The Future of the Role: Will There Be a Security Architect in 2036? · The Transformed Security Architect: the course

All courses / The Transformed Security Architect / Module 5 / Chapter 23

Learning objectives

After the lesson the participant can:

Classify trends affecting the role as observable, expected or speculation and state what each label justifies.
Describe the four scenarios for 2036 with the leading signal of each and what would be lost.
Define computable signals with thresholds and owners for at least one scenario.
Explain why the seven no-regret measures hold whichever scenario arrives.

Key concepts

Horizon register for a role: A file beside the role charter in which every trend carries a label, its sources, the artefacts it affects and the decision it supports. It is kept by the role's holders but approved by the CISO, because holders have an interest in a particular answer.
Commitment, preparation, reversibility: What the three labels justify: observable trends are documented now and justify commitment; expected trends rest on a stated trend or decided instrument with uncertain timing and justify preparation; speculative trends justify keeping decisions reversible.
Four scenarios: Absorbed into platform engineering, a governance role, commander of agent teams, and the role disappears. They are speculation by construction; the most likely future is a mixture whose proportions differ by organisation.
Signal: A measure that can be computed, has an owner and has a threshold, preferably a ratio computed from repositories and team-level records. The share of architecture changes at each autonomy level is the clearest signal of which scenario is arriving.
No-regret measures: Seven measures that hold across all four scenarios: keep the craft, express boundaries as code with named owners, write decision rights down, register the role's own delegations, evidence competence with and without AI, protect the entry route, and keep the stop path outside what it stops.

Interactive exercises

Do them here and get feedback at once. Choose a card and then where it belongs, or drag it.

Interactive exercise 1 · Sort

Observable, expected or speculation

Sort each trend under the label the chapter's horizon register gives it.

Interactive exercise 2 · Match

Four scenarios and their leading signals

Match each scenario for 2036 to the leading signal Table 23.1 gives for it.

Teaching plan

10 min	The teacher opens with the conflict of interest in a profession forecasting itself, and the purpose of scenarios as changing perception, not prediction.
15 min	Sorting activity: participants receive the chapter's trends on cards and place each under observable, expected or speculation, then compare with the chapter.
10 min	Groups each take one scenario and present its leading signal and what would be lost, using Table 23.1.
20 min	Exercise: participants write a register excerpt for their own role with trends, signals with thresholds and the status of the no-regret measures.
5 min	Wrap-up: the teacher reads the author's judgement, labelled as a projection, and asks what evidence would change it.

Discussion

The chapter calls the disappearance of the role the least likely and the most dangerous scenario, because it would come as a sequence of sensible delegations. Which delegations in your organisation could no longer be taken back?
Nordvik's leading signal is the share of tender requirements the post-holder wrote and can verify unaided. What would be the equivalent signal for your own role?
Why does Hansa's register give the signal for loosening changes merged at Level 3 a threshold of one?

Written exercise

Exercise · 20 minutes

Keep a horizon register for your role

Write the first version of a horizon register for the security architect role in your organisation. Enter five trends from the chapter, each with a label of observable, expected or speculation, its source or a statement that it is your organisation's own judgement, the artefacts it affects, such as the role charter, competence records, hiring profiles or tier policy, and the decision it supports. Choose the scenario you consider nearest and name at most three signals for it, each computed from repositories or team-level records, with a current value if known, a threshold and an owner. List the seven no-regret measures with their status. Name the owner, the approver and the review date before the budget and hiring plan are set.

Deliverable: A register excerpt in the form of HZN-HM-SA-01 with five labelled trends, up to three signals with thresholds and owners, and the status of the seven no-regret measures.

Your work

Self-test

Choose an answer to see whether it is right, or open the answer below each question.

How does the chapter label the trend that agents become reliable enough to verify architecture proposals without a competent human reviewer?
Show the answer
B. Speculation: no evidence was found, and evaluators favouring their own output argue against it
Reliable verification of AI by AI is labelled speculation. Chapter 14 found no evidence for it, and the finding that language-model evaluators recognise and favour their own generations argues against assuming it.
In the scenario where the architect becomes a commander of agent teams, what does the chapter say would be lost?
Show the answer
D. The route by which commanders and verifiers are made
What would be lost is the route by which commanders are made, because an architect who has never written a threat model unaided cannot verify the one an agent drafts. The scenario is stable only if learning tasks are reserved.
Who keeps and who approves the horizon register for the role, and why?
Show the answer
C. The role's holders keep it and the CISO approves it, because holders alone would drift towards reassurance
Because of the conflict of interest, the register is kept by the role's holders but approved by the CISO, with signals computed from repositories and records where possible; a register that only the holders maintain will drift towards reassurance.