This chapter describes B1 Anticipate, the blue team function that turns reports, feeds and knowledge of the estate into the hypotheses, detection requirements and patch priorities that direct the rest of the team's work, and the part of B2 Detect that it feeds. AI now reads the reports, extracts indicators and techniques, correlates them with the estate and drafts candidate hypotheses. The analyst's job moves from reading to deciding which of those hypotheses matter, and to proving that what the AI extracted is what the source said. The chapter follows the path from report to hypothesis, shows intelligence kept as code, combines the public exposure feeds with local asset context, sets out what AI does well and badly in this work, and ends with the two hazards specific to the function: sources that adversaries can write, and the duty to share.
The chapter builds on conclusions of the earlier volumes. Architecture as Code (Chapter 9C) put threat handling in the codebase: intelligence arrives as STIX and TAXII through pipelines, and findings return as pull requests (61, Nordqvist, 2025). AI Platform and Security, Chapter 18, named patch velocity as a measured service level and detection at machine speed as commitments against AI-enabled adversaries (63, Nordqvist, 2026), and AI Governance, Chapter 24, concluded that patch decisions must be delegated in advance, because a weekly change advisory board cannot sit in the path of a known-exploited vulnerability (62, Nordqvist, 2026). AI Red Team, Chapters 10 and 13, supplied two rules this chapter applies to intelligence: AI proposes at Level 1 Assisted while a named reviewer decides each candidate against its provenance, and everything security AI reads may have been written by the adversary (64, Nordqvist, 2026). The question left open there, how an analyst verifies what an AI concludes when the evidence may be adversary-written and the analyst depends on the AI to read it, is taken up here for intelligence and carried into Chapters 8 and 14.
A report is a claim about the world made by someone else, at a time, for their own purpose. B1 Anticipate converts such claims into three kinds of output the team can act on: a hypothesis (a statement about adversary behaviour that could be true in this estate and can be tested), a detection requirement (a specification for the detection engineers of Chapter 6) and a patch or mitigation priority (a ranking for the owners of the affected systems). A hunt, the subject of Chapter 9, is how a hypothesis is tested when no detection exists yet.
Primary topics explored
- From report to hypothesis
- Intelligence as code
- Exposure at machine speed
- What AI does well and badly
- Verifying extracted intelligence
- Hostile sources
About AI Blue
AI Blue is Book 8 of The Transformed Architecture. It examines how the blue team, the people and functions that defend an organisation, is transformed when artificial intelligence takes part in their work: anticipating, detecting, investigating, responding and learning, the team's own AI and how to verify and protect it, operating models, roles, decision rights, regulation and measurement, and the careers and wellbeing of the people involved, for European enterprises and public authorities.
It builds on the conclusions of Architecture as Code, AI Governance, AI Platform and Security, AI Red Team, AI Threat, The Transformed Security Architect and AI Boss.
Chief information security officers, heads of security operations, SOC managers, analysts, detection engineers and incident commanders, security and AI architects, boards and management bodies, procurement leads, works councils and unions, data protection and audit functions, and public-sector leaders.
Gunnar Nordqvist
Conceived, directed and published the books of The Transformed Architecture.
Continue with the full chapter
Chapter 5: Anticipate: Threat Intelligence and Exposure at Machine Speed in AI Blue gives the detailed explanations, practical examples and implementation patterns behind this summary.
This whitepaper belongs to “The Craft” and is one of 32 drawn from the manuscript.