This chapter looks ahead, with the series' discipline, at a question every security leader is now asked: will there be a security operations centre (SOC) in 2036, and if so, what will the people in it do? It concerns all five blue team functions, B1 Anticipate, B2 Detect, B3 Investigate, B4 Respond and B5 Learn, because the future of the team is the future of each function and of who performs it. The chapter treats the outlook as a horizon register in which every trend is labelled observable, expected or speculation, stages the debate between concern and calm, and then does what only this chapter and Chapter 28 may do: it states the author's own projection, labelled as such, with the evidence that would change it.
The chapter builds on the horizon-register method of AI Governance, Chapter 22 (62, Nordqvist, 2026), and on the argument of AI Threat, Chapter 35, that any answer should keep decisions correctable, the stop outside the system stopped, people able to judge the output, dependence reversible and autonomy matched to reversibility (65, Nordqvist, 2026). Chapters 1 to 23 supply the evidence for the present; this is the only place before the conclusion where it is extrapolated.
A forecast of the SOC in 2036 is unreliable by construction. The useful question is which decisions made now stay sensible across the futures the evidence leaves open. A horizon register lists trends, labels each by the strength of its evidence, attaches a measurable trigger and states the posture the team takes meanwhile.
Primary topics explored
- A horizon register
- Three scenarios
- What stays human
- The effect of adversaries
- The debate
- Verdict
About AI Blue
AI Blue is Book 8 of The Transformed Architecture. It examines how the blue team, the people and functions that defend an organisation, is transformed when artificial intelligence takes part in their work: anticipating, detecting, investigating, responding and learning, the team's own AI and how to verify and protect it, operating models, roles, decision rights, regulation and measurement, and the careers and wellbeing of the people involved, for European enterprises and public authorities.
It builds on the conclusions of Architecture as Code, AI Governance, AI Platform and Security, AI Red Team, AI Threat, The Transformed Security Architect and AI Boss.
Chief information security officers, heads of security operations, SOC managers, analysts, detection engineers and incident commanders, security and AI architects, boards and management bodies, procurement leads, works councils and unions, data protection and audit functions, and public-sector leaders.
Gunnar Nordqvist
Conceived, directed and published the books of The Transformed Architecture.
Continue with the full chapter
Chapter 24: The Future of the Blue Team: Will There Be a SOC in 2036? in AI Blue gives the detailed explanations, practical examples and implementation patterns behind this summary.
This whitepaper belongs to “People and Career” and is one of 32 drawn from the manuscript.