This chapter judges the book's thesis against the evidence of Chapters 1 to 27, answers the twelve questions the book took up, gives the author's labelled projection of which blue team functions a person, a system or a person conducting systems should perform in 2036, and says what a reader in five roles can do on Monday. It concerns all five functions: B1 Anticipate, B2 Detect, B3 Investigate, B4 Respond and B5 Learn. It also closes the argument that the series has made since Architecture as Code, and it does so for the people who defend an organisation.
A word on method before the verdicts. The evidence of this book is of four kinds: research and agency sources that the chapters cite; conclusions that the earlier volumes of the series established; design reasoning of the book's own; and the illustrative cases of Nordvik Region and Hansa Mutual, who are fictional. None of it is a measured outcome from a real security operations centre (SOC) observed over several years. When this chapter says that a part of the thesis held, it means that it survived the tests that the book could apply: the literature, the instruments, the design and the worked cases. It does not mean that it is proved.
The working thesis of Chapter 1 had five parts, and Chapter 1 gave each its own refutation: the evidence that would show it wrong. Each part is judged below against the chapters that tested it. A verdict is one of four: held, where the evidence available to the book supports the claim and no chapter found a counter-case; held with qualifications, where the claim survived but the book itself found cases that limit it; held in part, where a chapter refined it; and argued but not proved, where the book offers design and argument but no outcome evidence. No part earned a plain held.
Primary topics explored
- The thesis tested
- The twelve questions
- The author's projection for 2036
- What would change the view
- What to do on Monday
- The series' argument
About AI Blue
AI Blue is Book 8 of The Transformed Architecture. It examines how the blue team, the people and functions that defend an organisation, is transformed when artificial intelligence takes part in their work: anticipating, detecting, investigating, responding and learning, the team's own AI and how to verify and protect it, operating models, roles, decision rights, regulation and measurement, and the careers and wellbeing of the people involved, for European enterprises and public authorities.
It builds on the conclusions of Architecture as Code, AI Governance, AI Platform and Security, AI Red Team, AI Threat, The Transformed Security Architect and AI Boss.
Chief information security officers, heads of security operations, SOC managers, analysts, detection engineers and incident commanders, security and AI architects, boards and management bodies, procurement leads, works councils and unions, data protection and audit functions, and public-sector leaders.
Gunnar Nordqvist
Conceived, directed and published the books of The Transformed Architecture.
Continue with the full chapter
Chapter 28: Conclusions: The Blue Team Transformed in AI Blue gives the detailed explanations, practical examples and implementation patterns behind this summary.
This whitepaper belongs to “Experience and Conclusions” and is one of 32 drawn from the manuscript.