboard comfort, where a high pass rate over a stable library is read as safety.
Held-out set and generalisation gap: A share of scenarios and variants hidden from detection engineers and never used for tuning. The generalisation gap is the difference between the pass rate on known forms and on held-out variants; above ten percentage points it is treated as a finding.
Protected share of human-led emulation: A share of red-team hours reserved for novel, human-led work, with a default of 30 per cent that is the book's own figure, and with novel-finding yield measured separately from the pipeline's regression results.

Teaching plan

15 min	The teacher presents the three kinds of tool, the environment table and the pipeline definition of HM-SEC-004, stressing the lines that say what the runner cannot do.
15 min	Participants compute the generalisation gap from Hansa Mutual's first quarter of 2028: 37 of 41 known forms against 10 of 14 held-out variants, and decide what follows.
25 min	Exercise: choose triggers, cadence, volume cap and hold-back rules for a pipeline or, for a buyer of the loop, a pinned atomic-test subset in a contract.
25 min	Structured debate in four steps: the case for concern, the case for calm, where the positions meet and what can be done, with two groups arguing each side at its strongest.
10 min	The teacher gives the chapter's verdict in three labels and asks each participant for one design choice they can influence.

Discussion

The case for calm says spending a red-team operator's scarce hours on re-running last year's techniques is a poor use of them. Where does that argument stop being true?
A pipeline that adds alerts consumes analyst attention. Who in your organisation should hold the right to cap its volume, and on what evidence?
If the model that proposes variants also drafts detections, the set is not held out from it. How would you show a board that your held-out set really is held out?

Exercise · 25 minutes

Triggers and cadence for continuous emulation

For ten priority techniques of your own organisation, or of Hansa Mutual as the chapter describes it, write a pipeline definition in outline. Give each technique its evidence expiry and set the schedule trigger to one third of it. List the detections, connectors and mandates that can affect each technique and attach a change trigger with a maximum delay. Define the intelligence trigger as a named intake with deadlines. Estimate the alerts per week the pipeline will generate and compare them with the alert budget of the affected detections. Add hold-back rules and a quarterly stop-path drill with a target time. Participants whose organisation buys the loop instead specify five atomic tests, by technique identifier, for a contracted catalogue run.

Deliverable: A one-page pipeline definition, or contracted test subset, with three trigger types, a volume cap, hold-back rules and a stop-drill target.

Self-test

In Hansa Mutual's first quarter of 2028, detections fired on 37 of 41 known-form scenarios and on 10 of 14 held-out variants. What does the chapter conclude?
1. The pipeline is sound, because nine in ten known scenarios were detected.
2. The held-out set is too small to say anything and should be dropped.
3. The red team's held-out variants were unfair and should be shown to the detection engineers before the next run.
4. The 19-point generalisation gap is above the threshold and is a finding on the detections.
Which overfitting failure occurs when a detection fires on the telemetry tag that gives ground truth?
1. Catalogue closure.
2. Marker leakage.
3. Signature fitting.
4. Dashboard comfort.
How does the chapter's verdict label the claim that continuous automated emulation replaces the human red team?
1. Speculation: no evidence shows it, and a protected share of human-led work remains.
2. Observable: it is documented practice in large financial groups.
3. Expected: it follows from AI-generated variants at scale becoming routine in large organisations within a few years.
4. Refuted: the sources show that pipelines find fewer issues than people.

Chapter 9 · 90 minutes

Observe: Telemetry, Detection and Response Compared with Expectation

The lesson covers P3 Observe, where what the emulation did is compared with what the organisation's coverage claims said should happen. Participants write and seal an expectation sheet before results are shown, use tagged ground truth held outside the system observed, classify each step into one of seven outcomes ordered by layer, run a purple session with a rule for disagreement, and raise findings that record facts and propose an owner.

Learning objectives

Explain why the expectation is written from the detection catalogue and sealed before the ground truth is unsealed.
Classify emulated steps into the seven outcomes, recording the earliest failing layer.
Draft a finding that states the expectation, the outcome, the layer that failed and the evidence, without choosing the fix.
Review the use of an AI correlator at P3 against its four failure modes and the privacy rule.

Key concepts

Expectation sheet: The organisation's coverage claim made explicit for the techniques in a scenario: telemetry, rule, severity, triage and time bound per step. The detection owner writes it from the catalogue, knowing only the list of techniques, and the white team seals it.
Ground truth: The record of what the emulation did, written by the emulation side at the time. It is tagged, time-stamped from a source both sides trust and held outside the system observed, and the tag must never reach detection logic.
Seven outcomes: Prevented; detected; alerted but not triaged; triaged but not acted on; missed; no telemetry; not tested. They are mutually exclusive and ordered by layer, and detected demands the whole chain through a qualified triage decision and the playbook action.
Purple session record: The record (PRP) of the meeting in which red and blue read the result together: both seals, the roles, one outcome per step with a saved query, disagreements recorded with both readings, and results reported by technique, never by analyst.
Optimistic join: A correlator's failure in which it finds an alert near in time and on a related host and counts the step as detected. At Hansa Mutual all three corrections to the correlator's proposals were of this kind.

Teaching plan

15 min	The teacher introduces expectation first and ground truth, then the seven outcomes on the layer figure from prevention to action.
20 min	Participants classify the six steps of PRP-NR-2027-02 from short evidence cards before seeing the chapter's table, and argue step 2.
35 min	Exercise as a simulated purple session: sealed expectation, step-by-step unsealing, classification and one drafted finding.
10 min	Input on AI in observation: the optimistic join, the hostile field, the shared blind spot and silent drift, with the defence for each.
10 min	Plenary on reporting: aggregate only, no names in outcome tables, and times as values and maximum, never a mean over fewer than 10 runs.

Discussion

Step 2 at Nordvik Region looked detected in the SIEM alone. Which of your own detected results would survive the question of whether a qualified person took a triage decision in time?
Unsettled steps take the more cautious outcome, and disagreement is not settled by seniority. What does that rule cost a session, and what does it protect?
A Mode 5 agent that runs a scenario does not also grade it. Where else in your tooling does one system both act and judge its own result?

Exercise · 35 minutes

A purple session with sealed expectations

Work in groups of four as red lead, detection owner, SOC representative and white team. The white team gives the detection owner only the list of techniques of a six-step scenario. The detection owner writes the expectation sheet from the catalogue: telemetry, rule, severity, triage and time bound per step. The white team seals it, then unseals the supplied ground truth step by step in time order. For each step the group agrees one of the seven outcomes, working from prevention towards action, and records disagreements with both readings. For one step that is not prevented or detected, draft the finding: expectation, outcome, layer that failed, evidence and proposed owner. Do not discuss the fix. Use the Nordvik Region session of the chapter as the supplied case if you have none.

Deliverable: A purple session record with one outcome per step and one draft finding naming the failed layer and a proposed owner.

Self-test

A detection fired and an alert was closed by an automated process without a qualified triage decision. Which outcome does the chapter record?
1. Detected, with a note that automation handled the alert.
2. Missed, because no person ever saw the alert.
3. Alerted but not triaged, with the reason closed by automation.
4. Triaged but not acted on, because closure counts as triage.
What does the detection owner receive before writing the expectation sheet?
1. The list of techniques in the scenario, and nothing of the plan, order or timing.
2. The full emulation plan, so that the expectations match each step.
3. The emulation log, so that expectations can be checked against it.
4. The tester's draft report, with the findings removed by the white team.
Why does the chapter record the layer at which telemetry disappeared for a no telemetry outcome?
1. Because the layer sets the severity rating given by the tester.
2. Because supervisors require the layer in the attestation.
3. Because the correlator cannot join steps without a layer field.
4. Because the layer decides who owns the fix.

Chapter 10 · 90 minutes

Improve: From Finding to Change in Detections, Controls, Playbooks and Mandates

The lesson covers P4 Improve, the stage in which a finding becomes a change. Participants route a finding by the layer that failed to a detection, control, playbook, mandate or recorded risk acceptance, assign an owner who is not the scenario's author, review AI-drafted changes for overfitting and shared blind spots, count false-positive cost by replay and shadow, order the backlog, and record findings that no one can fix.

Learning objectives

Classify a finding by the layer that failed and choose the route, giving a reason for each route rejected.
Explain the ownership rules, including who must not own each kind of change.
Review an AI-drafted change against the five review questions and the three risks specific to the loop.
Draft a finding-to-change decision that a second person could reproduce.

Key concepts

Five routes: Detection, when activity was visible and no detection fired or it was routed wrongly; control, when a preventive control was absent or bypassable; playbook, when response was slow or wrong; mandate, when an agent, role or provider acted outside or short of its authority; recorded risk acceptance.
Change record: The CHG record of P4: the finding, the route, the decision with routes considered and urgency, the owner, the artefact, who drafted and who reviewed, cost, rollout, and the regression case handed to P5 Verify.
Alert budget and tune-or-retire rule: Each detection has a budget of alerts per week. A change is replayed over at least 30 days of telemetry, runs in shadow for 14 days, and is reviewed or rolled back if it exceeds its budget or twice its budget for two consecutive weeks.
Finding half-life: The number of days after which half of the findings opened in a quarter have a passing re-test; it counts only verified closure. Findings are sorted into urgent, standard and deferred, with default targets of 14, 30 and 90 days, by technique importance and evidence age, what the defence did and what is at stake.
Recorded risk acceptance: A decision by a role with authority over the residual risk, for a stated period, with a reason and a review date. The person who would do the work does not accept the risk, and the coverage record keeps showing the technique as failed or declared.

Teaching plan

15 min	The teacher presents the route table and the ownership table, with the telemetry gap as the case where the route is collection first.
15 min	Groups route six findings drawn from the chapters so far and split any that need two routes into child findings with separate owners.
15 min	Input on AI-drafted changes and review: drafting from a behaviour description, a negative test, a named reviewer who is not the drafter, and caps on open drafts.
35 min	Exercise: write a finding-to-change decision and hand it to another pair for the reproducibility test.
10 min	Debrief with the two worked examples: Hansa Mutual's detection merged at day 11 and still unverified, and Nordvik Region's change waiting on a provider's injected test.

Discussion

Lowering an agent's level takes effect at once, while raising it needs a named authority and a re-test. Why does the chapter build that asymmetry into review?
A loop that turns every finding into a rule ends with an alert queue nobody can read. Who should decide that an older rule is retired to make room for a new one?
Nordvik Region cannot edit its provider's closure behaviour. What can a buyer of the loop do at P4 Improve, and where does its leverage end?

Exercise · 35 minutes

A reproducible finding-to-change decision

Take one finding from your own register or use FND-NR-2027-011 from Chapter 9. Following the nine steps of the practical guide, restate the finding in behaviour terms with the technique identifier and evidence reference; name the layer that failed and list the routes considered with a one-line reason for each not chosen; choose the route and split by route with an owner who is not the scenario's author; set the urgency from the three questions and a target date; state the expected alert cost, budget and shadow period; name the reviewer and record what an AI system drafted; identify the regression case with at least one variant; and set the review date. Then hand steps one to eight to another pair and compare the route they reach.

Deliverable: A finding-to-change decision record with route, owner, reviewer, cost, regression case and expiry, plus a note of the reproducibility test's result.

Self-test

A finding shows that activity was detected but the response was too slow and too wide. Which route does the chapter's table indicate?
1. Detection: rewrite the logic of the rule that fired.
2. Playbook: change the playbook manifest, runbook or decision right.
3. Control: add a preventive control in front of the service.
4. Mandate: narrow the mandate of the tester who ran the scenario.
Who must not own the detection change that answers a scenario, according to the ownership table?
1. The detection-engineering lead of the organisation.
2. The purple-team coordinator who keeps the register.
3. The tester who wrote the scenario that it answers.
4. The platform team that runs the log pipeline.
What is the status of a finding whose detection change has merged but whose regression case has not yet run?
1. Implemented, unverified, with the coverage cell still shown as failed.
2. Closed and verified, with the merge date recorded as the date of closure in the register.
3. Risk accepted, until the next scheduled run of the pipeline.
4. Deferred, with a 90-day target for the re-test.

Chapter 11 · 90 minutes

Verify: Re-test, Regression and Evidence

The lesson covers P5 Verify, the stage at which the loop closes or fails to. Participants apply the four clauses of the closure rule, design a re-test with variants of path, context and rate, a held-out variant and a negative control, keep it as a regression case that runs on change, schedule and intelligence, produce an evidence manifest that expires by clock and by condition, and report the denominator, the reasons and the age.

Learning objectives

Explain the four clauses of the closure rule and the failure each one answers.
Design a re-test with a pass criterion, an independent runner, variants and a negative control.
Draft a regression case and the fields of an evidence manifest for one finding.
Review a verification report for its denominator, its reasons for unverified techniques and its evidence ages.

Key concepts

Four clauses of closure: A finding is closed only when the re-test and its variant pass; the evidence is attached; a named person signs; and closure has an age, so that when the condition lapses the finding is unverified again.
Variants: Path variants change how the technique is carried out, context variants change where and when, and rate and shape variants change volume and timing. A held-out variant is written by someone who did not write the fix and is not shown to the fix author.
Negative control: A benign look-alike that must not alert, included in each case because a detection can pass its re-test by alerting on everything.
Regression case as ratchet: A re-test that has been kept (REG): the exact scenario, its variants and the negative control, run on change, on schedule and on intelligence. A case once added is retired only by a recorded decision when its control is retired.
Evidence manifest: The unit of proof (EVD): generated by the run and not written, content-addressed, versioned with its dependencies, signed by a nameable person and minimised. It expires by a clock and by a condition, such as a change to a dependency.

Teaching plan

15 min	The teacher presents the four clauses and the four register states: verified; implemented, unverified; failed; not tested.
15 min	Case reading of REG-NR-0004 and EVD-NR-2028-0003: the exact re-test passed on 2027-11-17, an out-of-hours variant failed on 2028-01-19 and the full case passed on 2028-02-09.
35 min	Exercise: turn one closed finding into a regression case with variants, a held-out variant, a negative control, triggers and an expiry.
15 min	Participants rewrite a one-line board statement of 74 per cent verified into a report with denominator, reasons and evidence age, using Hansa Mutual's 25 of 34.
10 min	Plenary on delegation at P5: the runner at Level 3 Bounded, never the agent that drafted the fix, and closure signed by a person.

Discussion

Under a rule that closed findings on a passing exact re-test, Nordvik Region's finding would have been closed in November 2027. What would the Region have reported to its audit committee, and what would it have missed?
A green run is itself an automation output that people learn to trust. What keeps a nightly regression suite from being read by nobody?
Evidence that never expires is not credible, the chapter says. How would you explain to a system owner that a finding closed last spring is now unverified again?

Exercise · 35 minutes

From closed finding to regression case

Choose one finding that your register, or the Nordvik Region or Hansa Mutual material, calls closed. Following the practical guide, restate the hypothesis: technique, environment and pass criterion with its time bound and layer. Record the exact scenario as the base case. Describe at least three variants for a priority technique, one of path, one of context and one of rate or shape, each at the level of technique and telemetry and never of procedure. Name who will author the held-out variant, add one negative control, and confirm for each scenario its safety class, tag, clean-up step and stop-path holders. Set the triggers, the cadence and the evidence expiry, and list the versions the evidence manifest must record.

Deliverable: A regression case record with base case, variants, held-out variant, negative control, triggers, expiry and a named closure signer.

