The Pressure on the Blue Team: Machine-Speed Adversaries, Alert Volume and Scarce Talent

This chapter sets out the pressure that makes the transformation of the blue team a matter of necessity rather than choice, and it keeps to what the sources measured. It concerns all five functions. B1 Anticipate feels it as advisories and disclosures that arrive faster than they can be read, B2 Detect as telemetry and false positives, B3 Investigate as a queue that grows while the people who work it are few, B4 Respond as a shrinking interval in which containment still matters, and B5 Learn as the first activity dropped when the other four are under strain. It describes three pressures in turn, adversaries that use AI, an alert queue that can exceed human capacity and a scarcity of skilled people, and for each it states what the evidence shows, in whom and over what period, what it does not show, and whether the outlook is observable, expected or speculation.

The pressures on the team: attacker speed, alert volume and scarce talent, set against the capacity of a tiered SOC

Figure 3.1: The pressures on the team: attacker speed, alert volume and scarce talent, set against the capacity of a tiered SOC.

The chapter builds on conclusions of the earlier volumes. AI Platform and Security, Chapter 18, concluded that AI is both a target and a source of threat and that security operations must run faster than a monthly patch cycle, with patch velocity as a measured service level, detection at machine speed with the authority to act, and human verification as the bottleneck of AI-enabled defence (63, Nordqvist, 2026). AI Governance, Chapter 24, concluded that patch decisions for known-exploited vulnerabilities must be delegated in advance, because a weekly change advisory board cannot sit in their path (62, Nordqvist, 2026). AI Threat, Chapters 14 and 25, added that automation erodes the skills of the people who must catch its errors and that agents acting beyond their mandate are an observable pattern (65, Nordqvist, 2026). AI Red Team, Chapter 2 (64, Nordqvist, 2026), and AI Threat, Chapter 18 (65, Nordqvist, 2026), assemble the threat evidence from the standpoint of the organisation and of the threat register. This chapter takes the standpoint of the team: what the shift looks like from the chair of the person who triages the queue, and what it means for the people on the rota.

A team at the edge of its capacity

The pressure begins with arithmetic that every SOC lead already knows. A tier 1 analyst has a fixed number of productive hours in a shift, a triage step has a minimum duration if it is done properly, and the alerts arrive at a rate that the analyst does not control. Capacity is the product of the first two and demand is the third. When demand exceeds capacity the queue does one of three things: it grows, it is closed without being read, or it is cut by suppressing detections. All three are familiar, and all three move risk from the visible queue into the invisible estate.

The figures below are an assumed illustration, chosen to make the arithmetic visible for a team shaped like Nordvik Region's six analysts working office hours. They are not measurements, and they are not the Region's data. The inflow in particular is invented, because no source in this book's bibliography measures it.

Quantity Assumed value Result
Analysts on shift in office hours 6
Productive triage hours per analyst per day 5 30 analyst-hours a day
Minutes for a careful first triage of one alert 8 7.5 alerts per analyst-hour
Capacity of the team in the staffed hours 225 alerts a day
Assumed inflow over 24 hours 600
Of which arriving in the staffed hours 300 demand is 1.3 times capacity
Of which arriving out of hours 300 goes to the provider, whose capacity and rule the Region cannot see

Compared like with like, the six analysts face 300 alerts against a capacity of 225 in the hours they work, so about one alert in four cannot be triaged carefully by them. The other 300 belong to the provider, and all the Region can say about that half is that some of it is closed by the provider's AI under a rule it has not seen. The result is sensitive to the assumptions. At four minutes an alert the team's capacity is 450 and the staffed-hours queue clears; with 600 alerts in the staffed hours, demand is 2.7 times capacity. The margin turns on figures that only a team's own data can supply, which is why the exercise is worth repeating locally.

When demand exceeds capacity the team has four ways out. It can lower the triage time per alert, which is what automation offers. It can lower the inflow, which is what detection engineering offers. It can add people, which the labour market limits. Or it can accept that alerts will be closed unread, which is the failure that the first three exist to avoid. Chapters 6 and 7 treat the second and first of these in detail.

The same logic applies to time. A queue that is worked in hours puts a long interval between a signal and a person reading it, and the next sections describe what the adversary can do in intervals of that order. That is the sense in which the team is at the edge of its capacity: the problem is less that the team is slow than that the world around it has become faster.

Adversaries with AI

Three kinds of source describe how adversaries use AI, and they should be read differently. Government and agency assessments synthesise reporting and state judgements with stated confidence. Reports from AI developers and threat-intelligence teams describe activity that they observed and disrupted, on their own platforms or in their own incident-response work. Laboratory studies measure what a model can do under test conditions, which is evidence of capability and not of use. The sections below keep the three apart.

