A loop needs people who can do six kinds of work: choose and write scenarios, run emulation, engineer detections, read what happened, control an exercise and keep the evidence. When AI takes the routine part of the first four, the question is where the next people who can do the whole of that work come from, and how the present ones keep what the routine used to teach them. This chapter answers it for the people on both sides of the loop, with the weight on the red side, which AI Blue did not treat. It concerns every stage by name: P1 Target, where the scenario writer's grasp of an adversary's objectives decides what is tested; P2 Emulate, where operators and emulation engineers run, adapt and stop; P3 Observe, where red and blue read the result together; P4 Improve, where detection engineers turn a finding into a change; and P5 Verify, where a person reproduces a result and signs closure.
The chapter builds on three earlier treatments and does not repeat them. AI Blue, Chapter 22, set out a competence framework for the blue team, the competence record and the rule that a competence shown with and without the assistant counts at the lower level; AI Blue, Chapter 23, treated the missing first rung of the analyst's ladder, unassisted practice, the craft register and the SOC apprenticeship (94, Nordqvist, 2026). The Transformed Security Architect, Chapter 15, designed the keeping of a craft for a single role (92, Nordqvist, 2026). This chapter applies their instruments to the loop and its red craft, and stages the debate on whether automated emulation erodes the craft of the adversary's mind.
The red craft needs a definition before it can be protected, and the one used here is the book's own. It is the capacity to start from an adversary's objective and constraints and to build a path to it that nobody has catalogued; to adapt when a step fails or when the defence reacts; to judge which step to leave out because it would be unsafe, out of scope or not worth its risk; and to explain the result to people who defend. That is the adversary's mind in the working sense of this chapter: a set of skills that can be observed in an exercise, not a talent or a temperament.
Primary topics explored
- What the red craft is
- A competence framework for the loop
- What the evidence says about skill beside automation
- The red apprenticeship
- Exercises as training
- Hiring and contracted testers
About AI Purple
AI Purple is Book 9 of The Transformed Architecture. It takes the loop between the red team and the blue team as its subject and asks what happens when AI sits on both sides of the table: the five stages of the loop (target, emulate, observe, improve, verify), rules of engagement and safe emulation, continuous emulation, the independence principle, coverage as a claim that needs evidence, the loop's own AI and how to defend it, operating models, decision rights, regulation, and the people involved, for European enterprises and public authorities.
It builds on the conclusions of Architecture as Code, AI Governance, AI Platform and Security, AI Red Team, AI Threat, The Transformed Security Architect, AI Boss and AI Blue.
Chief information security officers, heads of security operations, red-team leads, penetration testers, SOC managers, detection engineers, purple-team coordinators and incident commanders, security and AI architects, boards and management bodies, procurement leads, works councils and unions, data protection and audit functions, and public-sector leaders.
Gunnar Nordqvist
Conceived, directed and published the books of The Transformed Architecture.
Continue with the full chapter
Chapter 24: Competences, Training and Keeping the Red Craft in AI Purple gives the detailed explanations, practical examples and implementation patterns behind this summary.
This whitepaper belongs to “People and Career” and is one of 33 drawn from the manuscript.