This book set out to show how large European enterprises and public authorities can put artificial intelligence to work as an active part of their cyber defence, under European law. It followed the six Functions of the NIST Cybersecurity Framework 2.0 so that no part of cybersecurity was left out, treated every Category through the three focus areas of the NIST Cyber AI Profile, and asked throughout how the answer changes with the usage mode of the AI and the autonomy it is given (19, NIST, 2024) (20, NIST, 2025). This closing chapter restates the thesis, draws eight cross-cutting conclusions and ends with what to do first.
AI strengthens cyber defence across every CSF Function when it acts inside a written mandate, in a usage mode and at an autonomy level matched to the reversibility of its actions, on a platform where containment holds whatever anyone intends, under continuous verification, and in a purple loop that turns every finding into a verified control with evidence.
Each clause carries weight. The mandate makes AI-enabled defence accountable, and the usage mode and autonomy level decide who judges and with whose identity the AI acts. Containment that does not depend on intent, the central conclusion of AI Platform and Security, applies to defensive AI too (73, Nordqvist, 2026), and the purple loop makes improvement, not discovery, the point of every test.
Primary topics explored
- The thesis restated
- Reflections on each part
- Eight cross-cutting conclusions
- How the conclusions interact
- How to use the conclusions by role
- Answered and open questions
About AI Red Team
AI Red Team is Book 4 of The Transformed Architecture. It shows how large European enterprises and public authorities put artificial intelligence to work as an active part of cyber defence: AI-assisted red teaming and adversary emulation, red teaming of AI systems themselves, the AI-assisted security operations centre, detection engineering, threat intelligence, incident response and purple teaming, all under a lawful mandate and with evidence a supervisor can inspect.
It builds on the conclusions of Architecture as Code, AI Governance and AI Platform and Security.
CISOs, SOC leads, red and blue team practitioners, security architects, AI architects and technical decision-makers.
Gunnar Nordqvist
Conceived, directed and published the books of The Transformed Architecture.
Continue with the full chapter
Chapter 28: Conclusions: AI as an Active Part of Cyber Defence in AI Red Team gives the detailed explanations, practical examples and implementation patterns behind this summary.
This whitepaper belongs to “Verification, Improvement and Conclusions” and is one of 32 drawn from the manuscript.