What the agency assessments say

The European assessments agree on the direction and differ in tone. ENISA's Threat Landscape 2025 covers 4,875 incidents between 1 July 2024 and 30 June 2025 (28, ENISA, 2025). The 2026 edition, published in September 2026 and covering 2025, records that threat groups, including cybercriminals and state-nexus intrusion sets, increasingly use AI, and says that reporting over 2025 indicates that attackers primarily use consumer-grade AI tools to augment existing skills and adapt attack vectors rather than to achieve breakthrough capabilities. In the same passage it says that model improvements have already been seen accelerating vulnerability discovery and exploitation. Its incident data name phishing as the main form of social engineering and the exploitation of vulnerabilities as a prevalent intrusion vector, so the vectors that AI is reported to accelerate are the ones that already dominate (29, ENISA, 2026). Its outlook is worded in its own confidence terms: ENISA assesses that AI will highly likely increasingly support malicious operations, and that it is likely that 2026 will see more phases of the kill chain directly enabled by AI, with possible experimentation with human-out-of-the-loop proofs of concept. That is an expected outlook, attributed to ENISA.

Europol's assessment for 2026 expects accessible AI tools to lower the barrier for cybercriminals and to shorten the time needed to launch attacks while increasing their scale and personalisation (30, Europol, 2026).

ANSSI and CERT-FR are the most cautious, and the caution is instructive. Their synthesis of 2025, dated 4 February 2026, states that ANSSI knew of no cyberattack against French actors carried out with the help of AI, and had not itself identified an AI system able to carry out all the steps of an attack autonomously. It records use of generative AI along the attack chain, for social engineering, code development and analysis of exfiltrated data. It states that there was no confirmed case of exploitation of a zero-day vulnerability discovered with a generative model, and judged it plausible that the operators who master these systems fastest could move towards near-complete automation of an attack chain in the short or medium term (31, ANSSI, 2026).

The National Cyber Security Centre of the United Kingdom, in its 2025 assessment of the impact of AI on cyber threat to 2027, judged that AI will almost certainly continue to make elements of intrusion more effective and efficient and that there will almost certainly be a digital divide between systems that keep pace with AI-enabled threats and those that do not. In the body it states that the time between disclosure and exploitation has shrunk to days and that AI will almost certainly reduce it further (32, NCSC, 2025). The Five Eyes agencies said in June 2026 that AI lowers barriers for malicious actors and shrinks the window between vulnerability discovery and exploitation (34, Five Eyes agencies, 2026). Separately, in their call to action on frontier models that they describe as transforming both offensive and defensive cyber capabilities, they wrote that the timeline "is not years, it is months". The first is a present-tense assessment. The second is a forecast about capability and an expected outlook, and the next section shows how much of it is already visible.

The International AI Safety Report 2026 gives the cautious summary that the first part of this chapter needs. It states that criminal groups and state-associated attackers are actively using general-purpose AI in their operations, that the evidence on real-world use comes largely from AI companies' own analyses, and that it is unclear whether attackers or defenders will benefit more (38, Bengio et al., 2026).

What the developers and threat-intelligence teams report

The reports that come from inside the incidents are more specific. Each is a self-report from one vantage point: the reporter sees only its own platform or its own cases, and developers report on the misuse of their own products.

Google's Threat Intelligence Group (GTIG) reported in January 2025 that government-backed and information-operations actors misusing its Gemini application were finding productivity gains but not yet developing novel capabilities (41, Google GTIG, 2025). By May 2026 the finding had moved. GTIG described what it called a first: a criminal group planning to use a zero-day vulnerability, a logic flaw in a web-based administration tool, in a mass exploitation event. GTIG stated high confidence that an AI model was used to develop the exploit, did not believe that Gemini was the model, and based the attribution on artefacts in the code rather than on direct evidence. It disrupted the activity and worked with the vendor on disclosure (42, Google GTIG, 2026). The case does not contradict ANSSI's finding of February 2026, which concerned the discovery of a zero-day with a generative model and French actors. It is a reported criminal plan to use an AI-developed exploit, disrupted before mass exploitation, and it narrows the distance between an assessment and an observation within a quarter. That is the reason the pressure register at the end of this chapter has a review date.

