Competences, Training and Exercises: A Framework for the Transformed Blue Team

This chapter defines the competences of the transformed blue team and describes how they are built, assessed and evidenced. It treats exercises, not certificates, as the main means of showing what a person can do, and it applies the AI literacy duty of the AI Act to people who supervise agents. It concerns all five blue team functions: B1 Anticipate in hunting and intelligence skills, B2 Detect in detection engineering, B3 Investigate in analysis and in reviewing what AI concludes, B4 Respond in incident command and stop decisions, and B5 Learn in the post-incident review and the exercises that assess competence and feed the learning loop of Chapter 11.

Competences by role and level, assessed by exercises, with the records that evidence them

Figure 22.1: Competences by role and level, assessed by exercises, with the records that evidence them.

Chapter 21 described the analyst at work. This chapter asks what that analyst, and every other member of the team, must be able to do, and how the organisation knows. The answer builds on a conclusion that runs through the earlier volumes: competence is shown by judgement exercised, not by attendance. Architecture as Code (Chapter 18) managed competence as a skills matrix by level, with certifications that validate knowledge and practical demonstration that shows capability (61, Nordqvist, 2025). AI Governance, Chapter 14, made AI literacy role-specific and asked that it be evidenced in individual records (62, Nordqvist, 2026). The Transformed Security Architect, Chapters 21 and 22, gave the form of a competence record and mapped it to the European Cybersecurity Skills Framework and SFIA (66, Nordqvist, 2026). This chapter carries that approach from the architect to the team that operates the boundaries.

A competence framework for the blue team

A competence framework lists what people in a function must be able to do, at which level, and what counts as evidence. It is useful only if decisions depend on it: who may approve a containment action at night, who may own a Level 3 closure class, which training a person needs next. A framework that sits in a human resources folder describes people without governing anything.

Eight domains and twenty-four identifiers

Hansa Mutual's group framework SOC-CF, version 2027.1, has eight domains of three identifiers each, 24 in all. The group owns it, as it owns the competence framework of AI Governance, Chapter 14, so that all seven entities use one level scale. Four domains follow the functions B1 Anticipate (HNT), B2 Detect (DET), B3 Investigate (INV) and B4 Respond (CMD). B5 Learn has no domain of its own: it is carried by CMD-03 (which includes the post-incident review), DET-02 and HNT-03 (turning findings into tested detections) and COM-03 (the purple loop with the red team). A team that wants to assess review facilitation as a specialism adds a learning domain at its next framework version. The other four domains, AGT, DAT, LAW and COM, are the ones on which every function depends.

Domain Identifiers Covers
DET Detection engineering (B2) DET-01 detection logic and tests as code; DET-02 coverage and tuning against techniques; DET-03 reviewing AI-drafted detections Chapter 6
INV Investigation (B3) INV-01 triage and scoping; INV-02 analysis and evidence handling; INV-03 reconstructing a case from the record, including an agent's part Chapters 7 and 8
HNT Hunting and intelligence (B1) HNT-01 intelligence to hypothesis; HNT-02 hunt design and execution; HNT-03 turning findings into detections Chapters 5 and 9
CMD Incident command (B4) CMD-01 incident coordination; CMD-02 containment and stop decisions; CMD-03 recovery handover, closure and the post-incident review Chapters 10 and 18
AGT Working with agents (B2 to B4) AGT-01 reading mandates, delegation profiles and playbooks; AGT-02 reviewing agent proposals; AGT-03 writing and testing the playbook that bounds an agent Chapters 13 to 15
DAT Data and query skills DAT-01 query and log literacy; DAT-02 telemetry quality and lineage; DAT-03 sampling and measuring AI output Chapters 6, 14 and 20
LAW Legal and regulatory literacy LAW-01 reporting duties and clocks; LAW-02 evidence, personal data and employee data; LAW-03 the AI Act duties for the team's own AI Chapter 19
COM Communication COM-01 the case record and the handover; COM-02 briefing management and non-specialists; COM-03 working with providers, the red team and employee representatives Chapters 16 and 18

Identifiers are unique within a framework, and a record always names the framework and its version. The architect's framework SA-CF of The Transformed Security Architect also has a LAW-02; the two are different competences and are never compared by identifier alone.