Self-test

Why is re-running the exact scenario necessary but insufficient for closure?
1. Because the exact scenario can only be run by the original tester.
2. Because supervisors accept only re-tests that were run in a pre-production mirror and signed by the tester.
3. Because the exact scenario expires as soon as the change is merged.
4. Because a detection written from a finding tends to fit that finding and can miss a variant.
Who signs the closure of a finding at P5 Verify?
1. The re-test runner, once the full regression case and its variants have passed at Level 3 Bounded.
2. A named person in a named role; never an agent, and never the author of the fix alone.
3. The pipeline, by rule, when the evidence manifest has been hashed.
4. The contracted tester who reproduced the original finding.
Which two parts make up the expiry of evidence in the chapter?
1. A weekly alert budget for the detection and a rule to tune or retire it after two weeks over budget.
2. A denominator of priority techniques and a list of reasons.
3. A clock since the last full pass and a condition that ends it early on a dependency change.
4. A signature by the closure owner and a hash of each artefact.

Module 3 · Part III · The Loop Meets AI Systems

Part III turns the loop on AI itself. Participants apply all five stages to the organisation's own AI systems and agents, choosing scenarios by ATLAS technique against four classes of target and building detections from the agent's manifest, and then to the defenders' AI: SOC agents, playbooks, the stop path and a provider's AI, tested with seeded incidents, benign twins and an injected-test clause in the contract. They leave able to write both artefacts.

Lecture · 40 minutes

When the target and the defender are both AI systems

The lecture argues that an AI system is tested and watched as a compound system, model, tools, data and identity together, and that a passing evaluation is not a running detection. It then turns to the blue team's own AI and makes the part's second claim: a delegated level on the defending side is a standing claim that has to be earned repeatedly, against cases whose answer the agent's operators did not write, and lost quickly on failure. Nordvik Region's withdrawn page in the citizen-service index and Hansa Mutual's benign twin that lowered an agent's level carry the argument.

8 min	A second question for every AI red-teaming test A red team asks what the system can be made to do; the loop also asks whether the defence would have noticed. Four classes of target by ATLAS technique: the model and its instructions, retrieval and the index, tools and actions, data and outputs. Prevention and detection are recorded separately; a control that held but was not seen is a finding.
9 min	Telemetry and detection for agents Six sources, from the AI gateway to the identity provider, each with its blind spot; the agent's narrative is not telemetry. Detection is built from the manifest: a denied call and an allowed call outside the ceiling are separate conditions. Detections cover an agent acting beyond its mandate, not an agent steered within it.
7 min	Evaluation is not detection An evaluation speaks about a version under chosen inputs; a detection about production events nobody chose. Each decays differently and each coverage claim carries a date and an expiry. Nordvik Region's DET-NR-0011: a document in the index that the publishing register does not list.
9 min	Testing the defenders' AI Six subjects, four properties: correctness, grounding, restraint and robustness to hostile input, with restraint first where action is delegated. Emulation supplies seeds with a ground truth the agent's operators did not write, including benign twins. The level falls at once on failure and rises only by a named authority's decision after a passing re-test.
7 min	The provider's AI and the limits of testing An injected-test clause makes the Mode 0 blind spot testable without negotiating each test. Nordvik Region's first round: 14 of 15 seeds correct, one escape, and a stop that took 21 minutes against 15. A small sample can show an escape; it cannot show a small escape rate.

What the audience takes away

Watch an AI system as a compound system and state coverage per technique, per system and with an expiry.
A delegated level on the blue side is re-shown after every change of mandate, model or connector, with seeds authored by someone independent.
What a buyer cannot inspect it can still test, if the contract carries an injected-test clause, evidence duties and a stop right.

Chapter 12 · 90 minutes

Purple for AI Systems and Agents: Attacks on Models and Detections That Catch Them

The lesson applies the purple loop to the organisation's own AI systems and agents. Participants choose scenarios by ATLAS technique against four classes of target, read what each telemetry source can and cannot tell the SOC, write a detection record for an agent that exceeds its permission ceiling, carry an AI red-teaming finding to a detection and a regression case, and distinguish a passing evaluation from a running detection.

Learning objectives

Classify AI-system scenarios into the four classes of target by ATLAS technique identifier.
Compare what each telemetry source records with its blind spot, and explain why the agent's narrative is not telemetry.
Draft a detection record for an agent that exceeds its permission ceiling, with two separate conditions.
Explain the difference between an evaluation and a detection and how each decays.

Key concepts

Four classes of target: The model and its instructions (AML.T0051 LLM Prompt Injection), retrieval and the index (AML.T0070 RAG Poisoning), tools and actions (AML.T0053 AI Agent Tool Invocation), and data and outputs (AML.T0057 LLM Data Leakage).
Compound system: The unit of test and of detection: the model, the tools it can call, the data it can read and the identity it acts under. The weak link is often not the model but the control or identity around it.
Permission-ceiling breach: A call outside the agent's manifest. A call the policy point denies shows the control worked and is a detection input; an allowed call outside the ceiling is more severe. The two conditions are kept separate in the detection record.
Evaluation versus detection: An evaluation asks whether a version resists chosen cases at a gate; a detection asks whether something is happening in production that should not be and who hears of it. A passing evaluation is not a running detection.
Three families of agent detection: Tool misuse, anomalous retrieval and permission-ceiling breaches. Expected behaviour is written in the manifest, and a baseline is added only for what the manifest cannot state.

Teaching plan

15 min	The teacher presents the four classes of target and the three rules for AI-system scenarios: a test range with synthetic data or a catalogued benign form, what can be undone stated before the run, and a stop outside the system.
15 min	Groups work through the telemetry table: for each of the six sources, name one thing a detection can read and the blind spot.
35 min	Exercise: write a detection record for an agent that exceeds its permission ceiling, from a supplied or real permission manifest.
15 min	Case reading of FND-NR-2027-019 and DET-NR-0011: a withdrawn page still in the citizen-service index, and the simulation that counted minutes to the alert.
10 min	Plenary on evaluation versus detection and on the usage-mode table: why Modes 1 to 3 are detected as the person.

Discussion

Nordvik Region holds a declared, not verified, position for the supplier's scoring component. What would it take, in contract and in test, to move that position to verified?
The chapter concludes that detections cover an agent acting beyond its mandate but not an agent steered within it. What follows for how narrowly a mandate should be written?
When a team reports that its AI system has been red-teamed, which follow-up questions separate an evaluation result from a detection that works today?

Exercise · 35 minutes

A detection record for a ceiling breach

Take the permission manifest of an agent in your organisation, or the description of Hansa Mutual's claims-triage agent, whose tool calls are bound to the market of each claim. Following the practical guide, list each permitted tool, action, resource scope and budget and write one adjacent action that must be refused. Confirm which telemetry must be present: the policy log and the tool-side audit log, each with a maximum silence. Write two separate conditions, A for a policy deny under a ceiling rule and B for an allowed call outside the ceiling, with severity and routing for each, including who may revoke the agent's credentials. State the positive and negative tests, the owner, an approver who did not write the scenario, and the coverage expiry.

Deliverable: A detection record with two conditions, data sources with maximum silence, tests, routing, owner, approver and a 90-day expiry for a priority agent.

Self-test

A scenario tests whether a tool can be invoked with parameters the permission manifest does not allow. Which class of target and ATLAS technique does the chapter assign?
1. Retrieval and the index; AML.T0070 RAG Poisoning.
2. Tools and actions; AML.T0053 AI Agent Tool Invocation.
3. Data and outputs; AML.T0057 LLM Data Leakage.
4. The model and its instructions; AML.T0051 LLM Prompt Injection.
Why does the chapter say the agent's narrative is not telemetry?
1. Because the narrative is stored in a format that the SIEM cannot parse.
2. Because the narrative contains personal data that the GDPR forbids the SOC to collect or read.
3. Because the narrative is always shorter than the tool-call log.
4. Because an agent's summary of its own work is a model output that can be wrong.
What does a pass mean for a detection, in the chapter's comparison of evaluation and detection?
1. Nothing fired; the absence of an alert is not evidence of absence.
2. The version resisted every case in the suite at the release gate.
3. The model has been shown safe against the four classes of target.
4. The SOC has confirmed that no adversary is present in the estate.

Chapter 13 · 90 minutes

Testing the Defenders' AI: SOC Agents, Playbooks and Providers' AI under Emulation

The lesson uses the loop to test the blue team's own AI. Participants distinguish six subjects, triage, investigation and drafting agents, the playbook layer, the stop path and a provider's AI, and test them for correctness, grounding, restraint and robustness to hostile input with seeded incidents and benign twins derived from emulation. They write an injected-test clause for a managed-service contract and learn why a level falls at once and rises by decision.

Learning objectives

Explain the six subjects of testing and where the ground truth for each comes from.
Design a seeded-incident register with replayed telemetry, live S1 seeds, benign twins and a held-out share.
Draft an injected-test clause for a managed-service contract with rates, scoring, evidence and a stop right.
Review a finding against an agent mandate and state what happens to the agent's level.

Key concepts

Four properties under test: Correctness, where the output agrees with the ground truth; grounding, where every claim can be traced to the evidence; restraint, where the system does no more than its mandate allows; and robustness to hostile input. Restraint comes first wherever an action is delegated.
Seeded incident from emulation: A known case injected into the queue, derived from a scenario record so that the correct disposition is fixed before the run. It takes three forms: replayed telemetry, live emulation observed by the agent, and benign twins.
Benign twin: A variant that produces telemetry similar to a malicious scenario from a legitimate change, such as a rollout using a service account from new hosts. It tests whether the agent refrains from acting on a lookalike.
Injected test: A seeded incident that the customer causes to arrive in the provider's pipeline. The provider knows that tests exist, their number per class and the scoring, but not the identity, timing or content of any seed.
Level falls at once, rises by decision: A failed test lowers the agent's level for the affected action immediately. It is restored only by a named authority after a passing re-test that includes variants and the benign twin.

Teaching plan

15 min	The teacher presents the six subjects with their test questions and sources of ground truth, and the four properties measured at the level of the mandate.
15 min	Case reading: seed S-04 of EMU-HM-2028-03, where the investigation agent proposed revoking sessions on a benign twin, and the finding FND-HM-2028-001 routed to the mandate.
35 min	Exercise: write an injected-test clause and a first quarterly schedule for a managed-service contract.
15 min	Tabletop on the stop path: plan a timed drill measured by a separate observer, and discuss a stop that took 21 minutes against a target of 15.
10 min	Plenary on the limits: production cannot be harmed, a recognisable test is weaker, the agent's report is not the record, and people are not the subject.

Discussion

The chapter's own claim is that a delegated level has to be earned repeatedly. Which of your organisation's delegations to an AI system were shown once and never again?
At Hansa Mutual the agent, its tests and its tuning are all on the same platform. What makes the seeds independent in that setting, and what would erode it?
A round of fifteen seeds cannot show an escape rate of one in a thousand. How should such results be worded for an audit committee so that they are not over-read?

Exercise · 35 minutes

An injected-test clause and schedule

Write an injected-test clause for the contract with a managed provider whose AI closes alerts for your organisation, or for Nordvik Region's annex MS-2. Following the eight steps of the practical guide, list the closure classes the provider's AI may act on; set the number of seeds per class per quarter; state what the provider may and may not know; give the scoring and thresholds in numbers, including what one escape and two escapes in a class trigger; require the evidence to be returned for every seeded closure within a stated time; give the customer a stop right with a yearly out-of-hours drill; say what happens after a failure; and protect the seeds as security-sensitive. Then outline the first round: classes, seeds, scenario sources by identifier and who authors the seeds.

Deliverable: A contract clause of about one page and a first-round schedule from which a reader can say, per class, how many seeds were injected and how they are scored.

Self-test

Who authors the seeds used to test an agent, according to the chapter's rules for keeping seeds honest?
1. The platform team that operates and tunes the agent under test, since it knows the agent's weak points best.
2. The agent itself, from its own record of earlier cases.
3. A party who does not tune the agent under test, with a share the operators have not seen.
4. The managed provider whose AI is being tested in the round.
An agent holding Level 3 Bounded for an action fails a seeded test on that action. What does the chapter prescribe?
1. The level falls to Level 2 at once and is restored by a named authority after a passing re-test.
2. The level stays at Level 3 Bounded until the group AI governance board has met for its next quarterly review.
3. The agent is retired and its mandate is permanently withdrawn.
4. The seed is rewritten so that the agent can be re-tested immediately.
What may the provider know about injected tests under the clause the chapter describes?
1. The identity and timing of each seed in advance, so that its analysts on shift are not disturbed.
2. Nothing at all, because any knowledge would invalidate the test.
3. The content of each seed after the round, for training its AI.
4. That tests exist, the number per class and the scoring, but not which alerts or when.

Module 4 · Part IV · The Loop's Own AI

Part IV treats the AI that the loop itself uses. Participants design a team of narrow agents with mandate manifests, permission ceilings, budgets and a drilled stop; apply the independence principle where AI sits on both sides of a check, with held-out scenarios, seeded gaps and reproduction by a person; and protect the findings register, the scenario library and the emulation agents as tier-0 assets. They leave with a mandate manifest, an independence statement and a classification policy.

Lecture · 50 minutes

Can machines close the loop? Mandates, independence and the tier-0 set

The lecture carries the central design argument of the book. A team of agents can run much of the loop, but only if each agent is narrow, bounded by a mandate that a policy decision point enforces, and stoppable from outside. Even then, a chain in which the scenario, the detection and the verdict share a model family, data, an author, a vendor or a moment in time may only agree with itself. The lecture shows how independence is declared, tested and dated, why a person must be able to reproduce a result, and why the records the loop produces are an adversary's best map of the estate.

10 min	A team of narrow agents Eight candidate functions; the runner executes a catalogue and does not compose, the triager ranks and does not close, the critic flags and never gates. Four questions set every ceiling: reversibility, scope, personal data or a named person, and independence of the check. Only the runner and the re-test runner reach Level 3 Bounded, and only for catalogued S1 scenarios.
8 min	The mandate as code Identity of its own, tokens issued outside the agent, a catalogue binding, budgets and circuit breakers. A never list closes the routes by which an agent could change its own governance; a separation list implements independence. Authorisation, the stop, closure and the authorship of novelty are not delegated at any level.
12 min	Correlated failure and the five kinds of independence What the research measured, and the inference to the loop that is the book's own. Model, data, authorship, vendor and time: each with a shared dependency, a control and a piece of evidence. A kind that is not shown is treated as shared; leakage of scenarios into detections needs no model at all.
10 min	Proofs: held-out scenarios, seeded gaps, reproduction The open-versus-held-out gap measures whether detections generalise. A seeded gap tests whether the loop finds a hole a person made. Hansa Mutual's statement: seven of 25 cells assessed, two failed, five verified with limited independence, eighteen not assessed. The verdict: machines alone can show the known still works, not that coverage is real.
10 min	The loop's records as tier 0 The findings register is a prioritised list of open doors; the scenario library's complement is the list of what is not tested. Handling classes FC-1 to FC-4, a register of record in its own store, and access policy enforced as code. The emulation agent is a privileged insider with no standing access to open findings.

What the audience takes away

Delegate functions, not the loop: every agent has a named owner, a ceiling enforced outside it and a stop it takes no part in.
Independence is designed, declared, tested and dated; the quarterly independence statement carries it to a board or supervisor.
Protect the loop's own records against theft and tampering, because coverage claims rest on them.

Chapter 14 · 90 minutes

An AI Agent Team for the Loop: Skills, Mandates and Containment

The lesson designs the loop's own AI as a team of up to eight narrow functions: scenario curator, emulation planner, emulation runner, observation correlator, detection drafter, finding triager, re-test runner and critic. Participants set the level per function with four questions, write a mandate manifest with a permission ceiling, identity, budgets, circuit breakers, a never list and a separation list, and decide what stays with people.

