Conclusions: AI as an Active Part of Cyber Defence

All courses / AI Red Team / Module 8 / Chapter 28

Learning objectives

After the lesson the participant can:

Restate the book's thesis and explain what each of its clauses contributes.
Explain the eight cross-cutting conclusions and how they form a chain.
Analyse the three tensions and how each is resolved in the book.
Draft a first-90-days plan with milestones mapped to CSF Categories and explicit guardrails.

Key concepts

The thesis: AI strengthens cyber defence across every CSF Function when it acts inside a written mandate, in a usage mode and at an autonomy level matched to the reversibility of its actions, on a platform where containment holds whatever anyone intends, under continuous verification, and in a purple loop.
Autonomy earned action by action: Autonomy is a property of each action, not of an agent. A defensive AI may act without per-action approval when the action is reversible, bounded, pre-approved through the decision tiers and covered by a stop path that people hold.
Three tensions: Speed versus control, resolved by action-by-action autonomy and continuous red teaming of the ceiling; autonomy versus accountability, resolved by every level being a recorded decision of a named forum; innovation versus sovereignty, resolved by self-hosting or by routing by data class and market overlay.
Evidence and judgement: The evidence supports the threat picture, the speed of exploitation and the conclusions that prompt injection is architectural and that containment must not depend on intent. The autonomy levels, ceilings and defaults are design choices, and the two organisations are illustrations, not data.
The open question: Whether evaluation can carry assurance when models recognise test settings remains open: production-like testing and chaos experiments help but do not settle it, and it may shape how much autonomy any organisation can justify.

Interactive exercises

Do them here and get feedback at once. Choose a card and then where it belongs, or drag it.

Interactive exercise 1 · Match

First action per usage mode

Match each usage mode to the first action the concluding chapter recommends for it.

Interactive exercise 2 · Sort

Looking forward: three labels

Sort each statement from the chapter's outlook under the label the chapter gives it.

Teaching plan

10 min	The teacher restates the thesis and asks participants to name the chapter that carries each clause.
20 min	Groups each take two of the eight conclusions, state the strongest objection to them and answer it from the book.
10 min	Review the table of answered and open questions and the outlook labelled observable, expected and speculation.
25 min	Exercise: participants write a first-90-days plan for their own organisation, modelled on the consolidated plan in the chapter.
10 min	Closing round: each participant names the one decision they will put to their management body and the evidence they will bring.

Discussion

Covering every CSF Function prevents tunnel vision. Which Function has your organisation's use of AI in security neglected, and what would the first gain there be?
The book says legal, privacy, procurement and works-council representatives are part of the design, not reviewers at the end. What would change in your programme if that were true?
If evaluation cannot fully carry assurance, what follows for how much autonomy your organisation should justify, and on what else should it rely?

Written exercise

Exercise · 25 minutes

Write a first-90-days plan

Write a plan for the first 90 days of an AI-enabled defence programme in your organisation, modelled on the consolidated plan in the chapter. Set six dated milestones, each with a deliverable and the CSF Categories it serves, covering at least: the programme charter with usage-mode and autonomy ceilings, the inventory of security AI including vendor features that act automatically, standing rules of engagement, a CSF profile as code with obligation mapping, a first Mode 4 capability at a low autonomy level with quality evaluation, and a first restore drill and purple session. State the guardrails: maximum usage mode, maximum autonomy level, what offensive work requires and where security data may be processed. Name the owner and the body the plan reports to.

Deliverable: A first-90-days plan with six dated milestones mapped to CSF Categories, explicit guardrails, an owner and a reporting line.

Your work

Self-test

Choose an answer to see whether it is right, or open the answer below each question.

According to the first cross-cutting conclusion, what sets the risk of security AI?
Show the answer
C. The usage mode, not the model
The same model can be a low-risk aid or a high-risk insider. In Modes 1 and 2 a person judges with their own identity; in Mode 5 the AI acts with permissions of its own.
Which inherited question does the chapter still list as open?
Show the answer
B. Whether evaluation can carry assurance when models recognise tests
Q4 is open: production-like testing and chaos experiments help but do not settle it. The questions on per-action approval, emulation in threat-led testing and containment testing are listed as answered.
Which action does the chapter place in the first 0 to 6 months?
Show the answer
D. Write the mandate and inventory security AI in every usage mode, including vendor features
First come the mandate, the inventory, a CSF profile as code, one Mode 4 capability at Level 0 or 1 and restore drills. Purple sessions and chaos engineering in test come next; Level 3 and production experiments come later.