Nordvik Region has six analysts and no detection-engineering function at the start of the book, so a framework of 24 identifiers would describe a team it does not have. Its own framework, SOC-CF-NR version 2027.1, uses the same eight domains and codes but has twelve identifiers: DET-01, INV-01, INV-02, HNT-01, CMD-01, CMD-02, AGT-01, AGT-02, DAT-01, LAW-01, LAW-02 and COM-01. It leaves out AGT-03, because the Region's triage assistant NR-SEC-001 runs at Level 1 Assisted and the Region writes no Level 3 playbooks for agents, and it leaves out the engineering identifiers beyond DET-01 until the Region has more than one person who engineers detections. The omissions are decisions in a record, not oversights, and they come back for review whenever the Region raises an autonomy ceiling.

Four levels, shown with and without the assistant

The levels are those of Architecture as Code (Chapter 18) and AI Governance, Chapter 14: Foundation, Practitioner, Advanced and Expert. The Transformed Security Architect, Chapter 21, added a second condition that carries over to the blue team: a competence that can be done with or without the assistant is shown in both forms, and the lower of the two counts. Competences that exist only with an assistant, such as reviewing its draft (AGT-02), are assessed in that form alone. A detection engineer who writes sound logic only when the drafting assistant proposes it has not shown DET-01 at the level that supervising the assistant requires.

Level The person can Typical evidence
Foundation Explain the concept and act under guidance Course, certificate or briefing, with a short practical check
Practitioner Do the work unaided in ordinary cases Unassisted performance in an exercise, reviewed by an assessor
Advanced Handle the contested or novel case and review others' work Unassisted exercise result plus a review record of someone else's work
Expert Set the team's practice and decide where the framework is silent Artefacts that held under test, such as a playbook that survived a purple exercise

Certificates support the lowest level only. Everything above Foundation rests on an exercise or on a record of work that was tested.

What each role needs

The roles that grow when triage is automated (Chapter 17) need different profiles. The defaults below are starting points that a team adapts to its size and risk appetite.

Role Highest-weighted competences Typical level
Analyst INV-01, INV-02, DAT-01, AGT-02, COM-01 Practitioner
Detection engineer DET-01 to DET-03, DAT-01, DAT-03, HNT-03 Advanced
Investigation lead INV-02, INV-03, AGT-02, LAW-02, COM-01 Advanced
Incident commander CMD-01 to CMD-03, LAW-01, COM-02, AGT-01 Advanced
Agent operator AGT-01 to AGT-03, CMD-02, DAT-03 Advanced in AGT
Threat hunter HNT-01 to HNT-03, DAT-01, DAT-02 Advanced

Competence records

A competence record (CMP-*) is a record of judgement exercised: the levels a person has shown, the evidence that shows them, the validity period and the development plan. It follows the form of The Transformed Security Architect, Chapter 21, with the same separation of three things. The record holds levels and references. The evidence stays under its own access rules. The assessor's working notes are deleted once the subject has had the chance to read the record and contest it; the evidence the record points to is kept under its own access rule.

Records are personal data

An assessment of how well a person judges is among the more sensitive kinds of employee data. The GDPR applies, including the principles of purpose limitation, data minimisation and storage limitation, the right of access, and Article 88, which lets member states set more specific rules for employment data (8, European Union, 2016). The record schema therefore carries its purposes, its readers and a list of uses that are excluded. Three rules are fixed for a blue team.

  1. Exercise evidence only. The record refers to performance in exercises and to reviewed artefacts. It holds no production oversight metric, no approval time and no AI-use log of the person. Chapter 14 reports the oversight-quality metric at team level only, and Chapter 12 extends the union rule of no per-name reporting to the AI-use log. A competence record that smuggled either back in by the side door would break those agreements.
  2. No ranking. The excluded uses include individual performance ranking, pay setting and disciplinary proceedings. The team sees a count of holders per identifier and level, never a league table.
  3. The person reads it all. The subject may read the whole record and attach a comment before it is accepted.