Learning objectives

Classify the eight candidate functions by stage, side, what they read and what they write or do.
Explain the four questions that set a ceiling and why only the two runners reach Level 3 Bounded.
Draft a mandate manifest for an emulation runner that a policy decision point can enforce.
Compare the delegation profiles of Nordvik Region and Hansa Mutual and the reasons behind each.

Key concepts

Eight candidate functions: Scenario curator, emulation planner, emulation runner, observation correlator, detection drafter, finding triager, re-test runner and critic. They are functions and not products; several may run in one system as long as the separations hold.
Mandate manifest: The written mandate for one agent (MND), in version control: named owner, operators and authority, the rules-of-engagement reference, the catalogue binding, the level per action class, identity, budgets, circuit breakers, a never list, a separation list, review and expiry.
Critic: A function on a second model family at Level 0 Advisory that challenges the planner's choices, the correlator's outcomes and the drafter's detections. It reads outputs, never working stores, and it flags and questions but never gates.
Budgets and circuit breakers: Ceilings an agent cannot argue with: actions, targets, time and cost per run or period. Circuit breakers stop the run on conditions such as an action outside the permission ceiling, contact with an out-of-scope asset or real personal data in a result.
Pause, revoke, undo: The three forms of stop: the policy decision point stops admitting steps; the identity provider and egress gateway end the agent's credentials and routes from outside the runner; and the clean-up manifests are executed and confirmed.

Teaching plan

15 min	The teacher explains why the loop's team differs from a SOC team: one agent executes emulation, the team sits on both sides, and three groups answer for it.
15 min	Participants place the eight functions on the five stages and assign a level to each using the four questions, then compare with Hansa Mutual's profile.
35 min	Exercise: write a mandate manifest for an emulation runner, including the never list, the separation list and the ceiling tests.
15 min	Pairs review each other's manifests: what can this agent reach whatever instructions it receives, and which dependencies does it share with another agent?
10 min	Plenary on what stays with people and on the practitioner's own use of AI in Modes 1 to 3, declared in the record.

Discussion

Nordvik Region delegates only the critic and the correlator and buys no runner. What would have to change, in capacity and in contract, before a Mode 5 runner made sense for it?
The triager ranks and routes but does not close. What damage could a triager do without ever exceeding that mandate, and how would you see it?
A team of eight functions invites one model gateway, one secret store and one log store. Which shared components in your own tooling would make two controls fail together?

Exercise · 35 minutes

A mandate manifest for an emulation runner

Following the ten steps of the practical guide, write a mandate manifest for an emulation runner in your own organisation or for Hansa Mutual's runner. Start from a signed rules-of-engagement manifest and make the mandate no wider. Name one owner, at least two operators, the authority that grants the level and the stop holders. Bind the catalogue, starting with S1 only, read-only to the agent. Set the level per action class. Give the agent a workload identity, test accounts only and short-lived tokens issued outside its runtime. Set budgets for actions, targets, runs and minutes. Write the circuit breakers, the never list and the separation list. Set review and expiry, and list the three planted conditions the policy decision point must refuse before the first run.

Deliverable: A mandate manifest of one to two pages with named people, ceilings, budgets, circuit breakers, never and separation lists, and three ceiling tests.

Self-test

Which functions reach Level 3 Bounded in Hansa Mutual's delegation profile, and for what?
1. The curator and the planner, for proposing scenarios from intelligence.
2. The correlator and the triager, for classifying and routing findings.
3. The emulation runner and the re-test runner, for catalogued S1 scenarios inside the signed scope.
4. The detection drafter and the critic, for merging reviewed detections into the production repository without a person.
What does the chapter say the critic may do?
1. Flag and question the outputs of other functions, on a second model family, without gating.
2. Approve or reject detections before they are merged to production.
3. Read the working stores of the other agents on the same model family in order to find their hidden errors.
4. Stop the emulation runner when its outcome looks implausible.
Which of the following is delegated to no agent at any level, according to the chapter?
1. Assembling and hashing the evidence manifest after a codified S1 regression case has been run.
2. Drafting a detection as a pull request for review.
3. Proposing the owner and priority of a new finding.
4. Authorisation, the stop, the closure of a finding and the authorship of novelty.

Chapter 15 · 105 minutes

Independence: Verifying the Loop When AI Is on Both Sides

The lesson develops the independence principle: a check counts as verification only when its failure modes are shown not to be those of the thing it checks. Participants analyse correlated failure, separate the five kinds of independence, use held-out scenarios, seeded gaps, layering against test-aware behaviour and reproduction by a person, write a quarterly independence statement, and work through the debate on whether a loop can be closed by machines alone.

Learning objectives

Explain correlated failure and how it inflates a coverage record, separating what the research measured from the book's inference.
Classify the dependencies of a chain of tester, tested and checker into the five kinds of independence.
Draft a one-page independence statement for a coverage claim, with controls, evidence, residual risk and expiry.
Review the debate between concern and calm and state the chapter's verdict.

Key concepts

Correlated failure: The case where tester and tested share a model family, training data, authors, vendor or time, so that their errors coincide and a passing result shows agreement and not verification. The inference from the cited research to the loop is the book's own.
Five kinds of independence: Model, data, authorship, vendor and time, each with a shared dependency, what it hides, a control and what is shown. The kinds are not ranked, and a kind that is not shown is treated as shared.
Held-out scenario: A scenario written by a person, kept where the detection side and its agents cannot read it, and run only after the detections are built. The gap between open and held-out pass rates measures generalisation, and the set is where human-authored novelty enters.
Seeded gap: A known weakness introduced on purpose, by a person, under the signed rules of engagement and in a place where it can be undone, to test whether the loop that is meant to find gaps finds this one, how fast and by what.
Independence statement: A one-page, signed record per coverage claim: the claim, the chain, the shared dependencies, the controls and their evidence, the residual risk in words, the evidence age and an expiry, by default 90 days for priority techniques.

Teaching plan

15 min	The teacher walks one chain, planner, runner, drafter and re-test runner, and asks where its members could be wrong in the same way.
15 min	Groups fill in the five-kinds table for Hansa Mutual's chain, where the planner and the detection drafter share a vendor and a family, and for Nordvik Region's provider and tester.
30 min	Exercise: run an independence review of one coverage claim and write the statement.
30 min	Structured debate in four steps on whether a loop can be closed by machines alone: concern, calm, where the positions meet, what can be done.
15 min	The teacher gives the verdict and the participants test their own statement against the ten-question checklist for supervisors and boards.

Discussion

The chapter says Nordvik Region's independence is by contract and cheap to show, while Hansa Mutual's is by design and cheap to lose. What does cheap to lose look like in day-to-day engineering?
Simulation markers protect against mistaking an incident for an exercise, yet a marker visible to an agent under test weakens the test. How would you resolve that tension in your own design?
If independence checks catch nothing over a long period, either the loop is sound or the checks are too weak. How could you tell which?

Exercise · 30 minutes

An independence statement for one claim

Choose one coverage claim that your board relies on, or use Hansa Mutual's seven verified priority techniques whose scenario and detection shared a chain. Following the practical guide, name who or what wrote the scenario, wrote the detection and judged the result. For each agent in the chain record the model family, provider, platform and retrieval corpus, or write not declared. Mark each of the five kinds as shared, separated by control or not shown. For each shared dependency name the control you would apply. State which results a person must reproduce, including a 10 per cent sample of other re-test passes. Write the statement on one page and say whether the claim is verified, verified with limited independence or downgraded.

Deliverable: A one-page independence statement with chain, five kinds, controls, residual risk, evidence age, expiry and a named signatory.

Self-test

Which control does the chapter pair with a shared model family between tester and tested?
1. A re-test run immediately after the fix, on the fix author's own data and by the fix author's agent.
2. A critique agent on a second model family, used for questions and not verdicts.
3. A longer retention period for the exercise telemetry.
4. A higher autonomy level for the re-test runner.
What is the chapter's verdict on a loop closed by machines alone?
1. It is unsafe in every respect and regression should return to people.
2. It is sufficient once two different model families are in use.
3. It verifies coverage for as long as the pass rate on the open scenario library stays above 90 per cent.
4. It can show that the known still works, and cannot by itself show that its coverage is real.
Hansa Mutual's statement IND-HM-2028-Q1 assessed seven of 25 verified cells. How does the chapter say the board figure of 25 should then be read?
1. As seven cells failed or at limited independence, and eighteen not yet assessed.
2. As 25 verified cells, since the statement found no failures at all.
3. As seven verified cells, because the other eighteen are now unverified.
4. As 18 verified cells, with the seven assessed cells removed from the board figure until the next review.

Chapter 16 · 90 minutes

Defending the Loop's AI: Scenario Libraries, Findings and Emulation Agents as Tier 0

The lesson treats the loop's own assets as tier 0: the findings register, the scenario library, emulation plans, coverage records and agent credentials. Participants classify findings into handling classes FC-1 to FC-4, segregate a register of record with access policy as code, apply the five controls to the emulation agent as a privileged insider, secure the supply chain of scenarios, decide what may reach an AI tool, and design detections of misuse.

Learning objectives

Explain why the loop's records are valuable to an adversary and to whom each asset is legitimately needed.
Classify findings into the handling classes FC-1 to FC-4 by what their content would let a reader do.
Draft a classification and access policy for a findings register of record, including agents and hosted models.
Design detections of misuse of the loop's assets and the evidence that the protection works.

Key concepts

Tier-0 set of the loop: The findings register, the scenario library, emulation plans and rules of engagement, coverage records, and agent credentials, mandates and connectors. Together they are an adversary's best map of the estate and the records on which coverage claims rest.
Handling classes FC-1 to FC-4: FC-1 Aggregate: counts and trends with no asset named. FC-2 Redacted: technique, severity, owner and status. FC-3 Restricted: asset-specific detail of an open finding. FC-4 Exploitable: anything that would shorten an adversary's work, such as unreleased gap lists.
Register of record: The authoritative findings store, in its own store with its own identity group: append-only writes with an attributed change log, access policy enforced at a policy decision point, references in place of copies elsewhere, and second-person approval for exports.
Emulation agent as privileged insider: An agent that holds working credentials and tooling inside the estate. Five controls sit outside it: identity of its own, task-scoped credentials issued outside the runtime, default-deny egress and a separate range, no standing access to open findings, and an external stop path.
Deterministic redaction gateway: A rule-based gateway that replaces assets and accounts before a call to a model. FC-4 never goes to a model, FC-3 only to a model in the organisation's own environment, and a model asked to remove asset names has already seen them.

Teaching plan

15 min	The teacher presents the asset table and the point that the sensitivity of an asset is not the sensitivity of its individual records.
15 min	Participants classify twelve short finding descriptions into FC-1 to FC-4 and say who the default audience is for each.
35 min	Exercise: inventory where findings live today and write a classification and access policy for a register of record.
15 min	Groups design two detections of misuse from the chapter's table, by technique identifier, telemetry and response, and name a decoy for each.
10 min	Plenary on findings in AI tools and on insider scenarios handled by separation of duties and attributable records, not covert monitoring.

Discussion

At Nordvik Region the working copy of exercise findings lived in the managed provider's ticket system. Where do the findings of your last test live today, and how many people can read them?
The access review is the control that lapses first when a small team is busy. How do you design a control so that its lapse is visible?
The chapter handles insider risk by separation of duties and attributable records rather than by covert monitoring. What does that choice protect, for staff and for the loop?

Exercise · 35 minutes

Classifying and segregating a findings register

Following the practical guide, inventory every place a finding lives in your organisation today, or in Nordvik Region as the chapter describes it: tickets, mail folders, tester portals, shared drives, chat channels, slide decks and backups, with a count of people who have access. Choose a register of record and its identity group. Adopt the four handling classes and write the default audience of each. Write the access policy as a short structured text: roles and what each may read and write, each loop agent by name with its reads and writes, what hosted models may receive, the export rule for FC-3 and above, the access review cadence and when a tester's access expires. List three tests that would evidence the policy.

Deliverable: An inventory of finding locations and a one-page classification and access policy with roles, agents, hosted-model rule, review cadence and three evidence tests.

Self-test

Into which handling class does the list of priority techniques with no passing test fall?
1. FC-4 Exploitable, for a named handful of people with a second person for any export.
2. FC-1 Aggregate, because it is a summary for the board.
3. FC-2 Redacted, because it names only technique identifiers and severities and not the affected assets.
4. FC-3 Restricted, because it concerns open findings only.
What access does the emulation runner have to the findings register in the chapter's design?
1. Read access to the FC-3 findings for the systems in its signed scope, so that it can choose its next scenario.
2. Full read access, so that it can avoid re-testing closed findings.
3. No read of the register; it appends results and cannot delete, reclassify or export.
4. Write access to change a finding's classification after a run.
Why must redaction happen deterministically before a finding is sent to a model?
1. Because models cannot process structured finding records.
2. Because a model asked to remove asset names has already seen them.
3. Because supervisors require redaction to be done by a person.
4. Because redaction by rule is cheaper than a model call.

Module 5 · Part V · The Loop in the Organisation

Part V puts the loop into the organisation. Participants replace a technique heat map with coverage records that carry age and expiry, design a board page that activity cannot improve, choose an operating model per stage with role charters and exit criteria, assign ten decision rights and test them in a tabletop, map legal obligations to controls and evidence, and write the consent, notice, sharing and disclosure protocols for a loop that crosses organisational boundaries.

Lecture · 60 minutes

Covered, measured, decided: the loop as an organisational claim

The lecture argues that the organisation's hardest questions about the loop are questions about claims and rights, not tools. Covered is a claim with five parts and a status computed by rule. Measures are safe only when running more scenarios cannot improve them. Whoever runs the stages, the coordinator, the closure owner, the white team, the register of record and the right to stop remain with the organisation. Ten decisions need named holders and times, the law turns into fields in a manifest and clauses in a contract, and every boundary the loop crosses needs consent, notice and a stop on both sides.

10 min	Covered is a claim with an age Five parts: a technique, an environment, a result at a named layer, a date and an expiry. Six statuses computed by rule; only verified counts as covered and a person declares. Hansa Mutual's conversion: four cells that were green on the heat map had evidence past its expiry.
10 min	Measures that activity cannot improve Six measures against four that mislead: scenarios run, findings opened, findings closed and a green percentage. Goodhart's law in four mechanisms, and why AI makes the adversarial form faster. Measures of the system, never of a named person; the catalogue is agreed with representatives before collection.
10 min	Who runs the loop and what must stay In-house, contracted, hybrid and sovereign or sector models, chosen per stage with exit criteria. Seven chartered roles; an AI system does not hold a role. Nobody marks their own work; a small team compensates with countersignature, sampling and a contract.
10 min	Ten decisions and the white team D1 to D10 with a holder, a deputy, a time, an evidence standard and a record. Stop needs no approval and runs outside the system stopped; restart is a separate decision at a lower level. No alert is closed as an exercise without a match in the tag ledger.
10 min	Regulation as a design constraint DORA Articles 24 to 27, NIS 2 Articles 20, 21 and 23, the AI Act, the Cyber Resilience Act, the GDPR and co-determination. Continuous emulation is not a threat-led test, and a hold list protects the test's secrecy. The owner's written authorisation separates an exercise from an offence.
10 min	Across boundaries Through a provider's pipeline, through its response chain, and never against its platform. Share the technique and the expected evidence, never the target mapping. Supervisors receive the records in a fitting form; the gap list is inspected and not copied.

