This chapter follows four people through the year in which the two organisations of this book first run the purple loop as a practice and not as an occasional event. The year is defined here as the twelve months to 2028-04-30: eight months of background from May to December 2027, told briefly from the facts earlier chapters established, and the four months from January to April 2028 that the chapter narrates in detail. The four people are Karin Lund, detection owner and purple-team coordinator at Nordvik Region; Elin Berglund, the principal consultant who tests for the Region under its call-off agreement; Lena Vogel, who leads detection engineering at Hansa Mutual; and Mareike Hartmann, who heads Hansa's group red team. It tells the year as a sequence of dated decisions, records and measures, and it shows all five stages of the loop at work: P1 Target, P2 Emulate, P3 Observe, P4 Improve and P5 Verify. Every event is tied to an identifier and to the stage it shows. The chapter adds no method. It shows what the methods of Chapters 4 to 26 look like when they meet a calendar, a contract, a works agreement and a budget, includes a failure at each organisation and the recovery that followed, because a year without a failure would have tested nothing, and ends with a practical guide and a worked example that turn the year into an annual calendar.
The eight months before the questions arrived matter to what follows, so they are told here from facts that earlier chapters established.
At Nordvik the spring fieldwork under RoE-NR-2027-001 (EMU-NR-2027-01, 2027-03-08 to 2027-04-02) was the last time T1486 and T1190 were exercised in the mirror. From 2027-06-07 to 2027-06-11 the Region ran its first test that involved staff, a deepfake of payment approvals in the finance unit (RoE-NR-2027-002, 23 participants, notice EIN-NR-2027-002 sent on 2027-05-24, GDPR Article 6(1)(e) as the legal basis), reported in aggregate only (Chapter 23). On 2027-07-01 Karin Lund took up the detection-owner post ROLE-NR-SEC-DET. The autumn run needed its own authority: version 1.3.0 of RoE-NR-2027-001, approved on 2027-10-05, set the window and added the scenarios SCN-NR-0001, -0007 and -0011. The stop drill followed on 2027-10-07, Karin sealed the expectation sheet on 2027-10-08, and EMU-NR-2027-02 ran from 2027-10-11 to 2027-10-22. In the session PRP-NR-2027-02 of 2027-10-20 the scenario SCN-NR-0001 was walked through six steps. The spray was detected by DET-NR-0001, the successful sign-in raised the alert ALR-0912 at 02:17, and the provider's AI closed it as low severity at 02:21. That became finding FND-NR-2027-011, and its regression case REG-NR-0004 passed its base form on 2027-11-17, six minutes from the first failed sign-in to detection.
Primary topics explored
- May to December 2027: the background
- The starting position in January 2028
- January: the first failure at Nordvik, the second at Hansa
- February: findings that travel the whole loop
- March: sessions, tabletops and the people who carry them
- April: what the numbers allow
About AI Purple
AI Purple is Book 9 of The Transformed Architecture. It takes the loop between the red team and the blue team as its subject and asks what happens when AI sits on both sides of the table: the five stages of the loop (target, emulate, observe, improve, verify), rules of engagement and safe emulation, continuous emulation, the independence principle, coverage as a claim that needs evidence, the loop's own AI and how to defend it, operating models, decision rights, regulation, and the people involved, for European enterprises and public authorities.
It builds on the conclusions of Architecture as Code, AI Governance, AI Platform and Security, AI Red Team, AI Threat, The Transformed Security Architect, AI Boss and AI Blue.
Chief information security officers, heads of security operations, red-team leads, penetration testers, SOC managers, detection engineers, purple-team coordinators and incident commanders, security and AI architects, boards and management bodies, procurement leads, works councils and unions, data protection and audit functions, and public-sector leaders.
Gunnar Nordqvist
Conceived, directed and published the books of The Transformed Architecture.
Continue with the full chapter
Chapter 27: A Year in the Loop: Nordvik Region and Hansa Mutual in AI Purple gives the detailed explanations, practical examples and implementation patterns behind this summary.
This whitepaper belongs to “Experience and Conclusions” and is one of 33 drawn from the manuscript.