Anthropic's reports, again from the vantage of one provider, follow the same arc. In August 2025 it described a data-extortion operation against at least 17 organisations in which an agentic coding tool automated much of the intrusion workflow (46, Anthropic, 2025). In November 2025 it described a campaign, attributed with high confidence to a Chinese state-sponsored group, in which the actor used AI for 80 to 90 per cent of the work with human intervention at perhaps four to six critical decision points, and in which the model sometimes hallucinated credentials or claimed to have extracted secrets that were public (47, Anthropic, 2025). Its September 2026 report says that the attacks used familiar methods such as stolen credentials, unpatched edge devices and phishing, that the change lay in economics and speed, and that the most serious compromises involved humans directing each step; it states its own limit, that it sees only activity on its platform and that some figures rest on the actors' own claims (48, Anthropic, 2026). Three facts matter to a team: the human decision points, the economics rather than new methods, and the limit of one platform's view.

GTIG and Mandiant reported in October 2026 that actors had begun to use open-source, LLM-driven penetration-testing frameworks in intrusions. The activity came in bursts of a few seconds to about 25 seconds separated by long pauses, and the tooling was noisy: it produced large numbers of log events and relied on trial and error. GTIG judged current use to be broad and noisy but still successful, and judged that stealthier use is likely to follow. The report also cites a campaign in which the time from the first compromised account to deep access was as little as 15 minutes, typically about four hours (45, Blum et al., 2026). The noise is an opportunity for the detection engineer. The speed is a constraint on the analyst.

Mandiant's M-Trends 2026, based on more than 500,000 hours of incident investigations in 2025, is the counterweight. It says that 2025 was not the year in which breaches were a direct result of AI, and that the vast majority of successful intrusions still stem from fundamental human and systemic failures (40, Mandiant, 2026).

What laboratory studies show

Laboratory studies show capability, which is a different thing from use. Fang and colleagues tested language-model agents on 15 one-day vulnerabilities and reported that the best model, given the vulnerability description, exploited 87 per cent of them, while every other model tested and two open-source scanners exploited none, and that the best model's rate fell to 7 per cent without the description (50, Fang et al., 2024). Anthropic announced in April 2026 that an unreleased model, Claude Mythos Preview, had found thousands of high-severity vulnerabilities across major operating systems and browsers, and that it would share access with defenders through Project Glasswing (51, Anthropic, 2026). Its own assessment reports that over 99 per cent of the vulnerabilities found remained unpatched, calls its published results a lower bound, and lists limits of its own (52, Carlini et al., 2026). These are claims by the developer about its own model, and they are reported here as such.

What the evidence does and does not show

Taken together, the sources support four statements. It is observable that adversaries of every kind use AI along the attack chain, and that the most documented effect in the incident reporting is speed and volume rather than new techniques, while laboratory and developer reports show capability beyond that. It is observable that AI-assisted vulnerability discovery and exploit development exist, in the laboratory and in at least one reported criminal case. It is observable that AI-orchestrated intrusion campaigns have been reported, with a small share of successes among many attempts and with human decisions at critical points. And it is expected, on the stated judgements of ENISA, the NCSC and the Five Eyes agencies, that the effect will grow. The sources do not show that fully autonomous campaigns succeed at scale against European organisations (a speculation today), nor a measured rise in successful intrusions attributable to AI, which is a gap in the evidence.

The collapsing exploitation window

The most operationally important measure for a team is the time between a vulnerability becoming known and its exploitation, because it sets the time in which anticipation, detection and patching must happen. Three sources give numbers, and each has a caveat.

Mandiant's analysis of 2023, by Charrier and Weiner, reported an average time to exploit of 5 days for vulnerabilities disclosed in 2023, down from 63 days in 2018 and 2019, 44 days in 2020 to the start of 2021, and 32 days in 2021 and 2022. The sample was 138 vulnerabilities exploited in the wild, of which 97 were zero-days and 41 were n-days. The average excludes 15 outliers, and without that exclusion the 2023 average rises to 47 days. The authors note that undetected exploitation likely occurred, so actual times are almost certainly earlier (39, Charrier & Weiner, 2024). The trend is clear, the level depends on method.

M-Trends 2026 reports an estimated mean time to exploit of minus seven days for 2025, meaning that on average exploitation began a week before a patch was released, and so often occurs before one exists. It reports exploits as the most common initial infection vector for the sixth year running, at 32 per cent of intrusions, voice phishing at 11 per cent and email phishing at 6 per cent, and a global median dwell time of 14 days, up from 11. It also reports that the hand-off window between an initial access group and a secondary group fell to 22 seconds in 2025, from more than eight hours in 2022 (40, Mandiant, 2026). The 22 seconds is a hand-off between criminal groups, not a time to damage or a time to detect, so it should not be set against a triage queue as if the two measured the same interval. The comparable intervals are the 14-day median dwell time, which shows how long an intrusion often runs undetected, and the 15 minutes to four hours from first account to deep access in the campaign cited above. Together they say that the earliest minutes can matter, while most intrusions run for days.

