This chapter follows four people through 2027, the first year in which the two organisations of this book run the blue team that Chapters 1 to 25 describe: Karin Lund, senior security analyst and detection owner at Nordvik Region; Piotr Nowak, shift lead at the Polish service centre of Hansa Mutual's group SOC; Lena Vogel, detection engineering lead in Hamburg; and Thomas Brandt, chair of Hansa Mutual's Konzernbetriebsrat. It tells the year as a sequence of dated decisions, records and measures, and it concerns all five blue team functions: B1 Anticipate, B2 Detect, B3 Investigate, B4 Respond and B5 Learn. It adds no new method; it shows what the methods look like when they meet a calendar, a night shift, a works council and a budget.
Both organisations received the same question in autumn 2026, after the July 2026 incident. Nordvik Region's regional director asked the CISO what the security unit becomes when AI enters its work (AIDR-0700, 2026-11-23, report due 2027-06-30). A day later Hansa Mutual's board asked the group CISO how the SOC will work when its agents act at night and when adversaries use AI (AIDR-0750, 2026-11-24, first report due 2027-04-30).
Nordvik's security unit of 14 has six analysts working office hours and buys out-of-hours monitoring from a managed security service provider under framework agreement NR-2025-044; Karin Lund, eleven years in the unit, in practice owns the SIEM and its twelve local rules. Hansa's group SOC has about 38 people on a follow-the-sun rota with a detection-engineering team of four. Piotr Nowak leads a shift at the Polish service centre, Lena Vogel leads the detection engineers, and Thomas Brandt chairs the body that co-determines, under BetrVG §87(1) no. 6, on every tool that can monitor employees' behaviour or performance. A SOC full of logging tools is such a place.
Primary topics explored
- The starting position
- January: the charters and the interim letter
- February and March: first rules, first closures, first escape
- April: the incident
- May and June: review, exercise and drill
- July to September: queues, drafts and hunts
About AI Blue
AI Blue is Book 8 of The Transformed Architecture. It examines how the blue team, the people and functions that defend an organisation, is transformed when artificial intelligence takes part in their work: anticipating, detecting, investigating, responding and learning, the team's own AI and how to verify and protect it, operating models, roles, decision rights, regulation and measurement, and the careers and wellbeing of the people involved, for European enterprises and public authorities.
It builds on the conclusions of Architecture as Code, AI Governance, AI Platform and Security, AI Red Team, AI Threat, The Transformed Security Architect and AI Boss.
Chief information security officers, heads of security operations, SOC managers, analysts, detection engineers and incident commanders, security and AI architects, boards and management bodies, procurement leads, works councils and unions, data protection and audit functions, and public-sector leaders.
Gunnar Nordqvist
Conceived, directed and published the books of The Transformed Architecture.
Continue with the full chapter
Chapter 26: A Year on the Blue Team: Nordvik Region and Hansa Mutual in AI Blue gives the detailed explanations, practical examples and implementation patterns behind this summary.
This whitepaper belongs to “Experience and Conclusions” and is one of 32 drawn from the manuscript.