Whether the record may be requested under public-access rules, whether archive duties require evidence to be kept, and how personal data in it is protected depend on national law, and the Region's counsel decides them; where a peer analyst from a neighbouring region sees an employee's performance, the two bodies need a data-sharing arrangement first; the architectural implication is that the schema separates the record from the evidence so that each can carry its own access rule. In Germany, works council rights over assessment principles and over systems suited to monitor behaviour or performance apply to the framework and to its tooling (AI Boss, Chapter 23) (67, Nordqvist, 2026), and at Nordvik the union has negotiated that closure rates and similar measures are never reported by name.

Worked example: competence record CMP-NR-04

Illustrative example. On 2027-06-09 the Region ran its first half-day exercise (the practical guide above) and wrote the first competence records for its analysts, CMP-NR-02 to CMP-NR-07, one for each of the six. CMP-NR-04 belongs to a security analyst with four years in the unit. The scenario was a synthetic case built on the techniques of spearphishing with a link (ATT&CK T1566.002) and valid accounts (T1078) (9, MITRE, n.d.), run on the Region's reserved capacity with no real data. The case had two parts. In the unassisted pass the analyst worked a case from the raw evidence, with no AI summary. In the assisted pass the analyst reviewed an AI-drafted summary of a parallel case that held three seeded errors.

# competence/records/CMP-NR-04.yaml (illustrative)
competence_record:
  id: CMP-NR-04
  person_ref: NR-EMP-40417
  role: security_analyst
  framework: {id: SOC-CF-NR, version: "2027.1"}
  assessed_on: 2027-06-09
  exercise: EX-NR-2027-01        # seeded incident, synthetic data
  assessors: [detection_owner, peer_analyst_neighbouring_region]
  purposes: [development_plan, input_to_duty_rota_decision]   # a named person decides the rota
  not_used_for: [individual_performance_ranking, pay_setting, disciplinary_process]
  readers: [record_subject, ciso, hr_competence_partner]
  competences:   # both forms: the lower counts; AGT-02 is assessed in the assisted pass only
    - {id: INV-01, level: practitioner, unassisted: EVD-NR-2027-011, assisted: EVD-NR-2027-012}
    - {id: INV-02, level: foundation,   unassisted: EVD-NR-2027-013, assisted: EVD-NR-2027-014}
    - {id: AGT-02, level: foundation,   assisted_only: EVD-NR-2027-015}   # 1 of 3 seeded errors caught
    - {id: CMD-01, level: foundation,   tabletop: EVD-NR-2027-017}
    - {id: DAT-01, level: practitioner, unassisted: EVD-NR-2027-019, assisted: EVD-NR-2027-020}
  rota_guidance: {INV-01: practitioner, CMD-01: practitioner}   # read by the CISO, who decides
  rota_decision: {by: ciso, recorded_as: AIDR, reasons_recorded: true}
  subject_comment: agrees; asks for a tabletop before the next on-call block
  development_plan:
    learning_path: LP-NR-SOC-2027-01   # decided as AIDR-0725
    protected_time_share: 0.10
    items:
      - {competence: CMD-01, target: practitioner, by: 2027-11-30, means: joint tabletop with neighbouring region}
      - {competence: AGT-02, target: practitioner, by: 2027-12-31, means: seeded-error drills, monthly}
      - {competence: INV-02, target: practitioner, by: 2028-03-31, means: paired case work with detection owner}
  valid_until: 2028-06-09

The record shows what it was designed to show. The analyst held INV-01 and DAT-01 at Practitioner in both passes. INV-02 stands at Foundation because the lower of the two passes counts: evidence handling was sound with the assistant and slipped without it, a gap that the assistant had masked. AGT-02 exists only in the assisted form, because reviewing an AI draft needs a draft: the analyst caught one of the three seeded errors, which the assessors graded as a gap to close and not as a failure. CMD-01 was observed in a tabletop.

The rota guidance names Practitioner in CMD-01 for the duty-analyst call-out, which the record does not show. The record informs the decision and does not make it. The CISO decides who is on the rota, records the reason, and here chooses to keep the analyst on it, paired with an eligible colleague as second call until the tabletop of the development plan is done. In a team of six, removing someone from the rota raises the call-out load of the others (one week in six becomes one in five), so the decision weighs that cost. A lapse in the record is handled like an expired certificate on a service: it prompts a conversation and a booking, and never removes anyone automatically.