What the audience takes away

Report the denominator, the reasons and the age; retire the heat map for reporting.
Buy capacity and a different view, and keep the coordinator, the closure owner, the white team, the register and the stop.
Write authority, consent, legal basis and notice into the manifest, and test the decision rights before the night they are needed.

Chapter 17 · 90 minutes

Coverage as a Claim: Technique Maps, Evidence Age and Detection Decay

The lesson examines the word covered. Participants learn that a coverage claim has five parts, a technique, an environment, a result at a named layer, a date and an expiry, and that a heat map with no age is not a coverage statement. They build coverage records whose status is computed by rule into six values, handle decay, environments and variants, keep not tested honest, and report by denominator, reason and age.

Learning objectives

Explain the five parts of a coverage claim and the three recurring failures of a heat map.
Classify coverage records into the six statuses and say which counts as covered.
Draft coverage records with expiry, environment, independence and declaration fields for a priority list.
Review a coverage page for its denominator, reasons, age distribution and honest not tested lines.

Key concepts

Coverage claim: A statement that a specified technique was exercised in a specified environment inside a window of time, with a result at a named layer, a date and an expiry. A claim that lacks one of the five parts is not a coverage statement.
Six statuses: Verified, expired, implemented-unverified, failed, asserted and untested. The status is derived by a deterministic rule from the evidence; a person does not edit it, and only verified counts as covered.
Tested versus asserted: A test is an exercise the organisation or an independent party ran and whose result it holds. An assertion is a statement by a provider, vendor or owner. An assertion repeated in four documents is still one assertion.
Decay: The process by which a detection that worked when tested stops describing the estate, through change in the estate or in the adversary and the variant. The record guards against it with a clock and with conditions that end the evidence early.
Declaration: The act of a named person who declares a technique covered, with a date. The field is empty unless the status is verified; AI compiles and proposes, the rule decides the status, and a person declares.

Teaching plan

15 min	The teacher shows a green heat map and asks what each cell proves, then names the three failures: it rewards the last pass, hides the denominator and merges unlike things.
15 min	Participants apply the status rule by hand to ten short record descriptions, first match wins, and compare the result with the colours of the map.
35 min	Exercise: convert a heat map for a priority list into coverage records and a coverage page.
15 min	Reading of Nordvik Region's page of 2028-04-26: nine techniques in three states, and of Hansa Mutual's conversion that reproduced 25 of 34 and showed what the colours hid.
10 min	Plenary on reporting to three readers and on why the pipeline's 31 of 34 techniques exercised within 30 days is activity and not coverage.

Discussion

The most valuable line on a coverage page is the one that says not tested, because it is the hardest to write. What makes it hard in your organisation?
Nordvik Region's risk is a page that is accurate on the day and not refreshed; Hansa Mutual's is a page refreshed so often that nobody reads its age. Which guard fits which risk?
A risk-accepted finding keeps its technique at failed. What would a board conclude wrongly if accepted gaps were shown as covered?

Exercise · 35 minutes

From heat map to coverage records

Take a technique heat map from your own organisation, or the nine priority techniques of Nordvik Region's benefits-triage service. Following the practical guide, create one record per technique and environment. For each green cell look for the evidence: the scenario, the last run, the result at a named layer and the manifest; where none can be linked, mark the cell asserted or untested. Set the clock, 90 days for priority techniques and 180 for the rest or your own figures, and list the conditions that end the evidence early. Apply the status rule in order and write the coverage page: verified out of all priority techniques, the others by reason, the age distribution, and the oldest unexpired and oldest expired claims.

Deliverable: A set of coverage records with computed statuses and a one-page coverage page with denominator, reasons, age distribution and a named declarer.

Self-test

A provider states in its runbook that it handles a priority technique, and the organisation has run no test. Which coverage status applies?
1. Verified, because the provider is contractually responsible.
2. Expired, because the statement has no date of its own.
3. Implemented-unverified, because a control exists somewhere.
4. Asserted, which does not count as covered.
Who sets the status of a coverage record, according to the chapter?
1. The coverage owner, after reviewing the last evidence manifest.
2. A deterministic rule applied to the records; nobody sets it by hand.
3. The coverage agent, which judges the strength of the evidence.
4. The board, when it approves the quarterly coverage page.
What did Hansa Mutual's conversion of its 34-technique heat map show that the colours had hidden?
1. Four cells were green although their evidence was past its expiry, because the map had no age.
2. Nine cells were green although no scenario had ever been written for those techniques in the library.
3. All 34 cells were green because the pipeline ran each technique monthly.
4. Two cells were red although the detections had passed every re-test.

Chapter 18 · 90 minutes

Measuring the Loop: Cycle Time, Yield, Re-test Pass Rate and the Metrics That Mislead

The lesson asks what the loop should report about itself. Participants learn six measures that running more scenarios cannot improve, four common measures that mislead when they become targets, the four mechanisms of Goodhart's law as they apply to the loop, AI-specific measures, and the rules that keep every measure at the grain of the system and never of a named person. They design a board page with gaming checks.

Learning objectives

Compare the six recommended measures with the four that reward activity, giving the replacement for each.
Explain the four Goodhart mechanisms with an example from the loop for each.
Draft measure catalogue entries with definition, denominator, grain and gaming check.
Design a board page of four to six measures that respects the aggregation rules agreed with employee representatives.

Key concepts

Six measures of the loop: Finding-to-control cycle time, finding half-life, re-test pass rate at first attempt with held-out variants, verified share within expiry, yield per exercise and detection debt. Each has a denominator and cannot be improved by running more scenarios.
Measures that mislead: Scenarios run, findings opened, findings closed and a green percentage. They are useful as operational data on cost and load but reward activity when they become targets or headline figures.
Goodhart mechanisms: Regressional, extremal, causal and adversarial, after Manheim and Garrabrant. AI sharpens the adversarial case: a drafter rewarded for passing scenarios produces detections that pass scenarios.
Yield per exercise: Findings per exercise that no catalogued run could have produced, and how many reach verified control within 90 days. It is the only one of the six that measures what the people on the red side add.
Grain and minimum group size: Every measure is computed per technique, scenario, class, service or team, never per named person. A role held by one person is that person. Hansa Mutual's floor is five people; Nordvik Region reports the unit of six as a whole.

Teaching plan

15 min	The teacher presents the six measures with their stages and denominators, then the four misleading measures and how each is gamed.
15 min	Groups take one Goodhart mechanism each and present how it would appear in a loop with a detection drafter and a pipeline.
35 min	Exercise: design a board page for the loop with catalogue entries, gaming checks and a decisions block.
15 min	Reading of the two pages LPG-HM-2028-Q1 and LPG-NR-2028-Q1, including Nordvik Region's cycle times of 112 and 21 days reported as individual values.
10 min	Plenary on the works-council constraints and the price they carry: aggregate measures cannot tell a manager which person needs support.

Discussion

Nordvik Region's first closure after 28 days would have been the headline; the verified closure took 112 days. Which of your own headline figures would change if only verified closure counted?
The chapter states the price of aggregation openly. How should a manager find out who needs support without turning the loop's records into a ranking?
Step nine of the guide doubles the scenarios run in a test quarter to see whether any figure moves. What would that test do to your present dashboard?

Exercise · 35 minutes

A board page that activity cannot improve

Design a board page for the loop of your own organisation or of Hansa Mutual. Start from the six measures of the chapter and the decisions a board can take: fund work, extend or hold a delegation, accept a named gap until a date. Choose four to six measures and write a catalogue entry for each: definition, source records, denominator, grain, gaming check and the count shown beside the figure. Attach the age to each coverage figure, including the techniques that expire within 30 days. Put the first-attempt re-test pass rate beside the pass rate on held-out variants. State the grain allowed and forbidden, the minimum group size and that no result enters an appraisal. Limit the decisions block to three, each traced to a measure.

Deliverable: A one-page board page layout with four to six measures, a catalogue entry per measure and a decisions block of at most three.

Self-test

Which measure does the chapter recommend in place of findings closed?
1. Scenarios run per quarter, with the share above S1.
2. The green percentage over the whole scenario library.
3. Finding half-life, with the recurrence rate beside it.
4. Findings opened per exercise by the red side.
At what grain may a measure of the loop be computed under the chapter's rules?
1. Per technique, scenario, class, service or team, never per named person.
2. Per analyst, provided the figures are shown only to the CISO.
3. Per shift, so that out-of-hours performance can be compared.
4. Per role holder, including roles that are held by one person.
Which Goodhart mechanism is at work when a detection drafter rewarded for passing scenarios produces detections that pass scenarios?
1. Regressional.
2. Extremal.
3. Causal.
4. Adversarial.

Chapter 19 · 90 minutes

Operating Models and Team Design: In-House, Contracted, Hybrid and Sovereign Loops

The lesson asks who runs the loop. Participants compare four operating models, in-house, contracted, hybrid and sovereign or sector, decide the model per stage with a decision record and exit criteria, charter the seven roles of the loop, apply independence between roles even in a team of six, and learn what procurement must secure: ownership of scenarios and findings, declared AI, return of data and the right to stop and leave.

Learning objectives

Compare the four operating models by who runs each stage, what is bought and what is left exposed.
Draft an operating-model decision per stage with exit criteria stated as numbers.
Draft a role charter with mandate, decision rights, prohibitions and the agents under the role.
Review a small team's role assignments against the forbidden pairs and name the compensation for each unavoidable pair.

Key concepts

Four operating models: In-house, contracted, hybrid and sovereign or sector. An operating model answers per stage who does the work, who is accountable and where the records live, and an organisation usually runs a mixture.
What must stay: Whatever the model, the organisation keeps the coordinator, the closure owner, the white team, the register of record and the right to stop. The model buys capacity and a different view.
Role charter: A versioned ROLE artefact with a holder and deputy, the mandate, accountabilities, decision rights, prohibitions and the agents under the role. An AI system does not hold a role; a person holds it and answers for what agents do under it.
Forbidden pairs: Pairs of roles or acts that the same person must not hold, such as authoring a scenario and the detection it tests, or authoring a change and closing its finding. Where unavoidable, the compensation is countersignature, sampling, a held-out scenario or a contract clause.
Viable minimum loop: A loop in which the five stages exist, each stage has an owner and a deputy, and the forbidden pairs are kept apart by contract, countersignature or sampling. Nordvik Region's uses two own people, two counterparties, two borrowed people and sampling by internal audit.

Teaching plan

15 min	The teacher presents the four models with Hansa Mutual as in-house and Nordvik Region as contracted, and notes that hybrid and sector are argued from the instruments.
15 min	Participants map who runs each of the five stages in their organisation today, including a provider's AI that acts only in practice.
35 min	Exercise: write an operating-model decision with exit criteria and one role charter for the purple team coordinator or exercise controller.
15 min	Groups test a six-person team against the table of forbidden pairs and assign compensations, using Karin Lund's hats as the case.
10 min	Plenary on procurement: the four terms that should appear in every purchase of the loop and what a supplier's refusal tells the buyer.

Discussion

The coordinator can escalate a stale finding without approval and cannot close one. Why does the charter grant the first right and refuse the second?
Nordvik Region's loop rests on five people, none full time, and two counterparties. Where is its single point of failure, and what would you do about it first?
The chapter says buying the loop is buying a right to learn from a result and not only a service. Which clauses in your current testing contracts secure that right?

Exercise · 35 minutes

Operating-model decision and a role charter

For your own organisation or Nordvik Region, list the five stages and the party that runs each today. Mark what must stay with the organisation. Score your preferred model per stage on whether it can show evidence within expiry, whether its independence can be shown, and whether the organisation could exit. Write the decision as a short record with an owner, a review date within twelve months and exit criteria as numbers, and test the exit on paper: what moves, to whom, in how many working days. Then write a role charter for the purple team coordinator: holder and deputy, mandate, accountabilities, decision rights, what the role may never do, and the agents under it.

Deliverable: A per-stage operating-model decision with numeric exit criteria and a one-page role charter with decision rights and prohibitions.

Self-test

Which exposure does the chapter attach to the in-house operating model?
1. A loop that starts only when the contract renews.
2. Overfitting to one's own habits, and a loop that nobody outside questions.
3. Dependency on a shared sector platform that the organisation neither operates nor controls on its own.
4. Two sets of records that disagree at a seam.
A small team cannot avoid one person authoring the P4 change and also closing the finding at P5. What compensation does the chapter give?
1. None is accepted; the organisation must hire a second analyst.
2. The purple team coordinator closes all findings in that person's place.
3. Countersignature by a named second person and a sample by internal audit.
4. The contracted tester signs the closure on the organisation's behalf.
What does the chapter say about an AI system and a role?
1. An AI system does not hold a role; a person holds it and answers for the agents under it.
2. An AI system may hold the coordinator role at Level 1 Assisted.
3. An AI system may hold a role if its mandate manifest names an operator, an owner and a stop holder.
4. An AI system may hold the closure owner role for S1 regression cases.

Chapter 20 · 105 minutes

Decision Rights, Authorisation and the White Team

The lesson assigns the decisions of the loop. Participants work with ten decisions, D1 to D10, each with a holder, a deputy, a time, an evidence standard and a record; examine what an authorisation covers; position the white team and the trusted agent; separate the right to stop from the decision to restart; route risk acceptance by tier with an expiry; and rehearse a real incident during an exercise in a tabletop.

Learning objectives

Explain the ten decisions of the loop and the four rules that govern the decision-rights file.
Draft a decision-rights file with holders, deputies, times and records, checking the forbidden pairs.
Classify residual findings into the three acceptance tiers and name who may not accept.
Run a tabletop with injects for an exercise that becomes an incident and a real incident behind an exercise.

Key concepts

Ten decisions D1 to D10: Authorise an exercise; change scope during a window; approve a run above S1; stop; restart; declare an event real or pause for deconfliction; raise a delegation level; accept a residual finding; declare a finding closed and verified; declare a technique covered.
Decision-rights file: The DRF record: the table of decisions in machine-readable form with the white team, the stop holders and the acceptance tiers. It is versioned, changed by pull request, approved by the management body and tested in a tabletop.
Stop and restart: Any named stop holder may stop without approval or justification, through a route outside the exercise platform. Restart is not the mirror of stop: it needs the white-team lead and the system owner, after review, at a lower level.
Acceptance tiers: Tier 1, low or medium severity and not a priority technique, accepted by the head of the owning function for up to 180 days; tier 2, high severity or any priority technique, by the CISO for 90 days; tier 3, critical or beyond appetite, by the management body.
Tag ledger: The record that links tagged emulation actions to the exercise. No alert is closed as an exercise without a match in the ledger, and it must be readable by the incident commander, the trusted agent and the provider's shift lead without going through the tester.

Teaching plan

15 min	The teacher presents the ten decisions and the four rules: lowest tier with evidence decides, every right has a time, authority and execution are separate, and the file is data.
15 min	Short input on authorisation, the white team, stopping and the acceptance tiers, with the worked risk acceptance for T1098.001 at Hansa Mutual.
25 min	Groups draft a decision-rights file for their organisation or adapt Nordvik Region's, naming holder, deputy, second deputy and time for each decision.
35 min	Exercise: tabletop with four injects against the drafted file, timed and recorded.
15 min	Debrief: each inject over target becomes a finding; compare with Nordvik Region's tabletop, where the ledger lookup took 22 minutes against 15 and revocation 190 seconds against 120.

Discussion

The right to stop is never routed upwards and needs no justification. What does an organisation risk by granting it so freely, and what does it risk by not doing so?
An adversary who knows an exercise is running may rely on the defender to dismiss what it sees. How does the tag-ledger rule change the incentives of an analyst at two in the morning?
Karin Lund keeps Nordvik Region's file but is excluded from authorisation, restart and acceptance. What does that exclusion protect?

