AI Blue

Welcome to the documentation portal for AI Blue: How Artificial Intelligence Transforms the Blue Team in European Enterprises and Public Authorities, Book 8 of The Architecture as Code Series by Gunnar Nordqvist. This site publishes the manuscript in a web-friendly format so that you can explore the chapters, diagrams and appendices directly in your browser. The source files are available in the repository at GitHub.

About the book

The earlier volumes of the series made architecture, governance, the AI platform and cyber defence executable, examined the evidence for AI as a threat, described how the security architect's role is transformed and asked what happens when AI takes the manager's chair. AI Blue asks what happens to the blue team, the people and functions that defend an organisation, when AI takes part in their work and when their adversaries use AI too: when alerts are enriched, triaged and in places closed by machines, when agents act with identities of their own, and when the analyst's craft, career and wellbeing are redesigned around them.

The book divides the blue team's work into five functions: B1 Anticipate, B2 Detect, B3 Investigate, B4 Respond and B5 Learn. Its thesis, which it tests against the evidence and judges in its conclusions, is that the blue team is transformed, not abolished: the work moves from the queue to the loop, autonomy is matched to reversibility with a stop path outside the system it stops, the defenders' own AI is part of the estate that is defended, and the route by which analysts are made is a design question. Everything in it is defensive; adversary behaviour is described by technique, only at the level needed to design detections, controls and tests.

The book is written for chief information security officers and heads of security operations, for SOC managers, analysts, detection engineers, intelligence analysts and incident commanders, for security and AI architects, for boards and management bodies with duties under NIS 2 and DORA, for procurement functions that buy managed detection and response, for works councils and unions, and for public authorities. It covers the team before the transformation, each function transformed, the team's own AI, the team in the organisation, the people and career, and the experience of two fictional organisations, Nordvik Region and Hansa Mutual, that run through every chapter.

The Architecture as Code Series

1. Architecture as Code, published at aac.geon.se, supplies the underlying discipline.
2. AI Governance, published at aig.geon.se, covers the regulatory map, risk management, governance as code, assurance, organisation and leadership.
3. AI Platform and Security, published at aips.geon.se, covers the platform, DevSecMLOps, infrastructure, security and operations.
4. AI Red Team, published at aired.geon.se, puts AI to work as an active part of cyber defence.
5. AI Threat, published at aithreat.geon.se, examines the evidence for AI as a threat to people, society and control.
6. The Transformed Security Architect, published at tsa.geon.se, describes what the security architect role has become and must become.
7. AI Boss, published at aiboss.geon.se, examines what happens when AI manages people.
8. AI Blue (this book), published at aiblue.geon.se, examines how the blue team is transformed by AI.

Each book stands on its own. Where a topic belongs to an earlier volume, this book summarises it and refers to that volume by chapter number.

How to use this site

• Start with the Introduction for the question, the thesis, the five blue team functions in brief and the two organisations that run through the book.
• Follow the parts in order: the blue team in question, the craft, the blue team's AI team, the team in the organisation, people and career, and experience and conclusions.
• Use the appendices for the glossary, the code examples, the templates and tools, and the bibliography.

The book has 28 chapters in six parts. The Book Blueprint records the brief and status of every chapter, and Series Foundations records the conclusions from the earlier volumes that the book builds on. Contributors should also read the Chapter Authoring Guide.

Suggestions and corrections are welcome as issues or pull requests in the repository.