Exercises as assessment

An exercise puts a person or a team in a situation with consequences, observes what they do and records it. Chapter 11 introduced purple exercises as a source of detections, and AI Red Team described red teaming and adversary emulation as authorised, scoped activity that ends in a defensive improvement (64, Nordqvist, 2026). This chapter uses the same exercises for a second purpose: they are where competence is seen.

Six kinds of exercise

Exercise Assesses best Limits
Tabletop CMD-01, CMD-03, LAW-01, COM-02 Talk is not action; shows decisions and roles, not skill with tools
Seeded incident in the queue INV-01, INV-02, AGT-02 Needs realistic seeds and a seed owner who does not review them (Chapter 14)
Cyber range or synthetic estate DET-01, DAT-01, HNT-02 Costs to build; only as good as its fidelity
Purple exercise DET-02, DET-03, HNT-03, COM-03 Scenario is known to the red team; measures the loop more than the person
Stop and degraded-mode drill CMD-02, AGT-03 Narrow, but the one place stop skill is shown; also a test of the platform
Chaos experiment on the SOC's own tools DAT-02, CMD-02, team resilience Needs a stop path for the experiment itself

The threat-led tests that supervisors set for large financial entities also belong in the table. DORA provides for threat-led penetration testing of significant financial entities (2, European Union, 2022), and the ECB's TIBER-EU framework describes such tests as intelligence-based and ethical (12, ECB, 2025). Chapter 11 placed them in the learning loop. Their cadence and scope are set from outside the team, and what the team learns from them enters the loop through the finding register, not through individual grades.

Security chaos engineering, the practice described by Rinehart and Shortridge (58, Rinehart & Shortridge, 2023) and applied to verification in AI Red Team, Chapter 25, deserves a word. A chaos experiment on the SOC's own tooling, such as silencing a log source or stopping the triage agent without warning to the shift, tests whether the manual queue opens within its target. Such an experiment shows whether the team and the runbook work; taken alone it does not grade a person.

Practical guide: Assessing a team in a half-day exercise and writing the records

Purpose. To produce, in half a day, evidence of what the team can do unassisted and with its assistants, and to turn that evidence into competence records and a learning plan.

Roles. The SOC lead (or, at Nordvik, the CISO) owns the exercise. A seed owner builds the scenario and does not assess. Two assessors, of whom one comes from outside the person's line (a peer from another entity, region or team), grade the evidence. The data protection officer or privacy officer checks that the scenario holds no real personal data. An employee representative receives the schema and the grading rubric in advance. The participants are the people being assessed.

Steps.

  1. Agree the terms first. Before the first exercise, agree with employee representatives the purposes, readers and excluded uses written into the record schema. Do not run the exercise until they are agreed.
  2. Choose six to ten identifiers from the framework to assess, not all of them. Name the level at which each is to be shown.
  3. Build one scenario from a past post-incident review (Chapter 11), rewritten so that no real identity or host remains. For the assisted pass, seed three errors in an AI-drafted summary and one false lead. Write the correct answer for each before the exercise.
  4. Run it in two passes. In the first pass the participant works the case without the assistant for 60 minutes. In the second pass the participant reviews the assistant's draft of a parallel case, with its seeded errors, for 60 minutes. Hold a 30-minute tabletop for the incident-command identifiers at the end.
  5. Grade against the rubric. Each assessor grades independently; where they differ by a level, they meet and record the reason. Where an identifier has both forms, the lower of the two is the level.
  6. Write the record within five working days. Show the participant the draft, record the comment, delete the working notes and file the record. Update the team map, a count of holders per identifier and level that carries no names.
  7. Write the learning plan. For each identifier below the role's target, name the means (pairing, course, tabletop, drill), the date and the protected time.
  8. Feed the loop. Every finding about a tool, rule or runbook goes to the finding register of Chapter 11. A finding about a person goes only to that person's plan.

Definition of done. Every participant has a record they have read, the team map is updated, each gap has a dated means, and the register holds the findings about the system. If a participant's result is visible to anyone beyond the readers in the schema, the exercise failed its own rule.