Exercise · 35 minutes

Tabletop: an exercise that becomes an incident

Using the decision-rights file your group drafted, run a tabletop with a facilitator who holds none of the decisions. Play four injects in order: an alert with no match in the tag ledger; a tagged emulation with a real effect, such as a locked staff account; a holder who cannot be reached for a scope change; and a request to continue with the next scenario after a stop. For each inject, name the decision that applies, who holds it, the route used and the evidence relied on, and record the target time and the time your group actually needed. Anything over target is written as a finding with an owner, and the file is amended.

Deliverable: A tabletop record with target and actual time per inject, the gaps found, and the amendments proposed to the decision-rights file.

Self-test

Who may accept a high-severity finding or a finding on a priority technique, and for how long at most?
1. The CISO, at tier 2, for at most 90 days.
2. The head of the owning function, at tier 1, for at most 180 days.
3. The closure owner for the class, for at most 30 days.
4. The contracted tester, until the next catalogue run.
How does the chapter describe the decision to restart after a stop?
1. Any stop holder may restart the exercise once the emulating system reports that its clean-up is complete.
2. Restart is automatic when the abort condition is no longer measured.
3. The red-team lead restarts at the same level after informing the white team.
4. It needs the white-team lead and the system owner, after review, and resumes at a lower level.
What rule catches a real incident hidden behind an exercise?
1. Every alert raised during an exercise window is closed as an exercise by default and reviewed after the window.
2. No alert is closed as an exercise without a tag-ledger match, and a failed match freezes it.
3. The tester confirms by telephone that each alert belongs to the plan.
4. The blue team is told the plan in advance so that it can filter alerts.

Chapter 21 · 90 minutes

Regulation as Constraint: DORA, TIBER-EU, NIS 2, the AI Act, the GDPR and Employee Rights

The lesson reads the legal frame of the loop as design constraints, not legal advice: DORA and threat-led penetration testing, TIBER-EU, NIS 2, the AI Act, the Cyber Resilience Act, the GDPR for exercise data, staff co-determination and criminal law. Participants learn why continuous emulation is not a threat-led test, why the owner's authorisation separates an exercise from an offence, and how to map each obligation to a control, an evidence artefact and an owner.

Learning objectives

Explain which regime applies to Nordvik Region and to Hansa Mutual and why the difference matters.
Compare a threat-led penetration test under DORA with continuous emulation and explain how the two are kept apart.
Classify obligations from the instruments by the stage of the loop they constrain.
Draft obligation register entries that map an article to a control, an evidence artefact with an age, an owner and a review date.

Key concepts

Threat-led penetration testing: Under DORA Article 26, entities the competent authorities identify carry out TLPT at least every three years on live production systems, by testers who meet Article 27, under Delegated Regulation (EU) 2025/1190, with a mandatory replay and purple teaming exercise at closure.
Hold list: The list (HLD-HM-TLPT-01 at Hansa Mutual) that keeps the continuous pipeline from masking or revealing a covert threat-led test. Continuous emulation is not a TLPT, and its manifest, authority and evidence are kept apart.
Management body duties: NIS 2 Article 20(1) has the management body approve the cybersecurity risk-management measures, oversee their implementation and be capable of being held liable for infringements of Article 21; Article 21(2)(f) asks for policies and procedures to assess the effectiveness of the measures.
Authorisation as the dividing line: The Directive on attacks against information systems has Member States criminalise access without right. The owner's written authorisation for each asset is what separates an exercise from an offence, so the manifest carries a consent field per boundary.
Obligation register: The OBL record that maps each instrument and article to a restated obligation, the stage it constrains, the control, the evidence artefact with an age limit, an owner and a review date. An open entry with a question and a person is a legitimate state.

Teaching plan

15 min	The teacher explains which regime applies to whom: Nordvik Region under NIS 2 as transposed, national law and the GDPR; Hansa Mutual's German entity under DORA.
20 min	Teacher-led walk through the instruments on the figure, attaching each to the stages it governs, with the five consequences of DORA for the loop.
35 min	Exercise: write obligation register entries for the instruments that apply to the participant's organisation or to one of the two fictional organisations.
10 min	Pairs discuss staff and their representatives: agreements govern classes of exercise and not single dates, and a covert test is notified as a class.
10 min	Plenary on the labels: what is observable in the texts, what is expected of supervisors, and what is speculation, such as harmonised treatment of AI-assisted emulation.

Discussion

The Delegated Regulation on TLPT contains no provision on AI. What should an organisation do before planning an agent in a supervised test, and why ask first?
Agreements with staff govern classes of exercise so that a covert test can be notified as a class and not as a date. What trust does that arrangement require on both sides?
Nordvik Region keeps an open entry on the disclosure of synthetic content in a deepfake scenario under AI Act Article 50(4). When is holding a scenario the right design decision?

Exercise · 35 minutes

An obligation register for the loop

Write six entries of an obligation register for your own organisation, or extend OBL-NR-2028-01 or OBL-HM-2028-01. For each entry follow the practical guide: name the instrument, article, paragraph and point as the chapter gives them and the date on which you read the text; restate the obligation in one sentence in architectural terms, naming the addressee; name the stage of the loop it constrains and the control that meets it, a manifest field, a policy-point rule, a contract clause, a runbook step or a record; name the evidence artefact, its holder and its age limit; and name the owner, a deputy and the review date. Mark at least one entry open, with the question and the person who will answer it. Treat the entries as design implications, not legal advice.

Deliverable: Six register entries, each with instrument and article, restated obligation, stage, control, evidence with age, owner and review date, one of them open.

Self-test

How does the chapter relate continuous emulation to a threat-led penetration test under DORA?
1. Continuous emulation replaces the TLPT once the pipeline covers every priority technique.
2. A TLPT is one form of the loop and uses the same manifest as the pipeline.
3. Continuous emulation is not a TLPT; the two are kept apart, and a hold list protects the test's secrecy.
4. The pipeline must be stopped across the whole estate for the active phase of a TLPT and restarted after the attestation.
Which provision does the chapter cite for policies and procedures to assess the effectiveness of cybersecurity risk-management measures?
1. DORA Article 27.
2. NIS 2 Article 21(2)(f).
3. AI Act Article 50(4).
4. GDPR Article 28.
What, according to the chapter, separates an authorised emulation from a criminal offence?
1. The use of benign, reversible and tagged scenarios of safety class S1 on the organisation's test tenant.
2. The presence of a white team during the exercise window.
3. A report delivered to the system owner after the exercise.
4. The authorisation of the owner or right holder of each asset, recorded in the manifest.

Chapter 22 · 90 minutes

Across Boundaries: Suppliers, Managed Providers, Sector Exercises and Authorities

The lesson takes the loop across organisational boundaries. Participants distinguish three ways a test crosses a provider boundary, write a consent and notice protocol with standing consent, window notice and stop holders on both sides, read cloud providers' published testing rules, share detections with peers without exposing the target mapping, route vulnerability disclosure in both directions, handle cross-border entities, and assemble the evidence package for a supervisor.

Learning objectives

Classify a test that crosses a provider boundary as pipeline, response chain or provider platform, and state the permission each needs.
Draft a consent and notice protocol for a test across a provider boundary.
Explain what may leave the organisation in sector sharing and what stays inside, by handling class.
Design the disclosure routes for a vulnerability found in a supplier's product and for a report about one's own estate.

Key concepts

Three boundary crossings: Through the provider's pipeline, with a seeded incident in its queue; through the provider's response chain, with a scenario on one's own estate; and against the provider's platform, which is outside the organisation's authority and excluded in every manifest.
Standing consent and window notice: Standing consent is given once in the contract: test classes, synthetic seeds, the stop right and knowledge rules. Window notice precedes each run, by default ten working days for a managed provider, without saying which cases are tests.
Sanitiser: A deterministic export that passes an allow-list of fields and drops everything else, followed by a person's release. The technique identifier, portable detection logic and aggregate results may leave; the target mapping, the gap list and findings stay inside.
Coordinated vulnerability disclosure: A weakness in a supplier's product goes to the supplier and, failing an answer, to the CSIRT designated as coordinator under NIS 2 Article 12(1). The test stops at proof. The organisation also publishes a channel for reports about its own estate.
One loop, local manifests: For a group in several legal regimes, the stage records and handling classes are the same everywhere, and each entity has its own rules-of-engagement manifest reflecting local law, consent and transfer rules.

Teaching plan

15 min	The teacher presents the three crossings and where the stop path and the question of what can be undone cross the boundary too.
15 min	Participants compare the cloud providers' rules in the chapter's table and draw the two lessons: the rules disagree and change, so the protocol records the page and the date.
35 min	Exercise: write a consent and notice protocol for a test that crosses a managed provider's boundary.
15 min	Sorting task: twelve items from a loop's records are placed in can leave or stays inside, with a Traffic Light Protocol marking for those that leave.
10 min	Plenary on disclosure in both directions and on the supervisor package, where the gap list is inspected and not copied.

Discussion

A log that cannot cross a border is a coverage gap, recorded as one. How should a group explain such a gap to a board that expects one loop for the whole group?
Detections received from peers are untrusted input and a draft. What would a loop need to do before a shared detection counts towards coverage?
A supervisor has the authority to demand the gap list and the organisation has a duty to protect it. Why does the chapter settle on inspection rather than a copy?

Exercise · 35 minutes

A consent and notice protocol

Write a consent and notice protocol for one test of your own organisation, or of Nordvik Region, that crosses a managed provider's boundary. Following the nine steps of the practical guide, classify the crossing and refuse any test against the provider's platform. Record the standing consent the contract annex must contain. If a cloud provider is involved, note which published rules you would read and that you record the page and the date. Set the window notice and its contents. State what the provider may and may not know during the run. Name the stop holders on both sides with deputies and the instrument each uses. Name the stop condition for a vulnerability found in the provider's own service. State the data rule and what the provider receives for each seed.

Deliverable: A one-page protocol from which a reader can name the provider, the clause, the date of notice, the stop holders on both sides and the data rule.

Self-test

Which of the three ways of crossing a provider boundary is excluded in every manifest?
1. Seeding an incident into the provider's queue under a contract annex.
2. Probing the provider's own platform, its other customers' tenants or its staff.
3. Running a scenario on one's own estate to watch the provider's out-of-hours chain.
4. Asking the provider to return outcomes for tagged events within five working days.
What may leave the organisation in sector sharing, under the chapter's rule?
1. The technique identifier, portable detection logic and aggregate results, after a person's release.
2. The names of the systems each scenario ran against, marked TLP:AMBER.
3. The list of techniques that are untested or failed, for peers to compare.
4. Evidence manifests and telemetry samples that let the receiving peers verify that the detection really works.
During an authorised test, a weakness is revealed in a supplier's product. What does the chapter prescribe first?
1. The tester continues to establish how far the weakness reaches.
2. The finding is published at once with full detail, so that the supplier's other customers can protect themselves.
3. The test stops at proof and the weakness is reported to the supplier, with the CSIRT coordinator as fallback.
4. The finding is closed as out of scope and removed from the register.

Module 6 · Part VI · People and Career

Part VI turns to the people of the loop. Participants examine what red and blue are rewarded for and design a shared target and a blameless purple session, protect staff who are exposed to exercises, build a competence framework and an apprenticeship route that survives the automation of routine emulation, and keep a horizon register on whether red and blue will be separate teams in 2036, with every trend labelled observable, expected or speculation.

Lecture · 45 minutes

Two professions, one loop: incentives, craft and the next ten years

The lecture argues that the loop's records and mandates work only if the people who run it can say what they saw, keep the skills the automation no longer exercises, and know where independence will live as the organisation changes. It starts from the scoreboard of red wins when blue loses, sets out what a blameless session requires, states honestly how thin and adjacent the evidence on wellbeing and on skill beside automation is, and ends with three futures for 2036 that differ on where independence lives and agree that it is needed.

10 min	What red and blue are rewarded for A scoreboard describes incentives, not characters; AI makes runs and drafts cheap, so measures that count them need a gaming check. Accountability stays separate where independence needs it; the target is shared where learning needs it. The shared target: priority techniques verified with evidence of a stated age.
9 min	Being tested, and staff exposed to exercises A charter written before the session; roles and systems recorded, not names; anyone may pause. Say what class of test exists and withhold only the instance; count the test against the system. Staff are protected by governance and not by consent: representatives first, no individual consequences, a debrief the same day.
10 min	Keeping the red craft The craft is the choice of path and the adaptation when a step fails; routine is running a known technique in a known form. The evidence on skill beside automation comes from other fields, and none of it concerns red teaming. Attempt first, manual-form practice on the range, rotation in both directions and a craft register tied to the runner's level.
9 min	Three futures for 2036 Two teams with one loop, one engineering practice, and a pipeline with a human verifier. They differ on where independence lives, not on whether it is needed. The verdict: that independence is needed is expected; how it is provided is speculation.
7 min	A register that can be wrong in a reviewable way Each trend has a label, a stage, evidence, a trigger, a posture and an owner. Triggers are computed from the loop's own records, such as the held-out catch rate and the age of evidence. The author's projection is given with five thresholds that would change it.

What the audience takes away

Measure red and blue together on verified coverage with evidence age, and never turn a measure of testing or of load into a measure of a person.
The route to the red craft is a design decision that can be made explicit, funded and counted.
Decide where independence lives, write it down, and tie the view of the future to triggers and review dates.

Chapter 23 · 75 minutes

Red and Blue as People: Trust, Incentives, Safety and Wellbeing

The lesson treats red and blue as people who are rewarded in opposite directions. Participants design a shared target that keeps accountability separate, write ground rules for a blameless purple session, apply three rules for those who are tested, manage the four sources of load, and govern exercises that expose staff outside the teams. The chapter states that its evidence is thin and adjacent and claims no more for it.

Learning objectives

Explain why a scoreboard of red wins when blue loses makes honest reading costly, and what the shared target replaces it with.
Draft a purple session charter with rules on recording, readers, pauses and the use of results.
Classify the four sources of load on a team and propose a spacing rule for tested activities.
Review a plan for an exercise that involves staff against the four points of governance.

Key concepts

Shared target: Red and blue are measured together by the share of priority techniques verified with evidence of a stated age, the time from finding to verified control and the held-out catch, while accountability for findings, changes and closure stays separate.
Blameless, not accountless: A session identifies contributing causes without indicting an individual, records roles and systems and not names, and lets no result enter an appraisal. The class owner, the person who granted a level and the closure owner still answer for design and decisions.
Withhold the instance, not the class: The charter and works agreement state that seeded incidents, injected records and tagged scenarios exist and in what classes. Only which case, when and with what content is withheld, and a missed seed counts against the system, not a person.
Four sources of load: The exercise window, the stop path that requires a reachable holder, the findings that become work, and the reviewing of machine output. Only the last is new, and tested activities are spaced so that a team is not always being tested.
Governance for staff exercises: Representatives are informed first; consent is not the legal basis; no result has individual consequences because the result belongs to the control; and staff are debriefed on the same day with a way to talk.

Teaching plan

10 min	The teacher opens with the scoreboard problem and the chapter's note on method: no study in its bibliography measures the wellbeing of red teams or the effect of a purple session.
15 min	Groups read Hansa Mutual's joint scorecard SCR-HM-2028-Q1 and identify the gaming checks and the prohibitions.
30 min	Exercise: write a purple session charter and an exercise-information notice for staff representatives.
10 min	Role play of two minutes each: the facilitator redirects sentences of the form X should have into the form the process allowed.
10 min	Plenary on the purple coordinator as translator, the strains of the role, and how it is measured by the flow and legibility of the register.