GTIG's study of vulnerability trends from January 2025 to August 2026 is useful for what it refuses to claim. Monthly CVE disclosures rose from 5,045 in January 2026 to 10,477 in July and 10,740 in August, and exploited vulnerabilities averaged 10.5 a month in 2025 and 18 a month in 2026. The authors caution that automated disclosure policies inflate totals and that causal claims about AI are hedged. The only timing data is a single case, in which one threat cluster exploited an AI-discovered flaw within 4 days of disclosure, and the authors call it a single case and not an average (44, Grunewald et al., 2026).

The defender's side of the same coin is the patch wave. The NCSC warned in May 2026 that AI used by skilled people can find and exploit accumulated technical debt quickly and at scale, and that organisations should expect a surge of updates across all severities. It advised reducing external exposure first, patching faster and at scale, and accelerating when exploitation is active (33, NCSC, 2026). Anthropic's May 2026 update on Project Glasswing, a developer's report on its own programme, reported that partners had found more than 10,000 high or critical vulnerabilities, of which about 530 had been disclosed to maintainers and 75 patched, and stated that progress is now limited by how quickly vulnerabilities can be verified, disclosed and patched (53, Anthropic, 2026). The volume of findings that reaches B1 Anticipate is therefore itself a pressure, whoever finds them.

The implications for the team are three, and they are the book's own conclusions from these sources. First, the interval in which a signal must be read, enriched and acted upon can be minutes for the cases that matter most, which the queue discipline of a tiered SOC was not built for. Second, patch decisions for known-exploited classes cannot wait for the team's normal rhythm, which is why AI Governance, Chapter 24, concluded that they be delegated in advance (62, Nordqvist, 2026); Chapter 5 shows how B1 measures them. Third, reporting clocks do not shorten when attackers speed up. NIS 2 Article 23 requires an early warning within 24 hours of becoming aware of a significant incident (3, European Union, 2022), and DORA Articles 17 to 19 set classification and reporting duties whose timing is set by the instrument and its technical standards (2, European Union, 2022). These clocks run alongside the work of containment, so a faster adversary compresses the investigation and the paperwork together.

Telemetry and the alert queue

The second pressure sits inside the team. This is the place for the most care, because none of the sources in this book's bibliography measures the growth of telemetry volume across organisations. The statement that alert volume can exceed human triage capacity is, in this book, a conclusion from the assumed arithmetic above and from qualitative studies of analysts, and the register at the end of the chapter treats the local measurement as the team's own task.

The qualitative evidence is consistent. Alahmadi, Axon and Martinovic reported in 2022 an online survey of 20 SOC practitioners and a broader qualitative investigation of 21. They found that the tools in use have high false-positive rates and that analysts must validate alarms manually. They also found that most false positives come from benign triggers, alarms that are technically accurate but reflect legitimate activity in the organisation, and that validation is tedious and can lead to alarm burnout and then to desensitisation. The authors propose five properties for better alarms: reliable, explainable, analytical, contextual and transferable (69, Alahmadi et al., 2022). The sample is small and practitioner-reported and gives no rate for a particular SOC; it gives a mechanism: a large share of the queue is accurate but uninformative, so the cost of a false positive is paid in attention. A 2025 survey of the research, in ACM Computing Surveys, shows that alert fatigue is an established field (72, Tariq et al., 2025).

Two features of the queue make AI both a remedy and a risk. As a remedy, enrichment, deduplication and summarisation can lower the minutes per alert, which is the first of the four ways out in the arithmetic. As a risk, a faster queue that closes alerts without reading them is the failure the arithmetic warned of, now at machine speed, and it changes the question that a manager must ask: not how many alerts were closed but how many closures would survive a second reading. How a blue team is measured when time to detect and time to respond can be improved by closing alerts faster is the question Chapter 20 takes up. The Mandiant figure that 52 per cent of intrusions were detected internally in 2025, up from 43 per cent in 2024, shows that detection is improving in the investigated population (40, Mandiant, 2026). It does not say what the queue cost to achieve it.

Scarce talent and strained people

The third pressure is the one that cannot be bought quickly. The best-documented source is the ISC2 2025 Cybersecurity Workforce Study, an online survey of 16,029 practitioners and decision-makers in North America, Latin America, Asia-Pacific and EMEA in May and June 2025. This chapter reports it with a restriction: the release frames the most pressing concern as skills and not headcount, and this chapter makes no claim about a headcount gap from it. The survey found that 88 per cent had experienced at least one significant consequence of a skills shortage, that 95 per cent had at least one skill need, and that 59 per cent reported critical or significant skill needs. Among the skills wanted, AI was first at 41 per cent. Only 28 per cent had integrated AI tools into their operations, while 69 per cent were engaged in adoption activities. Respondents also reported budget cuts (36 per cent) and layoffs (24 per cent) at their organisations, and 72 per cent agreed that significantly reducing security personnel increases breach risk (73, ISC2, 2025).