Defaults to adapt. The 60-minute passes, the five-day deadline and the ten-identifier cap are starting points. A team of six lengthens the cycle rather than assessing fewer people, and a team under a works agreement follows the agreement's deadlines and review rights over these defaults.

Literacy for working with agents

AI literacy in the AI Act is not a course title. Article 4 asks providers and deployers to take measures to ensure, to their best extent, a sufficient level of AI literacy among their staff and others who operate and use AI systems on their behalf, taking account of their knowledge, experience and the context of use (1, European Union, 2024). AI Governance, Chapter 14, discusses the Commission's Digital Omnibus proposal of November 2025 to change the article; this chapter relies on Article 4 as adopted and leaves the status of any amendment to be confirmed against the live text. AI Governance concluded that the competent-oversight duties of Articles 14 and 26(2) and the management-body training duties of NIS 2 Article 20(2) and DORA Article 5(4) stay in place whatever happens to it (62, Nordqvist, 2026) (3, European Union, 2022) (2, European Union, 2022). For a SOC the legal text matters less than the design question it points to, which is what a person must know in order to supervise an agent that works at night.

Four abilities answer it, and they define the AGT domain.

  • Writing a mandate. The person can state what an agent may read, which actions it may take, at which level, under which budget and with which stop path, in a mandate manifest (Chapter 13), and can say what each line prevents. This is AGT-01 at Practitioner and AGT-03 at Advanced when the person also writes the playbook that bounds a Level 3 class.
  • Reviewing a proposal. The person can test an agent's conclusion for grounding, completeness, alternatives, stated confidence and reversibility (Chapter 14), and can find a seeded error under time pressure. This is AGT-02. AI Threat, Chapters 6 and 14, concluded that relying on AI reduces effort and recall and, among those who trust the tool, checking (65, Nordqvist, 2026). Research on human use of automation points the same way (76, Parasuraman & Manzey, 2010). That is why review is assessed in an exercise and not assumed. AGT-02 is assessed in the assisted pass, on a draft with seeded errors.
  • Stopping. The person can invoke the stop path without asking anyone, knows what it does and does not undo, and has done it in a drill within the target time. This is CMD-02. A stop path is used rarely, so the skill is drilled. On the night of INC-HM-2027-0455 the shift lead stopped the agent in 57 seconds against the 120-second target, yet the drill of 2027-04-27 took 3 minutes 40 seconds (FND-HM-0455-3, Chapter 11). The drill showed that the practice was less even than the night suggested, and the re-test of 2027-06-03 took 1 minute 46 seconds. A drill measures the skill; it does not guarantee it.
  • Reconstructing an agent incident. The person can read the case record, the mandate and the action log after the fact and say which source an action rested on, which rule allowed it and who delegated it. This is INV-03. It is the skill a post-incident review depends on, and it is the one that makes the "named human decider" of the series more than a name.

These abilities are shown in exercises: a seeded error for review, a timed stop, a mandate written from a brief and a reconstruction from a record that has a fault in it. Reading about them is Foundation.

AI Red Team, Chapters 6 and 15, and The Transformed Security Architect, Chapter 15, reached the same conclusion for different roles: supervision and the degraded mode after a stop need skills that automation tends to leave unexercised (64, Nordqvist, 2026) (66, Nordqvist, 2026). Bainbridge described the pattern in 1983: automation leaves people the cases it cannot handle and removes the practice that prepared them for those cases (75, Bainbridge, 1983). The unassisted share of Chapters 12 and 14 is the continuing practice; the exercise is where its effect is measured. Chapter 23 treats the route by which new analysts acquire these competences at all.

Linking competence to autonomy

A competence framework becomes an architecture artefact when an autonomy ceiling depends on it. The Transformed Security Architect, Chapter 21, tied an agent's Level 3 ceiling to two architects who could write the bounding playbook unaided. The blue team adopts the same rule. A Level 3 Bounded class, defined by a codified playbook enforced by a policy decision point outside the model, needs people who could write that playbook themselves and who can stop the class. One rule governs every Level 3 class in this book. The class needs at least two evidenced holders of the bounding competence in the pool that can be rostered for it at each site where it runs, so that a single night reviewer always has a colleague who can take over or be called. Chapter 23 calls this pool the rota. If the holders fall below two, the ceiling falls to Level 2 Supervised until the gap closes, and Chapter 21 explains why the volume of proposals is capped at the same time. Holding the competence at Advanced means being able to write and test the playbook, which is more than working the class by hand; the craft register of Chapter 23 counts the latter, and the two counts are kept side by side.

