For most of the last decade, security teams in European enterprises and public authorities met artificial intelligence as a feature in a product they had bought, or as a new kind of system they had been asked to protect. The first three volumes of The Transformed Architecture followed that order. Architecture as Code made architecture executable, so that decisions, policies and evidence live in version control and are validated continuously (71, Nordqvist, 2025). AI Governance made the governance of AI executable and proportionate to how AI is used (72, Nordqvist, 2026). AI Platform and Security built the platform on which AI runs and secured it, and concluded that AI is now both a target and a source of threat (73, Nordqvist, 2026).
This book turns the question around. If attackers already use AI to find weaknesses, write convincing lures and run parts of an intrusion faster than a person can, defenders cannot afford to treat AI only as something to protect. They must put it to work: in the red team that emulates the adversary, in the testing of their own AI systems, in the blue team that detects and responds, and in the loop that turns each finding into a control that has been shown to work. AI Red Team is about doing that in large European organisations, under European law, and without losing the discipline the earlier volumes established.
Three developments have changed the defender's position in a short time, and each is documented rather than forecast.
Primary topics explored
- Why this book, and why now
- What the series has already established
- NIST CSF 2.0 with an AI focus
- Usage modes: from human judgement to machine identity
- Red, blue and purple across the Functions
- Rules of the book
About AI Red Team
AI Red Team is Book 4 of The Transformed Architecture. It shows how large European enterprises and public authorities put artificial intelligence to work as an active part of cyber defence: AI-assisted red teaming and adversary emulation, red teaming of AI systems themselves, the AI-assisted security operations centre, detection engineering, threat intelligence, incident response and purple teaming, all under a lawful mandate and with evidence a supervisor can inspect.
It builds on the conclusions of Architecture as Code, AI Governance and AI Platform and Security.
CISOs, SOC leads, red and blue team practitioners, security architects, AI architects and technical decision-makers.
Gunnar Nordqvist
Conceived, directed and published the books of The Transformed Architecture.
Continue with the full chapter
Chapter 1: Introduction: Putting AI to Work in Cyber Defence in AI Red Team gives the detailed explanations, practical examples and implementation patterns behind this summary.
This whitepaper belongs to “Foundations” and is one of 32 drawn from the manuscript.