The same study reports on strain, with a population that is global and a method that is self-report. It found that 48 per cent felt exhausted from keeping up with threats and emerging technologies and 47 per cent felt overwhelmed by workload. In the same survey, 68 per cent were satisfied in their current job and 80 per cent were passionate about their work (73, ISC2, 2025). The honest reading holds both halves: a workforce committed to the work and tired of the load. Analyst burnout is a design question, as the thesis of this book says, and Chapters 21 and 23 treat the on-call load, the monitoring of analysts themselves and the route by which new analysts are made.

A worldwide survey does not describe a Nordic public authority or a financial group in seven jurisdictions. The inference this chapter draws is narrower: the scarce resource is accountable human judgement under uncertainty, and the scarcity is sharpest where AI shortens the apprenticeship by taking the junior work, a point AI Threat, Chapter 14, made for work in general (65, Nordqvist, 2026).

At the rota the three pressures meet in one moment, which this illustration (not a record) makes concrete. At 03:00 the duty analyst of a two-person night shift has a queue left by the day team, an alert that matches a technique in last week's advisory and an agent's proposal to contain a host. The analyst must decide alone whether to wake the incident commander, knowing that waking someone costs sleep and starts an escalation clock, and that not waking them costs time. Nothing in the queue's own measures records that decision, which is why the book treats the rota, the escalation path and the stop right as design questions.

What the pressure does not justify

The pressure is real, and it is easy to draw the wrong conclusion from it. The wrong conclusion is that speed alone justifies autonomy. It does not, for four reasons that are the book's own.

First, speed that is wrong is faster to cause harm. A containment action that wrongly isolates a production system is an incident of the team's own making, and an adversary who can write the text that the defender's AI reads can try to provoke it. The series' rule stands: autonomy is matched to reversibility, Level 4 Autonomous is never used for an irreversible B4 Respond action, and a stop path outside the system it stops is part of the design (64, Nordqvist, 2026). Chapter 10 applies it to response.

Second, the documented adversary still works with people. Anthropic's report of November 2025 describes human decisions at four to six critical points, and its September 2026 report says the most serious compromises involved humans directing each step (47, Anthropic, 2025) (48, Anthropic, 2026). A defender that matched an imagined autonomous adversary with an actually autonomous defender would be answering a threat the sources do not document.

Third, a faster queue does not relieve the exploitation window. Fewer, better detections, patch decisions made in advance and rehearsed containment do. This is the move from the queue to the loop, and Chapter 4 defines it.

Fourth, cutting the team is not a response to pressure. In the ISC2 survey 72 per cent agreed that significantly reducing security personnel increases breach risk (73, ISC2, 2025). That is a practitioners' opinion and not a measured effect, and it is a reason to scrutinise a plan that answers pressure by cutting posts as closely as one that answers it with an agent.

Observable, expected, speculation

The labels follow AI Governance, Chapter 22: observable trends justify commitment, expected ones preparation, and speculative ones reversibility (62, Nordqvist, 2026).

Pressure Label Basis
Adversaries use AI along the attack chain, mainly for speed and volume Observable ENISA 2026, ANSSI 2026, GTIG 2025 and 2026, Anthropic 2025 and 2026
AI-assisted exploit development in at least one criminal case Observable GTIG May 2026, with the attribution resting on code artefacts
Time from disclosure to exploitation measured in days, and on average before a patch in M-Trends 2026 Observable Charrier & Weiner 2024, M-Trends 2026, with the caveats above
Dominant intrusion vectors are those AI is reported to accelerate Observable M-Trends 2026 (exploits 32 per cent), ENISA 2026 (phishing, vulnerability exploitation)
AI-enabled attacks continue to grow in volume and effectiveness Expected ENISA 2026 (highly likely), NCSC 2025 (almost certainly), Five Eyes 2026
Machine-speed adversaries as the normal case for a European organisation The book's design assumption, not a forecast An inference from the rows above; the team plans for it and tests it by drill
A surge of vulnerability disclosures and patches Expected NCSC 2026, Anthropic's Glasswing update, GTIG disclosure trends
Alert load beyond careful triage capacity Observable in the mechanism, local in the size Alahmadi et al. 2022 for the mechanism, the team's own data for the size; the chapter's arithmetic is an assumed illustration
Skills shortage and strain among defenders Observable ISC2 2025, as a survey of self-reported views
Fully autonomous campaigns at scale against European targets Speculation No source documents it; ENISA names experimentation as possible
A measured rise in successful intrusions attributable to AI Gap in the evidence Not measured in the sources cited

The register states the team's evidence, so the team can be wrong in a reviewable way. The practical guide and the worked example turn it into an artefact.