Worked example: competence conditions on autonomy

Illustrative example. Hansa Mutual's AIDR-0780, decided on 2027-07-06, adopts SOC-CF version 2027.1 and makes two of the ceilings in the mandate manifests depend on evidenced competence.

# competence/conditions.yaml (illustrative)
decision: AIDR-0780
framework: {id: SOC-CF, version: "2027.1", owner: group_soc_lead}
conditions:
  - id: COND-HM-SOC-01
    applies_to: {manifest: MND-HM-SOC-01, ceiling: level_3_bounded, classes: [SC-01, SC-02]}
    requires:
      competence: AGT-03
      level: advanced
      holders_at_least: 2
      per_site: [hamburg, polish_service_centre]
    on_unmet: {ceiling: level_2_supervised, notify: [soc_lead, group_ai_governance_board], rota_decision: soc_lead}
  - id: COND-HM-SOC-02
    applies_to: {manifest: MND-HM-SOC-02, ceiling: level_3_bounded, actions: [workstation_isolation, session_revocation]}
    requires:
      competence: CMD-02
      level: advanced
      holders_at_least: 2
      per_site: [hamburg, polish_service_centre]
      stop_drill_within_days: 90
    on_unmet: {ceiling: level_2_supervised, notify: [soc_lead, incident_response_lead]}
check:
  schedule: nightly
  reads: [level, validity]
  never_reads: [record_content, evidence, working_notes]
  lapse_is: expiry_not_disciplinary_event

A holder whose record expires is treated like a certificate that has lapsed on a service: the nightly check lowers the agent's ceiling, the owner is told and the person books the reassessment. The check acts on the agent's autonomy and never on the person: who is rostered is decided by the SOC lead. Nobody is called to account for the lapse. The check counts holders and never opens a record, which is what the Konzernbetriebsrat and the Polish employee representatives were asked to agree.

Training, certification and their limits

Training has three parts in this framework. Briefings bring a person to Foundation: two hours on the mandate, the delegation profile and the stop path of the team's agents (AGT-01), and a half-day on the reporting clocks (LAW-01). Practice keeps the person at Practitioner: the unassisted share of Chapter 14, a monthly seeded-error drill of an hour and a quarterly stop drill. Exercises, a half-day twice a year, show Advanced. These hours are defaults, are worked time, and are paid by the organisation. At Nordvik they come from the 10 per cent of time protected in the learning path; at Hansa from the framework budget of the group SOC.

Certificates have a place. A course or certificate shows that a person has met a defined body of knowledge at a point in time, it is portable between employers, and it is an efficient way to bring a newcomer to Foundation. They show less than they seem to. A certificate does not show what the holder does under the time pressure of a live case or without the assistant, and in a field that changes yearly it dates from the day it is issued. The consequence is a division of labour: certificates support Foundation and are a reasonable screen at recruitment, while Practitioner and above rest on exercises and on reviewed work.

The skills figures of the ISC2 study (Chapter 21) point the same way: 95 per cent of respondents reported at least one skill need and 41 per cent named AI as a top needed skill (73, ISC2, 2025). The survey is self-reported. It supports a modest conclusion, which is the book's own: a team that wants AI skills cannot assume the market will supply them, and a framework that names the skills lets it grow them.

Hiring and upskilling

The conclusion of AI Governance, Chapter 14, is that upskilling is the strategy and hiring is for scarce specialisms (62, Nordqvist, 2026). It holds for the blue team with a qualification. The scarce specialisms are detection engineering, agent operation and, for a small public body, any hunting capacity at all. The people available to be upskilled are the analysts whose tier 1 work is being automated, and their development has to start before the work disappears, not after.

