The Transformed Security Architect: the course

All courses / The Transformed Security Architect

About the course

The course follows The Transformed Security Architect, Book 6 of The Transformed Architecture. It starts with the question management bodies began to ask in 2026, whether security decisions can keep pace with what now acts in the estate, and defines the four shifts that answer it. It then teaches the craft as executable artefacts: models, threat models, containment profiles, identity records, a control catalogue, timed stop paths and recovery definitions. It covers the architect's own AI team and the review that keeps it honest, the role's place among forums, regulation and suppliers, competence and career, and a year of experience at two fictional organisations. It matters because every boundary still needs a person who can answer for it.

After the course the participant can

Explain the four shifts in the security architect's work, their evidence, their dependencies and the failure mode of each
Draft a role charter with a mandate, accountabilities, decision rights with time limits, and exclusions, and test it against past decisions
Design a boundary as a containment profile and identity record that hold whatever the contained party attempts, with tests run from outside
Classify controls as verified, declared or failed from a catalogue entry with a falsifiable objective, a test and evidence with a fail condition
Specify time as a design property through patch-velocity classes, delegated decisions and a timed stop drill
Write a mandate manifest for AI tools or agents and review AI-proposed changes by tier with techniques that do not trust the proposer
Translate articles of the AI Act, NIS 2, DORA and the Cyber Resilience Act into controls, tender requirements and a one-page report for a management body
Plan how competence is evidenced with and without AI, how the craft is kept, and how the practice develops over 24 months

Who it is for

Security architects and those moving into the role from security engineering, enterprise architecture, development or audit
CISOs and heads of security architecture who must define, staff and fund the role
Enterprise, solution and AI architects who share seams with the security architect
HR, competence and hiring leads responsible for security architecture posts
Public-sector procurement leads who hold security boundaries through tenders and contracts
Risk, compliance and internal audit staff who assess security architecture and its evidence

Before the course

Working experience of information security or IT architecture in a large enterprise or public authority
Familiarity with the usage modes, Mode 0 Ambient AI to Mode 5 Autonomous production agents, and the autonomy levels, Level 0 Advisory to Level 4 Autonomous, as introduced in AI Governance and AI Red Team
Ability to read simple configuration files and policy rules; no programming is required to follow the exercises
Helpful but not required: Architecture as Code and AI Platform and Security, on which the craft chapters build

Material

Three ways to run it

The same material in three lengths. Each row of an agenda names the lessons it draws on.

Executive briefing90 minutes

For management bodies, executive teams, regional directors, CISOs and the heads of risk and internal audit

A briefing for the people who commission and fund the role. It frames the question, presents the four shifts and the role charter, shows what a management body should ask to see, from a timed stop path to control status in three counts, and ends with the decisions the two fictional organisations put to their governing bodies.

0:00	The question that reached the board in 2026, and the thesis that the role is transformed, not abolished Ch. 1
0:15	The four shifts, how they depend on one another and how each fails when taken too far Ch. 3
0:30	The role charter: decision rights with time limits, and why the management body keeps the accountability the law names Ch. 4, Ch. 18
0:45	What to ask for: time to stop from a drill, patch velocity, and controls counted as verified, declared or failed Ch. 9, Ch. 10, Ch. 19
1:00	When AI drafts the architecture: review quality, the craft and autonomy that rises last Ch. 14, Ch. 15
1:15	Two organisations, two plans, and at most three decisions for this body; discussion Ch. 26, Ch. 27

One-day seminar1 day

For security architects, CISOs, enterprise and AI architects, platform leads and internal auditors working together on one organisation's practice

A working day that takes one practice through the book's main artefacts. Participants assess their practice on the four shifts, draft decision rights, design a containment profile with a stop drill, classify controls, tier AI-proposed changes and decide which decisions leave the review board, ending with a diagnostic for anti-patterns and first steps.

09:00	The question, the inherited practice and the four shifts; shift assessment of the participants' own practice Ch. 1, Ch. 2, Ch. 3
10:00	Workshop: decision rights for the role charter, tested against past decisions Ch. 4
11:00	Boundaries and identity: containment profile in six questions and review for correlated controls Ch. 7, Ch. 8
12:00	Lunch break
13:00	Controls and time: verified, declared or failed, patch-velocity classes and a timed stop drill plan Ch. 9, Ch. 10
14:00	The architect's AI team: mandate manifest, review tiers and the signals of rubber-stamping Ch. 13, Ch. 14
15:00	Gates instead of meetings: tier policy and expiring exceptions; regulation mapped to controls Ch. 17, Ch. 18
16:00	Diagnosing anti-patterns in the practice, what to do first, next and later, and close Ch. 24, Ch. 27

Full course8 weeks, with Part II and Part IV over two weeks each

For practising and prospective security architects, and the CISOs, architects, auditors and competence leads who work with them

The complete course: 27 lessons in six modules, one module per part of the book, each opened by a lecture on the argument of the part. Every lesson produces an artefact of the kind its chapter describes, and the artefacts accumulate into the capstone, a security architecture practice file for the participant's own organisation or for Nordvik Region or Hansa Mutual.