Practical guide: Writing the team's pressure register

Purpose. A pressure register keeps the pressures that bear on the team in one reviewed file, each with its evidence, its label, a local measure and a decision it informs, so that the team does not respond to the loudest headline or to a vendor's account of urgency. Roles. The SOC lead or head of security operations owns it; the senior analyst or detection owner supplies local measures; the CISO reviews it; the employee representatives see any measure that touches staff.

  1. Choose three or four pressures that matter locally. Start from the table above and drop what does not bear on the estate.
  2. Record the evidence by source number and say what it measured. Write the population, the period and the method in a line, and mark any figure that rests on a single case or a vendor's own platform.
  3. Label each entry observable, expected or speculation. Apply the labels as defined above, and attribute an expected judgement to the source that makes it.
  4. Attach one local measure per pressure. Prefer a measure the team already has: the median and 90th percentile hours from a feed entry to mitigation, the share of alerts closed as benign triggers, the unfilled night posts. Report any measure about people at team level only, in line with what the union at Nordvik and the works council at Hansa have agreed in substance.
  5. Name a threshold and the decision it informs. A threshold without a decision is a decoration. Say what the SOC lead will do when it is crossed.
  6. Set a review date and review triggers. A default of six months, and on any new threat assessment from ENISA, the NCSC or GTIG, any major incident and any change to the rota. Adapt it to the organisation's risk appetite and to what a works agreement says about the measures.
  7. Commit it, with the reviewer's name, to the repository. At an authority the register is public-access material, so write it to survive a request.

Definition of done. Every entry has a label, a source, a local measure, a threshold, a decision and a date; no entry measures a named person; the CISO has reviewed it; and the last review is less than six months old.

Worked example: A pressure register for Hansa Mutual's group SOC

This example is illustrative. The identifiers PRS-HM-2027-01 and P1 to P5 are introduced by this chapter, and the dates are fiction in the narrative year 2027. The source numbers are those of the bibliography.

# Illustrative: team/pressure-register.yaml, Hansa Mutual group SOC
register: PRS-HM-2027-01
owner: head of security operations
reviewed_by: group CISO
reviewed: 2027-05-03
next_review: 2027-11-01
review_on: [new ENISA or NCSC or GTIG assessment, major incident, change to rota]
measures_about_people: team level only
pressures:
  - id: P1
    name: Exploitation outpaces the queue
    label: observable
    evidence: {sources: [39, 40, 44, 45], note: "days to exploit; hand-off window; one-case timing; time to deep access"}
    local_measure: p90 hours, feed entry to mitigation, class exploited-exposed
    threshold: above 72 hours
    decision: duty-analyst delegation for the class is reviewed
  - id: P2
    name: AI-enabled attacks grow in volume and effectiveness
    label: expected
    evidence: {sources: [29, 32, 34], note: "ENISA highly likely; NCSC almost certainly"}
    local_measure: stop-path drill time against the 120-second agent-stop budget
    threshold: drill over budget twice in a row
    decision: Level 3 classes are frozen until a drill passes
  - id: P3
    name: Alert load beyond careful triage
    label: observable
    evidence: {sources: [69], note: "mechanism only; 20 and 21 practitioners"}
    local_measure: share of alerts closed as benign trigger, and sample re-read rate
    threshold: re-read finds more than 5 per cent of closures wrong
    decision: the class goes back to Level 2 Supervised
  - id: P4
    name: Skills and strain on a two-site rota
    label: observable
    evidence: {sources: [73], note: "survey, self-report, global"}
    local_measure: unfilled night posts in Hamburg and Poland; on-call hours per team
    threshold: any night shift below minimum staffing for two weeks
    decision: hiring or rota change goes to the executive board
  - id: P5
    name: Fully autonomous campaigns at scale against EU targets
    label: speculation
    evidence: {sources: [29, 34], note: "named as possible experimentation; none documented in the sources cited"}
    local_measure: none; watch for a documented case
    threshold: first documented case against an EU financial entity
    decision: only reversible preparation until then

Across the usage modes

Pressure differs by mode on both sides of the contest. The attacker's tools are not bound to the series' modes, but the comparison shows where speed sits.

