In the autumn of 2026 two governing bodies asked the same question about the same function. Nordvik Region's regional director asked the chief information security officer (CISO) what the security unit becomes when AI enters its work (AIDR-0700). Hansa Mutual's executive board asked the group CISO to show how the security operations centre (SOC) will work when its agents act at night and when adversaries use AI too (AIDR-0750). Chapter 26 followed four people through the year that answered them. This chapter draws the book together into a conclusion and a two-year plan for each organisation, across all five blue team functions: B1 Anticipate, B2 Detect, B3 Investigate, B4 Respond and B5 Learn. It compares the two, says what each should stop doing and limits what each takes to its management body to three decisions that are still open.
Both organisations are fictional and the year is illustrative. The recommendations are the book's own conclusions from Chapters 4 to 26, drawn here and not forecast: they say what a good choice looks like given what the records of the year showed. The plans run from 2027-10-01 to 2029-09-30.
The series makes one argument: keep decisions as records that can be corrected, keep the ability to stop outside the system being stopped, keep people able to do the work and judge the output, keep dependence reversible, and match autonomy to reversibility (65, Nordqvist, 2026). AI Boss added a commitment for people: a named person sits in the chair for every consequence, and no decision about a named person's access to work is delegated at Level 4 Autonomous (67, Nordqvist, 2026). This book applied the argument to a team through a team charter, a delegation profile per function and action class and a delegation register (Chapter 4), built on the autonomy levels of AI Red Team, Chapter 6, and the role charter of The Transformed Security Architect (64, Nordqvist, 2026) (66, Nordqvist, 2026). Every measure below is one of those commitments made testable.
Primary topics explored
- Nordvik Region: the plan
- Hansa Mutual: the plan
- Similarities and differences
- Decisions for the management body
- Measures and review
- What each should stop doing
About AI Blue
AI Blue is Book 8 of The Transformed Architecture. It examines how the blue team, the people and functions that defend an organisation, is transformed when artificial intelligence takes part in their work: anticipating, detecting, investigating, responding and learning, the team's own AI and how to verify and protect it, operating models, roles, decision rights, regulation and measurement, and the careers and wellbeing of the people involved, for European enterprises and public authorities.
It builds on the conclusions of Architecture as Code, AI Governance, AI Platform and Security, AI Red Team, AI Threat, The Transformed Security Architect and AI Boss.
Chief information security officers, heads of security operations, SOC managers, analysts, detection engineers and incident commanders, security and AI architects, boards and management bodies, procurement leads, works councils and unions, data protection and audit functions, and public-sector leaders.
Gunnar Nordqvist
Conceived, directed and published the books of The Transformed Architecture.
Continue with the full chapter
Chapter 27: Nordvik Region and Hansa Mutual: Conclusions for Two Organisations in AI Blue gives the detailed explanations, practical examples and implementation patterns behind this summary.
This whitepaper belongs to “Experience and Conclusions” and is one of 32 drawn from the manuscript.