Discussion

The joint scorecard changes what a good quarter means without changing who closes a finding. Why does the chapter insist on both halves of that sentence?
Large field studies of phishing simulations found limited value in the training. What does that imply for what an exercise involving staff should be designed to test?
Nordvik Region's small team is both examiner and examined. Which of the session rules matter most when the same six people will meet again next quarter?

Exercise · 30 minutes

A session charter and a staff notice

Write two short artefacts for your own organisation or for Nordvik Region. First, a purple session charter following the practical guide: purpose, who attends by role, what is recorded and what is not, who may read the record, how long it is kept, that the session opens with what held, that the record names roles and systems and not people, that any participant may pause without giving a reason, and that no result enters an appraisal. Second, an exercise-information notice for a class S4 exercise that involves staff: the kind of exercise, the unit, the window, the working days of notice to the representatives, what staff are told in advance and on the day, and that the result belongs to the control and has no consequence for any person.

Deliverable: A one-page session charter and a one-page staff notice, both dated before the session or window they govern.

Self-test

What does the chapter keep separate, and what does it share, between red and blue?
1. It shares accountability for closure and keeps the targets of each team separate.
2. It keeps accountability separate where independence needs it and shares the target for learning.
3. It shares budgets and reporting lines in one team and keeps the scenario library and the register separate.
4. It keeps the purple session separate and shares the individual appraisals.
How does a blameless session record an alert that was closed wrongly out of hours?
1. By the name of the analyst who was on shift, in a version of the record visible to the CISO only.
2. By the name of the shift, so that the team concerned can be retrained.
3. By omitting the event from the record to protect those involved.
4. By role and system, for example that a triage class closed the alert, not by person.
On what does the chapter rest the protection of staff exposed to an exercise such as a deepfake test of payment approvals?
1. On governance: representatives informed first, no individual consequences and a debrief on the day.
2. On the written consent of each participant, collected by the line manager before the exercise window opens.
3. On keeping the exercise secret from the representatives until it is over.
4. On limiting the exercise to volunteers from the finance unit.

Chapter 24 · 90 minutes

Competences, Training and Keeping the Red Craft

The lesson defines the red craft and the competences of the loop in six areas, from scenario design to evidence, each evidenced in an assisted and an unassisted form. Participants review what studies in other fields measured about skill beside automation, design an apprenticeship route with attempt-first practice, manual-form runs and rotation, write contract terms that buy teaching with testing, and work through the debate on whether automated emulation erodes the craft.

Learning objectives

Explain the difference between the red craft and routine, and where the framework gives the adversary's mind an address.
Classify loop competences into the six areas and state why each is evidenced in two forms.
Design an apprenticeship route with stages, gates, rotation and unassisted practice per usage mode.
Review the debate on erosion of the craft and state the verdict and what an organisation controls.

Key concepts

Red craft: In the book's own definition, the capacity to start from an adversary's objective and constraints, choose a path and adapt when a step fails. Routine is running a known technique in a known form and writing the record.
Six competence areas: SD Scenario design, EE Emulation engineering, DE Detection engineering, OA Observation and analysis, XC Exercise control and EV Evidence, with eighteen identifiers in Hansa Mutual's LOOP-CF. The adversary's mind is evidenced in SD-03 and EE-03.
Assisted and unassisted form: A competence is shown both with and without AI assistance, and the lower level counts; DE-03 and OA-03, the review of AI output, are assessed in the assisted form alone. The competence record is used for development, not for ranking, pay setting or discipline.
Attempt first: For the first six months an apprentice drafts every scenario, variant and detection test before opening any assistant's proposal. The chapter's reading of the studies is that the effect of AI on skill depends on whether it replaces the attempt.
Craft register: A team-level count of the people who have shown each loop competence unaided in the last twelve months. Hansa Mutual ties the runner's Level 3 for S1 scenarios to at least two operators who have shown EE-02 unaided.

Teaching plan

15 min	The teacher defines the craft and presents the six areas, then the table of what junior work taught and where AI now does that work.
15 min	Reading of the evidence: what the studies of colonoscopy, school mathematics and a programming library measured, and the labels observable, expected and speculation the chapter attaches.
30 min	Exercise: design an apprenticeship route, or for a buyer of the loop, the contract annex that buys novelty, pairing days and a handover.
20 min	Structured debate in four steps on whether automated emulation erodes the craft of the adversary's mind.
10 min	The teacher gives the verdict: the question of erosion is open, and the response is within the organisation's control.

Discussion

The case for calm says routine was never the craft. The chapter replies that the routine did teach. What exactly did it teach, and where can that now be learned?
Hansa Mutual measured 26 per cent human-led hours against a protected 30 and reported it as a finding, not a failing. What does that way of reporting make possible?
Nordvik Region buys the red competences and keeps the ability to read them. What is the minimum a buyer must be able to do itself?

Exercise · 30 minutes

An apprenticeship route that survives automation

Following the practical guide, design an apprenticeship route for your own team or for Hansa Mutual. List the competences the route must produce by identifier, for example EE-02, SD-01, SD-03, DE-01 and XC-02, and write for each where a junior practises it now that a pipeline runs the routine. Define the stages from shadowing to co-authoring to authoring a held-out scenario to leading a stop drill, with a gate for each. Add the attempt-first rule, manual-form practice on the range under supervision, and a rotation between detection engineering and the red team. Say who decides that a stage is complete and what is reported each quarter at team level. Participants whose organisation buys the loop write the tester annex instead: named testers, declared AI, an open-ended part, pairing days and a handover.

Deliverable: A learning path with competences, stages, gates and quarterly team-level counts, or a contract annex with the seven terms.

Self-test

Where does the competence framework give the adversary's mind an address?
1. In OA-01 and OA-02, reading and classifying outcomes.
2. In EV-01 and EV-02, writing and reproducing evidence.
3. In SD-03 and EE-03, writing a novel scenario and adapting when a step fails.
4. In XC-01 and XC-02, coordinating a purple session and holding and exercising the stop path.
What does the chapter's verdict say about whether automated emulation erodes the red craft?
1. The evidence shows neither that it does nor that it does not; the response is the organisation's.
2. The evidence from red teams shows erosion within two years of automation.
3. The evidence shows that automation improves the craft of every operator.
4. The question is settled against automation by the studies of colonoscopy, school mathematics and programming.
To what does Hansa Mutual tie the emulation runner's Level 3 for S1 scenarios in AIDR-0885?
1. To the number of scenarios the pipeline runs each month.
2. To the approval of the vendor that supplies the runner.
3. To a pass rate of at least 90 per cent on the known-form scenarios of the library.
4. To at least two operators who have shown EE-02 unaided within twelve months.

Chapter 25 · 75 minutes

The Future of the Loop: Will Red and Blue Be Separate Teams in 2036?

The lesson looks ten years ahead with the series' discipline. Participants sort trends into observable, expected and speculation, compare three futures for 2036, two teams with one loop, one engineering practice and a pipeline with a human verifier, by where independence lives, work through the debate on whether red and blue stay separate, examine the author's labelled projection and its five thresholds, and write a horizon register with triggers from the loop's own records.

Learning objectives

Classify statements about the future of the loop as observable, expected or speculation, with the posture each justifies.
Compare the three futures for 2036 by who authors scenarios, where independence lives and the main risk.
Explain the verdict's separation of whether independence is needed from how it is provided.
Draft a horizon register with labelled trends, triggers, postures and a review date.

Key concepts

Horizon register: A record of the organisation's view of the future of its loop in which every trend has a label, a stage, evidence, a trigger, a posture and an owner. Its triggers can be computed from the loop's own records.
Commit, prepare, keep reversible: The posture by label: observable trends justify commitment, expected trends justify preparation at low cost, and speculation justifies keeping a decision reversible, especially where it would remove a safeguard.
Three futures for 2036: Future A, two teams and one loop; Future B, one engineering practice; Future C, a pipeline with a human verifier. They are devices for thinking, carry no probability, and differ on where independence lives.
Author's projection: A section labelled as the author's judgement beyond the evidence: the red team survives as a name and role with changed content. It comes with five thresholds, each a trigger that would change the view.

Teaching plan

15 min	Card sort: participants place twelve statements from the chapter under observable, expected or speculation and name the posture for each.
15 min	The teacher presents the three futures with the comparison table and asks each group where independence would live in its own organisation.
10 min	Short debate in four steps on whether red and blue will be separate teams in 2036, ending with the verdict's three separated questions.
25 min	Exercise: write a horizon register for the participant's own loop, with triggers drawn from its records.
10 min	Plenary: groups name the trend they included that would be bad news for their present plan, and the date of the first review.

Discussion

The case for calm says the separation of red and blue was an accident of scarcity. What would have to be shown before you accepted a converged practice as verified?
A loop that closes findings without a person at any step is labelled speculation and advised against. What would the first warning signs of drifting towards it look like in your own records?
Nordvik Region accepts convergence inside the Region and keeps independence in the contract. What makes that defensible for a team of six?

Exercise · 25 minutes

A horizon register for the loop

Following the practical guide, write a horizon register for your own organisation's loop. List at most eight trends that bear on it, including at least one that would be bad news for your present plan. Label each observable, expected or speculation and write evidence a reader can look up; a trend without evidence is speculation. Name the stages each concerns by their exact names. Write a trigger for each trend with a threshold and a direction, drawn from the loop's own records where possible, such as the age of evidence for priority techniques, the held-out catch rate or the seeded-gap catch rate. Set the posture by label and say what keeping reversible means. Name the owner, the approver and the first review date.

Deliverable: A horizon register of up to eight trends, each with label, stages, evidence, trigger, posture and owner, and a review date.

Self-test

On what do the three futures for 2036 differ, according to the chapter?
1. On whether independence between tester and tested is needed at all.
2. On whether DORA and NIS 2 will still require financial and essential entities to test their ICT systems.
3. On whether a named person signs the closure of a finding.
4. On where independence lives: between teams, inside one practice, or with a human verifier.
Which posture does a trend labelled speculation justify?
1. Commitment: a decision can be taken on it today.
2. Keeping a decision reversible, especially where it would remove a safeguard.
3. Preparation: decisions that cost little now and save a great deal if the trend arrives.
4. No action, because speculation is excluded from the register.
How does the verdict label the two questions it separates about independence in 2036?
1. That it is needed is speculation; how it is provided is observable.
2. That it is needed is observable; how it is provided is expected.
3. That it is needed is expected; how it is provided is speculation.
4. Both are speculation, since ten years is too long a horizon.

Module 7 · Part VII · Experience and Conclusions

Part VII tests the design against experience. Participants recognise eight anti-patterns of the loop from public cases, composites and illustrative records, follow Nordvik Region and Hansa Mutual through a year with a failure and a recovery at each, turn a year of records into a two-year plan with at most six measures and three decisions, and weigh the author's verdict on the five-part thesis, the two operating rules and the twelve questions.

Lecture · 45 minutes

What a year in the loop proves, and what it does not

The closing lecture asks what the book has earned the right to claim. It shows how loops fail where a step was reasonable and a question was not asked, tells the year in which every failure at Nordvik Region and Hansa Mutual was found by the loop and not by an incident, and gives the two answers of April 2028: two of nine techniques verified, with reasons, and a pipeline that does not make the session redundant. It ends with the author's verdict, in which no part of the thesis earned a plain held, and with a first step for each role.

10 min	Eight ways a loop fails Four public cases: an authorised test that ended in arrests, stolen red-team tooling, evaluation agents beyond scope, and coverage figures from configuration. Eight anti-patterns, each with the stage it breaks and the control that changes the outcome. None of the cases shows that AI made the loop unnecessary or unsafe in itself.
10 min	A year with a failure at each organisation Nordvik Region: an hours variant fails on 19 January and all variants pass on 9 February. Hansa Mutual: a restraint failure on 24 January and an independence re-test on 22 February that moves two cells to failed. Every recovery had three parts: contain at once, fix by one person, re-test by another.
9 min	Two answers and two plans AIDR-0841: a verified share with its list, reasons and age, not closed findings. AIDR-0891: keep the quarterly session for held-out and human-led scenarios. A bought loop is worth the terms on which its evidence can be inspected; a run loop is as good as its independence and its stop.
9 min	The verdict on the thesis Parts 1, 2, 4 and 5 held with qualifications; part 3 held in part and was restated. The refutation conditions did not occur, but the cases are fictional and illustrate without testing. Two operating rules carry the book: the closure rule and the independence principle.
7 min	Monday One first step per role that takes a day or less and uses a record the reader already has. The first-week plan: inventory, target, register, claim and rules, owners. Six of the twelve questions stay open, and the author's projections carry triggers that would change them.

What the audience takes away

A loop that wants to be believed keeps records that someone who was not there can check.
Report what was tested with its age, and the list of what was not; neither organisation gave its board a green dashboard.
Keep the two rules: close only on a passed re-test with a variant, signed and dated, and count a check only where tester and tested can fail differently.

Chapter 26 · 90 minutes

Case Studies and Anti-Patterns

The lesson collects the failures of the purple loop. Participants read four public cases as far as their sources go, then eight anti-patterns, from purple theatre and the red team that grades its own homework to the findings register that leaked and the contract with no testing right, each with its mechanism, early signs and control. They run a loop review that finds which patterns their own loop is closest to.

Learning objectives

Classify a described failure as one of the eight anti-patterns and name the stage it breaks.
Explain the mechanism and the early signs of each anti-pattern and the control that changes the outcome.
Compare the four kinds of case material and say what each can and cannot support.
Review a loop against the seven steps of the loop review and draft an anti-pattern record for one pattern found.

Key concepts

Purple theatre: A session with no re-test: findings carry a change identifier and no re-test log, and the closure date equals the merge date. It breaks P5 Verify, and the control is the closure rule with implemented-unverified as a state.
Grading its own homework: A check in which tester and tested share a model, training data, prompts or a vendor, so that their errors correlate. The control is the independence statement, held-out scenarios and seeded gaps.
Coverage by assertion and the green dashboard: A coverage figure without a date, or a map coloured by the existence of a rule, and a dashboard that counts runs. The controls are a coverage record with last test, result and expiry, and cells that carry age.
The emulation that became an incident: An emulation whose blast radius includes what the estate does in response, for example a scope silent on calendars and dependencies. The controls are safety classes, scope as code and a stop path outside the runner.
Anti-pattern record: An AP record in the loop repository with the pattern, signs, evidence, owner, control, decision and a re-test date, so that a loop review can find each pattern and follow its remedy.

Teaching plan

15 min	The teacher presents the four public cases, describing only what the sources report, and the four kinds of material: public, composite, illustrative and the book's own conclusions.
20 min	Matching task: eight short case descriptions are matched to the eight anti-patterns, with the stage broken and one early sign for each.
35 min	Exercise: run the loop review on the participant's own loop or on a supplied case file and write one anti-pattern record.
10 min	Groups read the table of where each pattern is most likely by usage mode and explain why the delegation profile is the first document to read in a review.
10 min	Plenary: which pattern is each organisation closest to, and what is the re-test date for its remedy.

Discussion

The chapter says loops fail where a step was reasonable and a question was not asked. Take one anti-pattern: which reasonable step, and which unasked question?
Nordvik Region's anti-patterns come from buying a loop and Hansa Mutual's from running one. Which family does your organisation belong to, and does it also carry the other?
A draft pack at Nordvik Region said nine of nine priority techniques were mapped to a detection. What made that sentence easy to write, and what made it wrong?