Side and mode Where the speed sits What stays at human speed
Attacker, agentic frameworks (comparable to Modes 3 and 5) Reconnaissance, movement and tooling in bursts of seconds Choice of targets and review of results, in the reports cited
Defender, Mode 0 Ambient AI in SIEM, EDR and managed services Scoring, grouping and closure of low-severity alerts Nothing, unless the contract and the sampling say so
Defender, Modes 1 to 3 Drafting, enrichment and summarisation for the analyst The decision to close, escalate or contain
Defender, Mode 4 built or procured applications Triage and correlation inside a defined scope Approval of classes and the review of samples
Defender, Mode 5 Autonomous production agents Execution of a codified playbook Authority over the playbook, the stop path and the mandate

The defender's speed gains are largest where the mode is least visible to the team: Mode 0 acts at an autonomy that nobody decided, which is why Chapter 16 puts it in the contract.

Nordvik Region and Hansa Mutual

Nordvik Region's pressures are capacity and procurement. Its security unit of 14 has six analysts working office hours, a managed provider out of hours under framework agreement NR-2025-044, supplier-default detections and no detection-engineering function. The provider's AI closes a class of low-severity alerts out of hours under no stated rule, so the Region receives some of the benefit of AI in its queue without having decided it. Public-sector pay scales and procurement lead times limit how quickly it can add people or change suppliers, and the illustration of the first section suggests how thin its margin is.

Hansa Mutual's pressures are scale and attack surface. Its group SOC of about 38 people runs from Hamburg and the Polish service centre with a UK late shift, which makes it a target of the same machine-speed adversaries and also gives it a night shift to staff in two countries. It has agents of its own in production, the investigation agent and the triage agent among them, so the defender's AI is part of the estate that the exploitation window threatens. Seven legal regimes mean that a faster response must still meet reporting clocks under DORA for the EU entities and under the UK and Swiss regimes for the others. The register above is Hansa's; Nordvik would begin with P1, P3 and a pressure of its own on dependence on the provider.

Summary

Three pressures bear on the blue team, and each is documented to a different degree. Adversaries use AI along the attack chain, and the agency assessments of ENISA, Europol, ANSSI, the NCSC and the Five Eyes agencies, with the reports of GTIG and Anthropic, agree that the effect observed is speed and volume. ANSSI reported no confirmed exploitation of an AI-discovered zero-day against French actors in February 2026, and GTIG reported in May the first criminal plan to use an AI-developed zero-day exploit, disrupted before mass exploitation; the case narrows the distance between assessment and observation without contradicting ANSSI. The exploitation window has shortened from weeks to days by one measure, with caveats about method, and M-Trends 2026 reports exploitation on average before a patch and a hand-off between intrusion groups measured in seconds.

The second pressure is the alert queue, and here the evidence is weaker, and the chapter says so. No source in the bibliography measures the growth of telemetry across organisations. The mechanism is documented qualitatively: many alerts are accurate but uninformative, and validation leads to fatigue and desensitisation. The chapter's arithmetic is an assumed illustration, not data, and each team measures its own demand against its own capacity. The third pressure is people. The ISC2 study shows a workforce committed to its work, short of skills, and tired, and it supports no claim here about a headcount gap.

The pressure justifies a transformation and does not justify autonomy by itself. Speed that is wrong is a harm of the team's own making, the documented adversary still works with people at critical points, and the response lies in fewer and better detections, patch decisions made in advance, rehearsed containment and agents that act inside a mandate with a stop path outside them. A register of pressures, labelled observable, expected or speculation, with a local measure and a decision for each, is the artefact that lets a team respond to evidence rather than to alarm.

The chapter concerns all five functions: B1 Anticipate is under the pressure of volume and speed of reports, B2 Detect under telemetry and false positives, B3 Investigate under a queue that is longer than its people, B4 Respond under a window that has shrunk and clocks that have not, and B5 Learn under the temptation to drop the loop when the queue is full. Chapter 4 defines the transformed blue team that answers this pressure: the work moves from the queue to the loop, degrees of delegation are set per function, and the team's own AI is defended as part of the estate.

