Every chapter of this book has ended by asking how its subject plays out for two fictional organisations: Nordvik Region, a regional public authority in a Nordic member state, and Hansa Mutual, a mutual insurance group headquartered in Hamburg. This chapter draws those threads together. For each it records the starting point, the decisions across the six CSF Functions, what worked, what was hard and a 24-month plan, and then compares their CSF profiles as code.
Nordvik's question is how to use AI to stretch a small team without giving up sovereignty over security data or accountability to the public. Hansa's is how to give AI bounded autonomy at machine speed while proving to supervisors, works councils and its management body that people remain in command. Both started where the earlier volumes left them: AI is now both a target and a source of threat (72, Nordqvist, 2026) (73, Nordqvist, 2026).
Nordvik's security unit had fourteen people, of whom six were analysts working office hours. A European managed security service provider monitored the estate out of hours under framework agreement NR-2025-044, which requires processing and log storage inside the EU/EEA. Detection rules were mostly supplier defaults, and offensive testing meant an annual penetration test. The only security AI was a phishing-report classifier switched on by the email-security vendor (Mode 0), and analysts used the approved enterprise assistant (Mode 1) without pasting telemetry into it. Significant incidents were reported to the national CSIRT under the national transposition of NIS 2 (3, European Union, 2022). Its constraints were capacity, procurement lead times and public-access rules; its advantages were a single legal regime, a clear mandate and reserved, self-hosted AI capacity in a Nordic data centre.
Primary topics explored
- Nordvik Region
- Hansa Mutual
- The two CSF profiles as code
- The two organisations compared
- Summary
- Sources
About AI Red Team
AI Red Team is Book 4 of The Transformed Architecture. It shows how large European enterprises and public authorities put artificial intelligence to work as an active part of cyber defence: AI-assisted red teaming and adversary emulation, red teaming of AI systems themselves, the AI-assisted security operations centre, detection engineering, threat intelligence, incident response and purple teaming, all under a lawful mandate and with evidence a supervisor can inspect.
It builds on the conclusions of Architecture as Code, AI Governance and AI Platform and Security.
CISOs, SOC leads, red and blue team practitioners, security architects, AI architects and technical decision-makers.
Gunnar Nordqvist
Conceived, directed and published the books of The Transformed Architecture.
Continue with the full chapter
Chapter 27: Nordvik Region and Hansa Mutual: Cyber Defence Conclusions in AI Red Team gives the detailed explanations, practical examples and implementation patterns behind this summary.
This whitepaper belongs to “Verification, Improvement and Conclusions” and is one of 32 drawn from the manuscript.