This chapter defines the competences of the transformed blue team and describes how they are built, assessed and evidenced. It treats exercises, not certificates, as the main means of showing what a person can do, and it applies the AI literacy duty of the AI Act to people who supervise agents. It concerns all five blue team functions: B1 Anticipate in hunting and intelligence skills, B2 Detect in detection engineering, B3 Investigate in analysis and in reviewing what AI concludes, B4 Respond in incident command and stop decisions, and B5 Learn in the post-incident review and the exercises that assess competence and feed the learning loop of Chapter 11.
Chapter 21 described the analyst at work. This chapter asks what that analyst, and every other member of the team, must be able to do, and how the organisation knows. The answer builds on a conclusion that runs through the earlier volumes: competence is shown by judgement exercised, not by attendance. Architecture as Code (Chapter 18) managed competence as a skills matrix by level, with certifications that validate knowledge and practical demonstration that shows capability (61, Nordqvist, 2025). AI Governance, Chapter 14, made AI literacy role-specific and asked that it be evidenced in individual records (62, Nordqvist, 2026). The Transformed Security Architect, Chapters 21 and 22, gave the form of a competence record and mapped it to the European Cybersecurity Skills Framework and SFIA (66, Nordqvist, 2026). This chapter carries that approach from the architect to the team that operates the boundaries.
A competence framework lists what people in a function must be able to do, at which level, and what counts as evidence. It is useful only if decisions depend on it: who may approve a containment action at night, who may own a Level 3 closure class, which training a person needs next. A framework that sits in a human resources folder describes people without governing anything.
Primary topics explored
- A competence framework for the blue team
- Competence records
- Exercises as assessment
- Literacy for working with agents
- Training, certification and their limits
- Hiring and upskilling
About AI Blue
AI Blue is Book 8 of The Transformed Architecture. It examines how the blue team, the people and functions that defend an organisation, is transformed when artificial intelligence takes part in their work: anticipating, detecting, investigating, responding and learning, the team's own AI and how to verify and protect it, operating models, roles, decision rights, regulation and measurement, and the careers and wellbeing of the people involved, for European enterprises and public authorities.
It builds on the conclusions of Architecture as Code, AI Governance, AI Platform and Security, AI Red Team, AI Threat, The Transformed Security Architect and AI Boss.
Chief information security officers, heads of security operations, SOC managers, analysts, detection engineers and incident commanders, security and AI architects, boards and management bodies, procurement leads, works councils and unions, data protection and audit functions, and public-sector leaders.
Gunnar Nordqvist
Conceived, directed and published the books of The Transformed Architecture.
Continue with the full chapter
Chapter 22: Competences, Training and Exercises: A Framework for the Transformed Blue Team in AI Blue gives the detailed explanations, practical examples and implementation patterns behind this summary.
This whitepaper belongs to “People and Career” and is one of 32 drawn from the manuscript.