Before the blue team conducts a team of agents, each analyst already works beside an assistant. This chapter describes that personal use: the queries, drafts and summaries that analysts produce with conversational assistants (Mode 1), assistants embedded in the tools they already use (Mode 2) and agentic work tools (Mode 3), and the discipline needed when the data in front of the analyst is alert content, personal data and evidence. It concerns all five functions: B1 Anticipate (reading and summarising intelligence), B2 Detect (drafting queries and detection logic), B3 Investigate (summarising tickets and building timelines), B4 Respond (drafting communications and updates) and B5 Learn (writing reviews). It covers classification and routing, what must not leave the organisation, the record of AI use in a case, the line between assistance and delegation, shadow AI and the works-council dimension of logging an analyst's own tools. It does not repeat the risk analysis of security for AI systems in AI Platform and Security, Chapter 16; it applies that analysis to the work of the security operations centre (SOC).
Four conclusions of the earlier volumes frame the chapter. First, the usage mode, not the brand of the tool, sets the governance (AI Governance, Chapters 2 and 25) (62, Nordqvist, 2026): in Modes 1 to 3 the AI acts with the analyst's own identity and permissions, which is why this chapter is about the analyst's discipline rather than about an agent's mandate (AI Red Team, Chapter 6) (64, Nordqvist, 2026). Second, natural language is an instruction channel that the model cannot police, so what the assistant reads can steer it (AI Platform and Security, Chapter 16) (63, Nordqvist, 2026). Third, vendor AI in security products may act or process data at a level nobody decided, the Mode 0 blind spot (AI Red Team, Chapter 8). Fourth, the rule "agents draft; humans approve" (Architecture as Code (Chapter 20)) (61, Nordqvist, 2025) holds for the individual analyst as much as for an agent team: the analyst remains the accountable author of whatever enters a case, a detection or a message.
An analyst's use of AI is not one activity. It is a dozen small ones spread across the five functions, and the risk differs for each. Consider a shift at the Polish service centre. The analyst asks an assistant to summarise a threat report that arrived overnight (B1). A colleague asks it to turn a hypothesis into a query for the group SIEM (B2). During an investigation the analyst pastes a ticket history and asks for a timeline (B3). Later the analyst drafts an update for the duty manager and a notice for the affected business unit (B4). At the end of the week the analyst asks for a first draft of a post-incident review (B5).
Primary topics explored
- Starting points from the earlier volumes
- A day with an assistant
- Classification and routing
- What not to paste
- Recording use
- Assistance versus delegation
About AI Blue
AI Blue is Book 8 of The Transformed Architecture. It examines how the blue team, the people and functions that defend an organisation, is transformed when artificial intelligence takes part in their work: anticipating, detecting, investigating, responding and learning, the team's own AI and how to verify and protect it, operating models, roles, decision rights, regulation and measurement, and the careers and wellbeing of the people involved, for European enterprises and public authorities.
It builds on the conclusions of Architecture as Code, AI Governance, AI Platform and Security, AI Red Team, AI Threat, The Transformed Security Architect and AI Boss.
Chief information security officers, heads of security operations, SOC managers, analysts, detection engineers and incident commanders, security and AI architects, boards and management bodies, procurement leads, works councils and unions, data protection and audit functions, and public-sector leaders.
Gunnar Nordqvist
Conceived, directed and published the books of The Transformed Architecture.
Continue with the full chapter
Chapter 12: The Analyst's Own Use of AI: Querying, Drafting and Summarising in Modes 1 to 3 in AI Blue gives the detailed explanations, practical examples and implementation patterns behind this summary.
This whitepaper belongs to “The Blue Team's AI Team” and is one of 32 drawn from the manuscript.