Exercise · 35 minutes

A loop review for the eight patterns

Run the chapter's loop review on your own organisation, or on the records of Hansa Mutual and Nordvik Region as the book gives them. Draw a sample of findings closed in the last two quarters and ask for each re-test log and evidence manifest. For five claims on the coverage map, ask for the last test, the result and the expiry. List every agent and tool that plans, runs, drafts or checks, with vendor and model family. For each class of scenario in production, ask who holds the stop and how long a drill took. Inventory where findings live. Read the contracts for a testing right. For each of the eight patterns write found, not found or not testable, and write an anti-pattern record for one pattern found.

Deliverable: A review sheet with an entry per pattern and the evidence read, plus one anti-pattern record with owner, control and re-test date.

Self-test

Which early sign points to purple theatre?
1. A closure date that equals the merge date, and findings with no re-test log.
2. One vendor's model family named across the planner, the detection drafter and the critic.
3. A tester's access that outlives the engagement.
4. An agreement that says nothing about testing.
Which control answers the anti-pattern of overfitted detections?
1. A register of record with handling classes and expiring access.
2. A testing right, scope as code and the consent of third parties written into every supplier contract.
3. Detection from a behaviour description, variants, a negative control and the held-out gap.
4. Cells that carry age and turn amber at expiry.
What does the chapter conclude from its cases about AI and the loop?
1. That AI made the loop unnecessary, since pipelines now find the failures.
2. That AI made the loop unsafe, since agents leave the scope of a test.
3. That public cases prove each anti-pattern occurs in most organisations.
4. That no case shows AI made the loop unnecessary or unsafe in itself.

Chapter 27 · 75 minutes

A Year in the Loop: Nordvik Region and Hansa Mutual

The lesson follows four fictional people through the loop's year to 30 April 2028: Karin Lund and Elin Berglund at Nordvik Region, Lena Vogel and Mareike Hartmann at Hansa Mutual. Participants trace dated failures and recoveries through all five stages, read the two reports that answer AIDR-0800 and AIDR-0850, and turn the year into an annual loop calendar in which every expiry has a re-test dated before it.

Learning objectives

Explain the failures of the year at each organisation and the stage at which the loop found each.
Classify the steps of a recovery into containment, fix and independent re-test.
Compare the two reports of April 2028 by what each claims and what each lists as not shown.
Draft an annual loop calendar with fixed dates, stage events, delegation levels, stop holders and closure signers.

Key concepts

Three-part recovery: The shape every recovery of the year had: a local and immediate containment, such as a lowered level, a rotated token or a retired rule; a fix made by one person; and a re-test run by another.
Found by the loop: Every failure of the year, the hours variant, the restraint failure, the shared model family, the collector's log and the slow stop, was found by a scheduled exercise or check and not by an incident.
The two reports: AIDR-0841 reports Nordvik Region's exercise programme as a verified share with its list, reasons and age, not as closed findings. AIDR-0891 keeps Hansa Mutual's quarterly session for held-out and human-led scenarios and the findings the pipeline cannot raise.
Annual loop calendar: A calendar built backwards from dates that cannot move, such as evidence expiries, the validity of the independence statement, risk acceptances and contract end dates, with a re-test before each expiry, a drill before each window and time reserved for recovery.

Teaching plan

10 min	The teacher sets the starting position of January 2028 and reminds the room that every person, date and figure of the chapter is illustrative fiction.
20 min	Timeline work: groups place twelve dated events of the two organisations on a wall timeline and tag each with its stage and its record identifier.
10 min	Groups mark the three parts of the recovery for the restraint failure of 24 January, restored after 49 days, and for one Nordvik Region failure.
25 min	Exercise: write an annual loop calendar for the participant's own loop.
10 min	Plenary on the two reports: what the audit committee and the executive board were told, and what each report says it has not shown.

Discussion

A year without a failure would have tested nothing, the chapter says. How should a team present its failures of the year to a board so that they are read as evidence that the loop works?
The chapter notes that the people carried more than the records show. Where in the year did the design rely on one person, and what made that person safer?
Hansa Mutual's answer to its board was no, with reasons. Which of those reasons would stop being true first if the organisation stopped funding human-led work?

Exercise · 25 minutes

An annual loop calendar

Following the practical guide, write a calendar for the next twelve months of your own loop, or continue the calendar of Nordvik Region or Hansa Mutual. First fix the dates that cannot move: expiries of evidence, the validity of the independence statement, risk acceptances and contract end dates. Place the stage events behind them: a review of the priority list, emulation windows, a purple session after each window, change deadlines and a re-test dated before every expiry. Give each event its delegation level and a stop holder who sits outside the system being stopped, and schedule a stop drill before every emulation window. Reserve time for recovery. Name the person who signs each closure. Label every statement about the future as a plan.

Deliverable: A twelve-month calendar with fixed dates, dated stage events, levels, stop holders, closure signers and reserved recovery time.

Self-test

How were the failures of the year discovered at the two organisations?
1. By incidents that reached production and were investigated afterwards.
2. By the loop itself, through scheduled exercises, re-tests, reviews and drills.
3. By the supervisor during a threat-led penetration test.
4. By the vendors of the simulation tool and the managed service.
What does AIDR-0841 decide about how Nordvik Region reports to its audit committee?
1. To report nine of nine priority techniques as covered by detections.
2. To report the number of findings closed since the first exercise.
3. To withhold the coverage page until every technique has been tested.
4. To report a verified share with its list, reasons and age, not closed findings.
Which sequence describes the recovery pattern the chapter finds in every case?
1. Report to the board, wait for the next quarter, then re-run the pipeline.
2. Accept the risk, close the finding and record a lesson learned.
3. Contain at once, fix by one person and re-test by another.
4. Raise the delegation level, tune the detection and close at merge.

Chapter 28 · 90 minutes

Nordvik Region and Hansa Mutual: Conclusions for Two Organisations

The lesson draws the conclusions for the two organisations. Participants compare what the year verified and left open per stage, the conclusion that a bought loop is worth the terms on which its evidence can be inspected and that a run loop is as good as its independence and its stop, the six measures of each plan, the three decisions asked of each management body, and what each organisation should stop doing. They write a two-year loop plan.

Learning objectives

Compare the conclusions and plans of Nordvik Region and Hansa Mutual by leverage, risk, independence and limit.
Explain how each organisation answers the five parts of the thesis from its own records.
Draft a two-year loop plan with at most six measures, each with an owner, a date and a verification.
Design a gate for an increase in delegation and tie the plan's triggers to numbers in the loop's records.

Key concepts

A bought loop: Nordvik Region's conclusion in AIDR-0846: a bought loop is worth as much as the terms on which its evidence can be inspected. The Region owns the priority list, the register, closure and the stop, and asks the contract to carry what the team cannot.
A run loop: Hansa Mutual's conclusion in AIDR-0896: a run loop is as good as its independence and its stop. It keeps the red team's authorship of the held-out set and a person's reproduction of a sample of what the agents report.
Six measures: Each plan has at most six measures, normally one per stage and one for people, each with a verb, an owner by role, a date and a verification that produces evidence. They target what is open, not what a passed re-test has closed.
Delegation gate: Every increase in delegation is written as a gate: a threshold on the class's own evidence, a period, a named grantor, a stop rule and a first review 90 days after the increase. Hansa Mutual withdraws delegation below a seeded-gap catch of 0.8.
Three decisions for the management body: The management body receives one page and at most three decisions. Nordvik Region's are testing as a condition of every agreement, funding the people who hold the loop, and accepting the age of evidence.

Teaching plan

15 min	The teacher presents the verified and open table per stage for both organisations and the two conclusions.
15 min	Groups read the comparison table and the thesis table, then state what each organisation learns from the other: a number for every trigger, and independence in a clause.
40 min	Exercise: write a two-year loop plan for the participant's own organisation as a decision record.
10 min	Pairs exchange plans and check each measure for an owner, a date and a verification, and each delegation increase for a gate.
10 min	Plenary on what each organisation should stop doing, and on what the plans assume, labelled observable, expected and speculation.

Discussion

Nordvik Region is asked to accept a re-tender or a change of supplier if a provider refuses a testing-right clause. What does it cost a small public authority to hold that line, and what does it cost not to?
Hansa Mutual's strongest instrument is described as the discipline not to widen what it cannot yet show it can supervise. How is that discipline made visible to a board that wants the pipeline to do more?
Both plans end with a measure about people. Why does the chapter require these to be agreed with representatives before the first reading is taken?

Exercise · 40 minutes

A two-year loop plan as a decision record

Following the nine steps of the practical guide, write a two-year plan for your organisation's loop. List the year's decisions as done, in progress or reopened. For each of the five stages name the constraint that limits it most, such as one person, review capacity, a provider's silence or a shared model family. Write at most six measures, normally one per stage and one for people, each with a verb, an owner by role, a date and a verification that produces evidence. Order them by reversibility. Write any increase in delegation as a gate with a threshold, a period, a named grantor, a stop rule and a review after 90 days. Take triggers from your horizon register and tie each to a number in your records. Select at most three decisions for the management body.

Deliverable: A plan of at most six measures with owners, dates and verifications, the delegation gates, the triggers and three decisions for the management body.

Self-test

What is Nordvik Region's conclusion about its loop, as recorded in AIDR-0846?
1. A bought loop cannot be trusted and should be brought in-house within two years.
2. A bought loop is as good as the pipeline its provider runs.
3. A bought loop is worth as much as the terms on which its evidence can be inspected.
4. A bought loop needs no coordinator, because the contract closes the findings.
How does the plan treat an increase in a delegation level?
1. As a gate: a threshold on recorded evidence, a named grantor, a stop rule and a review after 90 days.
2. As an automatic step once the pipeline has run for two consecutive quarters without an incident or a failed drill.
3. As a decision of the agent operator, recorded after the fact.
4. As a vendor setting that changes with each new model version.
What does the chapter say both organisations should stop counting as progress?
1. The verified share within expiry and its age distribution.
2. The number of scenarios run or of findings closed.
3. The held-out gap and the seeded-gap catch rate.
4. Cycle time from finding to verified control.

Chapter 29 · 75 minutes

Conclusions: The Purple Loop with AI

The lesson gives the author's verdict on the book. Participants examine how each of the five parts of the thesis fared, why no part earned a plain held, how part three was restated, whether the refutation conditions occurred, the two operating rules and the six that serve them, the twelve questions with their status, the author's labelled projections and their triggers, and a first step for each role with a first-week plan.

Learning objectives

Explain the verdict on each part of the thesis and what remains unproved for each.
Compare what is supported by sources and design with what is only illustrated by the fictional cases.
Classify the twelve questions as answered by design or open, giving the reason for the open ones.
Draft a first-week plan for a loop with a concrete output for each of the five days.

Key concepts

Verdict on the thesis: Parts 1, 2, 4 and 5 held with qualifications and part 3 held in part. No part earned a plain held, the refutation conditions did not occur, and the fictional cases illustrate the design without testing it.
Part 3 restated: A loop closed by machines alone can show that the known still works and cannot by itself show that its coverage is real. Regression, replay and the re-run of a known scenario are mechanical and properly automated.
Two operating rules: The closure rule and the independence principle carry the book. Six further rules serve them: coverage with evidence age, expectation before result, scope as code with the stop outside, ceilings with the lowest governing, the register as tier 0, and a named person who decides.
Twelve questions: Six are answered by design, which is the book's own conclusion, and six are open because they turn on people over years, on what supervisors and national law decide, and on how long a stop path stays quick.
First-week plan: Five working days: Monday inventory, Tuesday target, Wednesday register, Thursday claim and rules, Friday owners. By Friday the organisation can say what it has tested, what is closed and who holds the stop.

Teaching plan

15 min	The teacher presents the verdict table: for each part of the thesis, the support in sources and design, what only the illustrative cases show, and what remains unproved.
15 min	Groups take three of the twelve questions each, state the best current answer and argue whether its status is answered by design or open.
10 min	Reading of the author's six projections with their labels; each participant names one trigger that would change one projection.
25 min	Exercise: write the first-week plan for the participant's own loop and the Monday step for the participant's own role.
10 min	Closing round: each participant states the one record they will ask for on Monday and what they will do if it is missing.

Discussion

The author finds that no part of the thesis earned a plain held, and says the book searched only its own sources. How does that admission change how you would use the book's rules in your organisation?
The first part of the thesis is partly a definition, and a definition is not refuted by a case. What evidence would persuade you that a separate purple team does worse, or better, than a loop held by roles?
Of the six open questions, which matters most to your organisation in the next two years, and what would you measure to narrow it?

Exercise · 25 minutes

A first-week plan for a loop

Write the first-week plan of the chapter for your own organisation, with a named person and a concrete output for each day. Monday: list every tool and assistant in testing and detection with its usage mode, owner and stop holder, and mark the first with no stop path outside itself. Tuesday: build the priority list for one service, mark the hard-to-emulate entries and set a review date. Wednesday: count the findings by the five states and check one closed finding for re-test date, variants and signer. Thursday: write the coverage statement for three techniques in five parts and check that a signed manifest names a stop holder outside the system being stopped. Friday: name the closure owner and the coordinator, diarise the review of the independence statement and inform the employee representatives.

Deliverable: A five-day plan with a named person and an output per day, plus the participant's own first step for Monday.

Self-test

How did the third part of the thesis fare in the author's verdict?
1. It held without qualification, on the strength of the Hansa Mutual case.
2. It was refuted, because pipelines found most of the year's failures.
3. It held with qualifications, like the other four parts.
4. It held in part and was restated for what a machine-only loop can and cannot show.
Which two rules does the author say carry the book?
1. The alert budget and the tune-or-retire rule.
2. The closure rule and the independence principle.
3. The 30 per cent human-led share and the attempt-first rule.
4. The handling classes and the register of record.
What first step does the chapter give the closure owner for Monday?
1. Ask of one finding the register calls closed its re-test date, its variants and its signer.
2. Drill the stop on one real identity and measure the time to revoked credentials.
3. Replace one activity count on the board page with the verified share within expiry, with its list and age.
4. Read the contract for a right to test and a duty to declare AI.