Sources

  1. European Union Agency for Cybersecurity (2025). ENISA Threat Landscape 2025. ENISA, October 2025. (28, ENISA, 2025)
  2. European Union Agency for Cybersecurity (2026). ENISA Threat Landscape 2026. ENISA, September 2026. (29, ENISA, 2026)
  3. Europol (2026). The evolving threat landscape: How encryption, proxies and AI are expanding cybercrime, Internet Organised Crime Threat Assessment (IOCTA) 2026. Publications Office of the European Union. (30, Europol, 2026)
  4. ANSSI and CERT-FR (2026). L'IA générative face aux attaques informatiques: synthèse de la menace en 2025 (CERTFR-2026-CTI-001). ANSSI, 4 February 2026. (31, ANSSI, 2026)
  5. National Cyber Security Centre (2025). Impact of AI on cyber threat from now to 2027. NCSC, 7 May 2025. (32, NCSC, 2025)
  6. National Cyber Security Centre (2026). Preparing for a 'vulnerability patch wave'. NCSC blog, 1 May 2026. (33, NCSC, 2026)
  7. Five Eyes cyber security agencies (2026). The AI shift in cyber risk: why leaders must act now. Joint statement, 22 June 2026. (34, Five Eyes agencies, 2026)
  8. Bengio, Y. et al. (2026). International AI Safety Report 2026. 3 February 2026. (38, Bengio et al., 2026)
  9. Charrier, C. & Weiner, R. (2024). How Low Can You Go? An Analysis of 2023 Time-to-Exploit Trends. Mandiant, Google Cloud Blog. (39, Charrier & Weiner, 2024)
  10. Mandiant (2026). M-Trends 2026: Data, Insights, and Strategies From the Frontlines. Google Cloud Blog, 23 March 2026. (40, Mandiant, 2026)
  11. Google Threat Intelligence Group (2025). Adversarial Misuse of Generative AI. Google Cloud Blog, 29 January 2025. (41, Google GTIG, 2025)
  12. Google Threat Intelligence Group (2026). GTIG AI Threat Tracker: Adversaries Leverage AI for Vulnerability Exploitation, Augmented Operations, and Initial Access. Google Cloud Blog, 11 May 2026. (42, Google GTIG, 2026)
  13. Grunewald, R., Mazumdar, S. & Vanderlee, K. (2026). Vulnerability Discovery and Exploitation Trends in the AI Era. Google Threat Intelligence Group, 30 September 2026. (44, Grunewald et al., 2026)
  14. Blum, Mainor, Nambiar et al. (2026). ARTEX and Friends: Enter Agentic Offensive Frameworks. Google Threat Intelligence Group and Mandiant, 30 October 2026. (45, Blum et al., 2026)
  15. Anthropic (2025). Detecting and countering misuse of AI: August 2025. 27 August 2025. (46, Anthropic, 2025)
  16. Anthropic (2025). Disrupting the first reported AI-orchestrated cyber espionage campaign. 13 November 2025. (47, Anthropic, 2025)
  17. Anthropic (2026). Detecting and countering misuse of AI: September 2026. Threat Intelligence Report. (48, Anthropic, 2026)
  18. Fang, R., Bindu, R., Gupta, A. & Kang, D. (2024). LLM Agents can Autonomously Exploit One-day Vulnerabilities. arXiv:2404.08144. (50, Fang et al., 2024)
  19. Anthropic (2026). Project Glasswing: Securing critical software for the AI era. 7 April 2026. (51, Anthropic, 2026)
  20. Carlini, N., Cheng, N., Lucas, K. et al. (2026). Assessing Claude Mythos Preview's cybersecurity capabilities. Anthropic Frontier Red Team, 7 April 2026. (52, Carlini et al., 2026)
  21. Anthropic (2026). Project Glasswing: An initial update. 22 May 2026. (53, Anthropic, 2026)
  22. Alahmadi, B. A., Axon, L. & Martinovic, I. (2022). 99% False Positives: A Qualitative Study of SOC Analysts' Perspectives on Security Alarms. 31st USENIX Security Symposium. (69, Alahmadi et al., 2022)
  23. Tariq, S., Baruwal Chhetri, M., Nepal, S. & Paris, C. (2025). Alert Fatigue in Security Operations Centres: Research Challenges and Opportunities. ACM Computing Surveys 57(9). (72, Tariq et al., 2025)
  24. ISC2 (2025). 2025 Cybersecurity Workforce Study. Announced 4 December 2025. (73, ISC2, 2025)
  25. European Parliament and Council of the European Union. Directive (EU) 2022/2555 (NIS 2 Directive). (3, European Union, 2022)
  26. European Parliament and Council of the European Union. Regulation (EU) 2022/2554 (DORA). (2, European Union, 2022)
  27. Nordqvist, G. (2026). AI Governance: Governing Artificial Intelligence in European Enterprises and Public Authorities. (62, Nordqvist, 2026)
  28. Nordqvist, G. (2026). AI Platform and Security: Building and Securing AI Platforms in European Enterprises and Public Authorities. (63, Nordqvist, 2026)
  29. Nordqvist, G. (2026). AI Red Team: AI as an Active Part of Cyber Defence in European Enterprises and Public Authorities. (64, Nordqvist, 2026)
  30. Nordqvist, G. (2026). AI Threat: Are the Dystopias Coming True? Evidence, Risk and Response for European Enterprises and Public Authorities. (65, Nordqvist, 2026)