This chapter describes how to measure a blue team that works with AI without rewarding the wrong behaviour. The measures most security operations centres (SOCs) report, mean time to detect, mean time to respond, closure rate and alert volume, can all improve while fewer intrusions are caught. The chapter proposes measures of speed, coverage, quality of judgement and learning, each paired with the check that shows when it is being gamed, and it shows how they reach the board on one page. It concerns all five blue team functions: B1 Anticipate, through the coverage that intelligence selects; B2 Detect, through verified detections and the cost of alerts; B3 Investigate, through escape rate and the quality of review; B4 Respond, through time to contain and recoverability; and B5 Learn, through the time from finding to verified control. It answers two questions: how a blue team is measured when time to detect and time to respond can be improved by closing alerts faster, and what measures show the quality of its judgement. It also says how measures about people are agreed.
The programme metrics of Architecture as Code (Chapter 9B) are mean time to detect (MTTD), mean time to respond (MTTR) and the false-positive ratio (61, Nordqvist, 2025). They were chosen to push manual response to keep pace with attackers. Mandiant reports a global median dwell time of 14 days for its 2025 investigations, up from 11 days, and reports that organisations first detected malicious activity internally in 52 per cent of cases, up from 43 per cent in 2024 (40, Mandiant, 2026). Speed still matters. The difficulty is that speed measured as an average of closed tickets is a different quantity from speed at which intrusions are caught.
Four measures dominate SOC dashboards, and each rewards a behaviour that AI makes cheaper.
Primary topics explored
- What the old measures reward
- Speed
- Coverage
- Quality of judgement
- Learning
- The board page
About AI Blue
AI Blue is Book 8 of The Transformed Architecture. It examines how the blue team, the people and functions that defend an organisation, is transformed when artificial intelligence takes part in their work: anticipating, detecting, investigating, responding and learning, the team's own AI and how to verify and protect it, operating models, roles, decision rights, regulation and measurement, and the careers and wellbeing of the people involved, for European enterprises and public authorities.
It builds on the conclusions of Architecture as Code, AI Governance, AI Platform and Security, AI Red Team, AI Threat, The Transformed Security Architect and AI Boss.
Chief information security officers, heads of security operations, SOC managers, analysts, detection engineers and incident commanders, security and AI architects, boards and management bodies, procurement leads, works councils and unions, data protection and audit functions, and public-sector leaders.
Gunnar Nordqvist
Conceived, directed and published the books of The Transformed Architecture.
Continue with the full chapter
Chapter 20: Measuring the Transformed Blue Team: Speed, Coverage and Quality of Judgement in AI Blue gives the detailed explanations, practical examples and implementation patterns behind this summary.
This whitepaper belongs to “The Team in the Organisation” and is one of 32 drawn from the manuscript.