Answers to the self-tests

Chapter 1	1B · 2D · 3A (1) The thesis holds that a machine-closed loop can show that the known still works but cannot by itself show that its scenarios were the right ones, which is why verification needs independence. The other options contradict parts one, two and four. (2) The chapter distinguishes modes by whose identity the AI uses. A Mode 5 runner executes against the estate with an identity of its own, so it is treated as a privileged account; over-reliance on a draft is the risk of Modes 1 to 3. (3) Both decision records ask for an answer in the form the thesis requires: what was tested, when and with what result. The chapter says neither can be answered by a count of findings or scenarios.
Chapter 2	1C · 2A · 3D (1) The simulation runs a catalogue on a schedule and records a pass or fail per control and test, but in the baseline there was no one to act on a failure, so P4 Improve is the stage it usually left unfinished. (2) A tabletop is a discussion; it shows that people, roles and the plan hold together on paper and cannot show that any control or detection works. The question to ask is which technical claims the discussion rested on. (3) The chapter names three causes, the backlog, ownership not matched to the test, and above all that closure had no owner and no test. It labels that conclusion as the book's own.
Chapter 3	1B · 2C · 3A (1) A detection is at-risk when its last passing test is within the evidence expiry, 90 days for a priority technique at Hansa Mutual, but a dependency has changed since. Expired applies only when the last passing test is older than the expiry. (2) The ratio counts production changes touching what the technique depends on between two passing tests. At twenty, twenty changes accumulated, and if the twentieth broke something the test cannot say which of them did. (3) Repetition is already cheap and variation and drafting are expected to become cheaper. Novelty, judgement, independence and safety stay costly, and a design that assumes otherwise moves the bottleneck without removing it.
Chapter 4	1D · 2B · 3C (1) The state implemented, unverified means a change is merged or deployed and the finding is still reported as open. Only closed and verified, with a passed re-test and variant, signed evidence and a dated signature, counts as closed. (2) Running and recording a codified re-test may reach Level 3 Bounded, but declaring closure is never delegated. The table states: person; no delegation. The runner proposes and the closure owner signs. (3) The three proofs are held-out scenarios the detection builders did not see, seeded gaps and seeded errors that show the check can fail, and reproduction. Model, data and vendor are three of the five kinds of separation, not proofs.
Chapter 5	1C · 2A · 3D (1) The ranking sums three coarse ordinal tiers, impact, relevance and uncertainty about the defence, to give an order and a tier with reasons. The chapter says explicitly that techniques are not chosen by novelty. (2) The chapter sets the ceiling at P1 Target at Level 1 Assisted: a proposal made by a system is not a decision, and a draft enters the library only when the named owner accepts it. Scenario selection is not delegated to a Mode 5 agent. (3) All four categories of exclusion end in a record with a reason, a decider and a review date. The chapter's rule is that an excluded technique is untested, and untested is not covered.
Chapter 6	1B · 2D · 3A (1) The chapter keeps the rules of engagement and the mandate manifest apart and states that the lowest ceiling governs. With a mandate at Level 2 Supervised, the agent runs at Level 2 whatever the manifest would allow. (2) The stop path sets the stop flag at the policy point, revokes the emulating system's credentials and egress and triggers the deterministic clean-up. The emulating system takes no part in any of the three, and stopping needs no approval. (3) Exercises that involve people are class S4. For S4 the ceiling is Level 0 Advisory: AI may plan only, and a named operator acts with per-step white-team approval, under the agreements with employee representatives.
Chapter 7	1C · 2A · 3B (1) The plan carries the target scope as a reference to the scope in the rules-of-engagement manifest and never as a wider or new list, so that the policy decision point and the white team work from one signed scope. (2) The chapter says a person contributes judgement that depends on consequence and context, while AI adds breadth, speed and cost. It adds that the division is not a ranking of value and that a plan needs both. (3) The log goes to an append-only store held by the white team. Testers can add entries and annotations but cannot alter what is written, and an agent's action log is part of the same record.
Chapter 8	1D · 2B · 3A (1) Ninety per cent on known forms against 71 per cent on held-out variants gives a gap of 19 points. The chapter treats a gap above ten percentage points as a finding on the detections, a threshold later fixed in AIDR-0889. (2) Marker leakage is the case where the tag is visible to the detection logic, so a rule fires on the tag and not on the behaviour. The design answer is a tag that detections cannot see. (3) Continuous regression is observable and AI-generated variants at scale are expected, but replacement of the human red team is labelled speculation. The book's conclusion is that the work changes and a protected share of novel, human-led emulation remains.
Chapter 9	1C · 2A · 3D (1) Detected demands the whole chain: detection, alert, a qualified triage decision and the playbook action within the bound. An alert closed by automation without a qualified decision is alerted but not triaged, with the reason recorded. (2) The sheet is written from the detection catalogue, and the owner needs only the list of techniques, not the plan, the order or the timing. Reading the log first would let the tested side grade its own test. (3) An event may be not generated, not forwarded, dropped or retained too briefly. Each has a different owner, as Hansa Mutual's three telemetry gaps showed, so the observer records the layer at which the event disappeared.
Chapter 10	1B · 2C · 3A (1) The playbook route applies when the activity was detected and the response was slow, wrong, too wide or too narrow. The artefact changed is the playbook manifest, the runbook or the decision right. (2) The table lists the tester who wrote the scenario as the party who must not own the detection route. It carries the independence principle into ownership: the scenario's author does not tune the detection that answers it. (3) A merged change is not a closed finding. In the Hansa Mutual example the finding is implemented-unverified and the coverage cell stays failed until P5 Verify has run the case and its variants and attached the evidence.
Chapter 11	1D · 2B · 3C (1) The exact re-test shows the specific path is now seen. A detection shaped by a finding passes the scenario that shaped it, so variants, a held-out variant and a negative control are needed to give evidence about the technique. (2) Closure is a decision about the organisation's risk and is not delegated. A runner may execute the re-test and record the result, but a named role signs, never an agent and never the author of the fix alone. (3) An expiry has a clock, a number of days after the last full pass, and a condition that ends the evidence earlier when something it depends on changes. When either triggers, the status changes by rule from verified to unverified.
Chapter 12	1B · 2D · 3A (1) A tool invoked with parameters, a sequence or a destination that the permission manifest does not allow belongs to the class tools and actions, identified as AML.T0053 AI Agent Tool Invocation. (2) An agent's account of its work is an output of the model and can be wrong or steered. Detection therefore relies on the runtime, the policy decision point and the tool-side audit log, which record the effect whatever the runtime reported. (3) For a detection, a quiet period means only that nothing fired. Evidence that a detection works is a recent simulation that fired the alert in time, which is why the coverage claim carries a date and an expiry.
Chapter 13	1C · 2A · 3D (1) The author of a seed is not the person who tunes the agent under test, and the set contains a held-out share the operators have not seen. At Hansa Mutual the red team, not the SOC platform team, authors the seeds. (2) Lowering a level is immediate and raising one is a decision by a named authority. In the worked example session revocation was held at Level 2 and restored only after the re-test passed on all three variants and the benign twin. (3) The provider consents in the contract and knows that tests exist, the seeds per class and the scoring. It does not know the identity, timing or content of any seed, which keeps the test from being recognisable.
Chapter 14	1C · 2A · 3D (1) Only the two runners reach Level 3 in practice, and only for S1 scenarios inside a signed scope enforced by a policy decision point outside the agent. Everything else the agents produce is a draft at Level 1 or an objection at Level 0. (2) The critic runs on a second model family at Level 0 Advisory. It reads the outputs of the other functions, never their working stores, and writes flags and questions; it never gates. (3) Four things stay with people: a named authority signs the rules of engagement, named people hold the stop, a named person closes a finding, and human-authored novelty remains a human task. The other options are drafts or bounded tasks agents may perform.
Chapter 15	1B · 2D · 3A (1) For the model kind the control is a critic on a different family, used for questions and not verdicts, with the declared families and a log of the critic's disagreements as evidence. An immediate re-test is the failure the time kind addresses. (2) The verdict keeps mechanical checks such as replay automated, and holds that a machine-closed loop shows regression but not that the scenarios were the right ones. Second-family critics, held-out scenarios, seeded gaps and reproduction by a person are required for claims a board relies on. (3) Of the seven assessed, two failed a held-out re-test and five remain verified with limited independence. The other eighteen are not assessed by the statement, so the figure of 25 carries that qualification.
Chapter 16	1A · 2C · 3B (1) An unreleased gap list would shorten an adversary's work, so it is FC-4. At Hansa Mutual the list of nine unverified priority techniques is the FC-4 gap list, while the board sees 25 of 34 as FC-1. (2) The runner has a task-scoped identity, no read of the register and append-only writes. The side that tests does not hold the means to edit the record of what it found, which is where the independence principle reaches this chapter. (3) Redaction is done by a rule-based gateway before the call. A model that is asked to redact has received the unredacted content, so the exposure has already happened.
Chapter 17	1D · 2B · 3A (1) Asserted means no test by the organisation or an independent party, only a statement by a provider, vendor or owner. It does not count as covered; it becomes evidence when a test, such as an injected test, is seen. (2) The record is derived and rebuilt whenever a regression case, an evidence manifest or an assertion changes. The status is computed by a deterministic rule, so an agent cannot raise a technique to verified, and a person only declares. (3) The conversion reproduced 25 verified of 34. Four of the nine not verified had been green on the old map because their last result was a pass and the map had no age; the other five were already visible as failed or never tested.
Chapter 18	1C · 2A · 3D (1) Findings closed can be gamed by closing on merge, closing by acceptance or reclassifying a repeat as new. The chapter reports finding half-life, which counts only verified closure, and recurrence instead. (2) No measure is computed per named person, and a role held by one person is that person, so by-owner and by-shift figures are excluded. The catalogue lists person, role held by one person and shift as forbidden grain. (3) The adversarial mechanism concerns agents that respond to the measure, people and, in this book, software. The chapter says AI makes this form faster, which is why part of the instrument is hidden and a person reproduces a sample.
Chapter 19	1B · 2C · 3A (1) The in-house model gives speed and depth and leaves exposed overfitting to one's own habits and a loop nobody outside questions. The other options are the exposures of the contracted, sovereign or sector, and hybrid models. (2) For the pair authors the change and closes the finding, the table gives countersignature by a named second person and sampling by internal audit. Nordvik Region applies it through the deputy CISO's countersignature. (3) Roles are not delegated; tasks are. The charter lists the agents under a role, and the person who holds the role answers for what they do. Even where the re-test runner records a result, the closure owner signs every closure.
Chapter 20	1A · 2D · 3B (1) Tier 2 covers high severity or any priority technique: the CISO, or the group CISO at Hansa Mutual, accepts, the management body is informed, and the longest expiry is 90 days. The author, the closure owner and the tester may not accept. (2) D5 is not the mirror of stop. It needs the white-team lead with the owner of the system concerned, after review and confirmed clean-up, and the exercise restarts at a lower level. No agent holds D5. (3) The standing rule is that no alert is closed as an exercise without a match in the tag ledger. When the match fails, D6 freezes the exercise and the incident is handled as real, so the ledger must be readable without the tester.
Chapter 21	1C · 2B · 3D (1) A TLPT is a regulated project the loop receives: covert, threat-led, run by testers who meet Article 27. Continuous emulation is kept apart from it, and a hold list keeps the pipeline from masking or revealing the test. (2) NIS 2 Article 21(2)(f) lists policies and procedures to assess the effectiveness of cybersecurity risk-management measures. In Nordvik Region's register it is met by coverage records and evidence manifests with an age. (3) The offences concern conduct without right. Authorisation comes from the owner or right holder of each asset, which is why the manifest carries a consent field per boundary and a default-deny policy point.
Chapter 22	1B · 2A · 3C (1) Testing against the provider's platform is outside the organisation's authority to permit and is excluded in every manifest. The pipeline and response-chain crossings are allowed with the provider's consent given in advance in the contract. (2) The rule is to share the technique and the expected evidence and never the target mapping. FC-1 and FC-2 content leaves through a deterministic sanitiser and a named release authority; systems, the gap list, findings and evidence stay inside. (3) The test stops at proof, the line of testing ends, and the report goes to the supplier. Where the vendor has no channel or does not answer, NIS 2 Article 12(1) provides the CSIRT designated as coordinator.
Chapter 23	1B · 2D · 3A (1) The tester answers for the quality of findings, the engineer for the change and a named person for each closure. The shared target is verified coverage with evidence age, time from finding to verified control and the held-out catch. (2) The session record names roles and systems and not people: the triage class closed the alert. Names appear only where a person holds a decision, and the facilitator asks what the system made easy. (3) In employment an employee can rarely refuse without consequence, so consent is a weak basis. Protection comes from governance: the representatives see the scenario in advance, the result belongs to the control, and staff are debriefed the same day.
Chapter 24	1C · 2A · 3D (1) The framework's first design decision is that the adversary's mind has an address: SD-03, writing a novel held-out scenario from an objective and constraints, and EE-03, adapting when a step fails and deciding what to leave out. (2) None of the measurements concerns red teaming. They show that unaided performance can fall in other fields depending on use. The verdict leaves erosion open and points to what can be designed: a protected share, an apprenticeship route, a craft register and teaching contracts. (3) The decision ties autonomy to the craft register: the runner keeps Level 3 for S1 only while at least two operators have shown they can run a scenario by hand, EE-02, unaided in twelve months. Four of the five had at the date of the decision.
Chapter 25	1D · 2B · 3C (1) The chapter states that the futures do not differ on whether independence is needed; they differ on where it lives. In Future A it lives between teams, in Future B between people and model families with an outside tester, in Future C with a human verifier. (2) Observable trends justify commitment and expected trends preparation. Speculation is plausible but unsupported, so it justifies keeping a decision reversible; the most consequential speculations are those that would remove a safeguard. (3) The verdict separates the title's questions: whether independence between the side that tests and the side that is tested is needed in 2036 is expected, while the organisational form that provides it is speculation.
Chapter 26	1A · 2C · 3D (1) Purple theatre is a session with no re-test. Its early signs are findings that carry a change identifier and no re-test log, and a closure date equal to the merge date. The other signs belong to patterns 2, 7 and 8. (2) Overfitting arises when the test becomes the target. The control is to draft from behaviour and not from a log line, include variants and a negative control in every regression case, and watch the gap on a held-out share. (3) The chapter states that no case shows AI made the loop unnecessary or unsafe in itself. Loops fail where a step was reasonable and a question was not asked, and the controls are few and the book's own.
Chapter 27	1B · 2D · 3C (1) The first thing the chapter draws from the year is that every failure was found by the loop and not by an incident: a scheduled variant, an exercise against an agent, an independence review, a drill. (2) AIDR-0841 answers AIDR-0800 by reporting the exercise programme as a verified share with its list, reasons and age: two of nine verified within expiry, three tested and failed, two asserted by the provider and two not tested. (3) Every recovery had the same three parts: a local and immediate containment, a fix made by one person and a re-test by another. It is the pattern of P4 Improve and P5 Verify with independence at closure.
Chapter 28	1C · 2A · 3B (1) The Region owns the priority list, the register, closure and the stop, and buys the offensive work, monitoring and seeded incidents. Its conclusion is that the loop is worth the terms on which its evidence can be inspected, so it asks the contract to carry what the team cannot. (2) Every increase in delegation is written as a gate on recorded evidence with a named grantor and a first review 90 days later. At Hansa Mutual the group AI governance board grants, and delegation is withdrawn below a seeded-gap catch of 0.8. (3) Both are asked to stop counting scenarios run or findings closed as progress and to replace them with verified share with age, the held-out gap, cycle time and seeded catch, as on the board page of Chapter 18.
Chapter 29	1D · 2B · 3A (1) Part 3 held in part. The strong form, that a machine-only loop verifies nothing new, was refined, because regression and replay are mechanical and a machine can show that something known to work still works. (2) The chapter states that two rules carry the book, the closure rule and the independence principle, and that a reader who keeps only these has kept most of it. Six further rules serve them. (3) The closure owner's first step is to test one closed finding against the closure rule: re-test date, variants and signer. The other options are the first steps of the white-team lead, the CISO and the procurement lead.

Final assignment

A loop charter with evidence for one service. Design the purple loop for one service of your own organisation, or for the benefits-triage service of Nordvik Region or the claims estate of Hansa Mutual, and carry one finding through all five stages on paper. The work is defensive and authorised by construction: adversary behaviour appears only by ATT&CK or ATLAS identifier, every emulation is scoped by written rules of engagement against the organisation's own or the fictional organisations' systems, and every finding ends in a defensive improvement. The result is a package a CISO could sign and an auditor could check: who targets, who emulates under which rules, how outcomes are observed, how a finding becomes a change, how it is verified, how independence is shown, and what is reported as covered and as not tested.

Assessment criteria

Every stage has a record, an owner and a date, and the five stages are named exactly
The finding is closed only by a re-test with a variant, attached evidence and a named signer who did not author the fix
Emulation is defensive only: identifiers and parameters, signed scope, a stop outside the system stopped and nothing irreversible delegated
Coverage is stated with what was tested, when and with what result, and independence is declared across the five kinds
No measure or record ranks a named person, and staff safeguards are stated where an exercise involves people