Security AI tends to arrive by side doors. A vendor switches on an AI verdict in the endpoint product, an analyst pastes an alert into a conversational assistant, the SOAR platform gains an embedded assistant, and a detection engineer starts using a coding agent on a laptop. Together these steps produce an estate in which models read the most sensitive telemetry and act in production outside the gateway, policy point and evidence trail built for every other AI system. This chapter presents a reference architecture that closes those side doors by placing security AI on the governed platform of the earlier volumes, and gives every later chapter a common picture of its layers and ranges.
In CSF 2.0 terms the chapter is responsible, together with Part IV, for two Protect Categories: PR.PS Platform Security, which covers the hardware, software and services of platforms and their management consistent with risk strategy, and PR.IR Technology Infrastructure Resilience, which covers the security architectures that protect asset confidentiality, integrity and availability and organisational resilience (19, NIST, 2024). It treats both through the three focus areas of the NIST Cyber AI Profile (20, NIST, 2025); Chapters 16 and 17 supply the detailed controls. It answers three questions: where security AI sits, where models may run on security telemetry, and how offensive capabilities are separated from production.
The first decision, placement, settles most of what follows. A triage assistant that summarises alerts, an agent that proposes containment and a harness that runs adversarial tests against the organisation's own assistants are all AI systems: they call models, read content they did not write, invoke tools and leave consequences behind. They should therefore run on the governed AI platform, under the same controls as the citizen-service assistant or the claims-triage agent, rather than beside it.
Primary topics explored
- Security AI is AI: inheriting the platform
- Layers of the AI-enabled security operation
- Sovereignty of security data
- Separation of ranges
- Mapping to D3FEND and CSF
- Summary
About AI Red Team
AI Red Team is Book 4 of The Transformed Architecture. It shows how large European enterprises and public authorities put artificial intelligence to work as an active part of cyber defence: AI-assisted red teaming and adversary emulation, red teaming of AI systems themselves, the AI-assisted security operations centre, detection engineering, threat intelligence, incident response and purple teaming, all under a lawful mandate and with evidence a supervisor can inspect.
It builds on the conclusions of Architecture as Code, AI Governance and AI Platform and Security.
CISOs, SOC leads, red and blue team practitioners, security architects, AI architects and technical decision-makers.
Gunnar Nordqvist
Conceived, directed and published the books of The Transformed Architecture.
Continue with the full chapter
Chapter 4: A Reference Architecture for AI-Enabled Cyber Defence in AI Red Team gives the detailed explanations, practical examples and implementation patterns behind this summary.
This whitepaper belongs to “Foundations” and is one of 32 drawn from the manuscript.