Introduction: Putting AI to Work in Cyber Defence

All courses / AI Red Team / Module 1 / Chapter 1

Learning objectives

After the lesson the participant can:

• Explain the three developments that changed the defender's position and why a monthly patch cycle is structurally too slow for the exposed estate.
• Distinguish the usage mode of a security AI capability from its autonomy level, and say why Mode 0 Ambient AI is called the trap.
• State the four rules of the book and justify why they make AI-enabled red teaming acceptable to supervisors, works councils and boards.
• Draft a programme charter that caps usage mode and autonomy by type of action and names who can stop any capability.

Key concepts

AI as an active part of cyber defence

AI does work people cannot do at the required speed or scale, inside boundaries people set, at a level of autonomy that matches the consequences of a mistake, and with evidence of what it did. It does not mean handing the security operation to a model.

Three AI focus areas

The perspective of the NIST Cyber AI Profile on every CSF Category: securing AI systems, AI-enabled cyber defence and thwarting AI-enabled attacks. The profile was published as an initial preliminary draft in December 2025.

Usage mode and autonomy level

The mode describes how the AI is deployed: where it runs, whose identity it uses and what it can reach. The level describes who decides each action, from Level 0 Advisory to Level 4 Autonomous, and belongs to a capability in a context, not to a model.

Three red threads

The usage modes paired with the autonomy levels; the purple loop, in which every finding ends as a verified control and the CSF profile is updated; and security chaos engineering, which injects the conditions a control exists for and checks the outcome.

Programme charter

The mandate for an AI-enabled defence programme. Nordvik Region's charter NR-SEC-PROG-2027 names the scope in CSF terms, the boundaries, the ceilings on usage mode and autonomy level by type of action, the decision rights and the evidence reported to the regional board.

Interactive exercises

Do them here and get feedback at once. Choose a card and then where it belongs, or drag it.

Teaching plan

Discussion

1. Which security products in your organisation already act automatically, and who decided the autonomy level at which they act?
2. Why does the charter cap autonomy by type of action rather than by product, and what would change in a later argument for raising a level if it did not?
3. What would a supervisor, a works council and a board each need to see before accepting AI-enabled red teaming in your organisation?

Written exercise

Self-test

Choose an answer to see whether it is right, or open the answer below each question.

1. According to the chapter, what is the difference between the usage mode and the autonomy level of a security AI capability?

   1. The mode names the model vendor, while the level names the size of the model in use
   2. The mode describes how the AI is deployed, while the level describes who decides each action
   3. The mode describes who decides each action, while the level describes whose identity is used
   4. The mode is set by the AI Act, while the level is set by the NIST Cyber AI Profile
   Show the answer

   B. The mode describes how the AI is deployed, while the level describes who decides each action
   The chapter states that the mode describes where the AI runs, whose identity it uses and what it can reach, while the level describes who decides each action. The two are decided together in Chapter 6.

2. Why does Nordvik Region's charter name the managed security service provider's shift lead among those who can stop any capability?

   1. Because the provider is the legal owner of the Region's alert data during the hours that it monitors
   2. Because NIS 2 requires that an external party holds every stop decision
   3. Because the provider built the SOC triage assistant and holds its credentials
   4. Because an alert is useless if it reaches people who do not hold the stop decision
   Show the answer

   D. Because an alert is useless if it reaches people who do not hold the stop decision
   The chapter draws this from the July 2026 incident: an alert is useless if it reaches people who do not hold the stop decision, and the provider monitors the estate out of hours.

3. Which statement about Level 4 Autonomous is made in the chapter?

   1. It is never used for offensive or irreversible actions
   2. It is the normal level for Mode 1 Conversational assistants
   3. It is required for any agent with an identity of its own
   4. It is the ceiling Nordvik Region sets for containment
   Show the answer

   A. It is never used for offensive or irreversible actions
   The chapter says the level belongs to a capability in a context, not to a model, and that Level 4 is never used for offensive or irreversible actions.