Careers need a specialist ladder and a path between building and verifying. AI Governance, Chapter 14, recorded that people who build an AI system should not be the only people who verify it, with a cooling-off period between the roles. In the SOC this means that the detection engineer who builds a rule is not the only person who assesses coverage, and the person who writes an agent's playbook does not alone certify the stop drill. Competence records make such moves visible: a reviewer qualified in DET-03 can review another engineer's drafts, and a rotation from operations into engineering is planned as a learning path.

Pay structures shape the mix. A post graded for a security coordinator cannot be advertised as an agent operator without regrading, and a regional authority works inside its grading system. The tools it has are protected time, a clear ladder, and access to exercises it could not run alone. A multinational insurer faces a different limit: seven legal regimes and works councils make it slow to restructure the pyramid. Chapter 17 treats the shape of the team; this chapter treats the people who move in it.

Mapping to frameworks

A framework of one's own is useful because it names the team's work. It gains by being readable by other organisations and by auditors, and two public frameworks serve that purpose.

The European Cybersecurity Skills Framework (ECSF) is published by ENISA, dated 19 September 2022, and describes twelve typical cybersecurity professional role profiles, each with a title, mission, tasks, skills, knowledge and competences (77, ENISA, 2022). SFIA 9, released by the SFIA Foundation in October 2024, describes skills and competencies for business and technology professionals in seven levels of responsibility, and covers information and cyber security among other areas (78, SFIA Foundation, 2024). Both describe roles and skills, and the framework owner checks how each reads against the AGT domain.

The mapping follows the method of The Transformed Security Architect, Chapter 21. For each identifier the framework owner records one of three fits against each public framework: a direct fit, a partial fit, or none, and for a partial fit or none an extension_reason in plain words. The owner decides the fit, not this book, and the owner re-checks it when either framework is revised. The book makes no prediction about the outcome. A mapping lets a Nordvik analyst's record be read by a neighbouring region or by a procurement panel that asks for ECSF profiles, and it lets Hansa show a supervisor that its framework is not an idiosyncrasy. It does not replace the exercise.

Outlook for competence evidence

The labels follow AI Governance, Chapter 22 (62, Nordqvist, 2026).

  • Observable. Skills shortages are documented: the ISC2 survey records them among its respondents (73, ISC2, 2025). Exercises already serve as assessment where supervisors set threat-led tests for financial entities (2, European Union, 2022) (12, ECB, 2025).
  • Expected. DORA sets requirements on digital operational resilience testing and on the training of staff and of the management body (2, European Union, 2022), and NIS 2 Article 20(2) requires training of management bodies (3, European Union, 2022). On that direction of the instruments, competence evidenced by exercises is expected to become a normal form of evidence in regulated sectors. The expectation rests on the instruments and not on a rule that requires it.
  • Speculation. That AI tutors will replace exercises as the means of showing competence is speculation. A tutor can teach, and teaching is not showing under pressure without help; nothing cited here supports the replacement. The author's own projections are confined to Chapters 24 and 28.

Across the degrees of delegation

The competence a person needs depends on the level at which the AI works, and each step up moves it from doing toward bounding and verifying.

Level What the person must be able to do Evidence
Level 0 Advisory Treat the output as a lead, not a finding AGT-01 at Foundation; briefing recorded
Level 1 Assisted Review each output and do the task unaided when the assistant is unavailable INV-01 at Practitioner, unassisted pass; AGT-02, assisted pass
Level 2 Supervised Approve or refuse each action in minutes and find a seeded error AGT-02 at Practitioner; seeded-error result in an exercise
Level 3 Bounded Write and test the playbook, stop the class and reconstruct what it did AGT-03 and CMD-02 at Advanced; at least two holders per site
Level 4 Autonomous No competence is defined: no delegation profile in this book uses Level 4, and the profile schema rejects it Not applicable

Nordvik Region and Hansa Mutual

Nordvik Region. The unit's six analysts have no detection engineer to learn from and no team large enough to rotate. The learning path LP-NR-SOC-2027-01, decided as AIDR-0725 on 2027-05-25 with the unions' agreement on the record terms, gives each analyst 10 per cent of their time, protected in the rota, and buys places in an exercise run by a neighbouring region, whose security architect already exchanges practice with the Region's. The first exercise on 2027-06-09 produced CMP-NR-02 to CMP-NR-07. The assessors were the Region's detection owner and a peer analyst from the neighbouring region, so no one assessed a colleague alone. The records are read by the analyst, the CISO and the human resources competence partner, and never by name in any report; the union's rule that closure rates are not reported by name was extended to the records. The framework has twelve identifiers and no AGT-03, a decision that returns for review when the Region raises an autonomy ceiling. Its leverage is the exercise and the protected time, not hiring.