Week 1	Module 1, The Role in Question: the commission, the practice audit, the shift assessment and the role charter Ch. 1, Ch. 2, Ch. 3, Ch. 4
Week 2	Module 2, The Craft, first half: the model and policy as code, generated threat models, boundaries and containment Ch. 5, Ch. 6, Ch. 7
Week 3	Module 2, The Craft, second half: identity for non-human actors, the control catalogue, machine speed and recoverability Ch. 8, Ch. 9, Ch. 10, Ch. 11
Week 4	Module 3, The Architect's AI Team: own use of AI, the agent team, verifying AI proposals and keeping the craft Ch. 12, Ch. 13, Ch. 14, Ch. 15
Week 5	Module 4, The Role in the Organisation, first half: the role map, decision forums and gates, regulation as constraint Ch. 16, Ch. 17, Ch. 18
Week 6	Module 4, second half: communicating to five audiences; public authorities and multinationals Ch. 19, Ch. 20
Week 7	Module 5, Competence and Career: the competence framework, learning and hiring, the horizon register Ch. 21, Ch. 22, Ch. 23
Week 8	Module 6, Experience and Conclusions: anti-patterns, a year in the role, two plans and the conclusions; capstone presentations Ch. 24, Ch. 25, Ch. 26, Ch. 27

Modules and lessons

One module for each part of the book and one lesson for each chapter. A lesson has learning objectives, key concepts, a teaching plan, discussion questions, an exercise and a self-test.

Module 1 · Part I · The Role in Question

Part I asks what has happened to the security architect now that architecture is code and agents act in the estate. It frames the thesis that the role is transformed, not abolished, describes the inherited practice fairly, defines the four shifts with their evidence and failure modes, and ends with the role charter kept as code. Participants leave with a framed commission, an audit of their inherited practice, a shift assessment and a first set of written decision rights. Lecture: Transformed, not abolished: the security architect in question

Module 2 · Part II · The Craft

Part II is the craft of the transformed security architect. Seven lessons move the work from documents to executable design: the architecture model and policy as code, threat models generated on every change, boundaries and containment that hold whatever an actor intends, identity for workloads and agents, the control catalogue with its evidence, time as a design property, and recoverability. Participants leave with the artefacts themselves: a boundary rule, a threat model entry, a containment profile, an identity record, a control entry, a timed stop drill and a reversibility test. Lecture: The craft: boundaries that hold, shown to hold, in time

Module 3 · Part III · The Architect's AI Team

Part III follows Shift 4, from sole author to conductor of an AI team, from one assistant to a governed agent team. Four lessons cover the architect's own use of AI in Modes 1 to 3, an agent team under a mandate manifest enforced outside the agents, review for soundness by techniques that do not trust the proposer, and the practices that keep the craft on which verification depends. Participants leave with a mandate manifest, a tiered review protocol, a review record and a craft-keeping programme. Lecture: The conductor must still be able to play

Module 4 · Part IV · The Role in the Organisation

Part IV places the security architect in the organisation. Five lessons cover the role map and its four seams with the AI architect, decision tiers and gates in place of meetings, European regulation read as engineering constraints, communication to five audiences from one source, and the two settings that change the role most: the public authority that procures and the multinational under many legal regimes. Participants leave with a role map, a tier policy, an article-to-control mapping, a one-page board report and a testable tender requirement. Lecture: From the door to the design: decision rights in the organisation

Module 5 · Part V · Competence and Career

Part V asks what a person must be able to do to hold the transformed role, how anyone can tell, and whether the role has a future. Three lessons cover a competence framework kept as code with six domains and four levels evidenced with and without AI, learning paths, certification, hiring and upskilling, and a horizon register with four scenarios for 2036. Participants leave with an assessment plan, an interview exercise that tests judgement in two conditions and a register of signals for the role. Lecture: Competence that shows without the assistant

Module 6 · Part VI · Experience and Conclusions

Part VI turns from the craft to the experience of practising it. Four lessons cover three cases and five anti-patterns with a diagnostic, one year in the role at Nordvik Region and Hansa Mutual with what went wrong as well as what worked, the answers each organisation gave and its 24-month plan, and the book's conclusions with their firmness and a first-90-days plan. Participants leave with a diagnosed practice, a year review with a went-wrong field, a funded plan in which autonomy rises last, and their own first steps. Lecture: What a year in the role teaches: order, failure and people

Final assignment

Capstone

A security architecture practice file for one organisation

Assemble the artefacts of the course into one practice file for a single organisation: your own, or Nordvik Region or Hansa Mutual as the book describes them. The file must show the role with written decision rights, one boundary designed and tested, one control with evidence, one timed property, the rules under which AI takes part in architecture work, and a plan in which autonomy rises last. Every claim in the file is classified as verified, declared or failed, and every artefact names an accountable person by role. Present the file as a one-page report asking a management body for at most three decisions. Security content stays at the level of design, review, detection and drills.

Steps

Frame the commission as a decision record and assess the practice on the four shifts with evidence links and dependency flags.
Write the role charter section: mandate, decision rights with tiers and time limits, exclusions, and a test against five past decisions.
Design one boundary: a containment profile or tender annex with blast radius statement, identity record, stop holders and tests run from outside.
Write one control entry with a falsifiable objective, test, evidence and status, and plan one timed stop drill with its budget.
Write the rules for AI in the practice: a mandate manifest, review tiers, a review-quality measure at team level and a craft-keeping cadence.
Draft the 24-month plan against the binding constraint and the one-page report with at most three decisions.

Deliverables

A practice file containing the decision record, shift assessment, charter section, boundary artefact, control entry, drill plan and mandate manifest
A 24-month plan with owners, verifications and conditional autonomy increases
A one-page report for the management body with indicators, at most three decisions and a statement of what is not known
A ten-minute presentation of the file and its open questions

Assessment criteria

Faithfulness to the book: the four shifts, usage modes, autonomy levels and artefact names are used exactly, and nothing is invented.
Testability: every boundary, control and time claim has a test that can fail, an owner and a status of verified, declared or failed.
Accountability: each decision right resolves to one holder, no agent approves or is accountable, and Level 4 Autonomous is never used for irreversible actions.
Honesty of evidence: declared and unmeasured items are stated as such, and AI-drafted parts are disclosed with their verifier.
Usefulness to the reader: the report asks for at most three decisions, each with cost, reversibility and consequence of not deciding.