Hansa Mutual. The group owns SOC-CF with 24 identifiers and runs the quarterly purple exercise with the red team of five and the detection-engineering team of four; each analyst and shift lead takes part in at least two exercises a year, and the competence records, such as CMP-HM-31 for a Polish service centre analyst and CMP-HM-32 for a detection engineer, hold the evidence. AIDR-0780 was agreed with the Konzernbetriebsrat and the Polish employee representatives, with the Swedish unions consulted for the Swedish entity; its record terms exclude ranking, and the nightly check reads levels only. The conditions tie two Level 3 ceilings to evidenced holders at both sites. The pattern differs from Nordvik's: Nordvik uses exercises to find out what its few people can do, and Hansa uses them to keep the autonomy of its agents in step with a large team's demonstrated judgement.

Summary

The transformed blue team needs a framework of competences that its decisions depend on. Hansa's has eight domains and 24 identifiers, Nordvik's the same domains and twelve; both use four levels and, where a competence has an unassisted and an assisted form, count the lower of the two. Competence records follow the form of The Transformed Security Architect: they hold levels and evidence references, exclude ranking, pay and discipline, and are read by the person they concern. Exercises, not certificates, show competence above Foundation.

Exercises are tabletops, seeded incidents, ranges, purple exercises, stop drills and chaos experiments, and the half-day assessment of the practical guide turns them into records and learning plans in five working days. The work with agents has its own domain: writing a mandate, reviewing a proposal, stopping the agent and reconstructing what it did. It meets the AI literacy duty of Article 4 of the AI Act in the only form that matters to a SOC, evidence of ability. It also fixes the autonomy a team may use: with fewer than two evidenced holders per site, a Level 3 Bounded class falls back to Level 2 Supervised.

The chapter concerns B1 Anticipate through the hunting and intelligence domain, B2 Detect through detection engineering and the review of drafted detections, B3 Investigate through analysis and reconstruction, B4 Respond through command and the stop decision, and B5 Learn because the exercises are where the learning loop meets the people. ECSF and SFIA make the framework readable beyond the organisation, with extension reasons recorded where the owner finds a gap. Hiring covers scarce specialisms; upskilling covers the rest, and it has to start before the work it replaces disappears. Chapter 23 turns to the question this chapter leaves open: when AI does the junior triage through which analysts learned, how do the next analysts acquire these competences at all, and how do experts keep their own?

Sources

  1. Nordqvist, G. (2025). Architecture as Code. The Architecture as Code Series, Book 1. (61, Nordqvist, 2025)
  2. Nordqvist, G. (2026). AI Governance: Governing Artificial Intelligence in European Enterprises and Public Authorities. The Architecture as Code Series, Book 2. (62, Nordqvist, 2026)
  3. Nordqvist, G. (2026). AI Red Team: AI as an Active Part of Cyber Defence in European Enterprises and Public Authorities. The Architecture as Code Series, Book 4. (64, Nordqvist, 2026)
  4. Nordqvist, G. (2026). AI Threat: Are the Dystopias Coming True? Evidence, Risk and Response for European Enterprises and Public Authorities. The Architecture as Code Series, Book 5. (65, Nordqvist, 2026)
  5. Nordqvist, G. (2026). The Transformed Security Architect: Role, Craft and Career in the Age of AI in European Enterprises and Public Authorities. The Architecture as Code Series, Book 6. (66, Nordqvist, 2026)
  6. Nordqvist, G. (2026). AI Boss: When Artificial Intelligence Manages People in European Enterprises and Public Authorities. The Architecture as Code Series, Book 7. (67, Nordqvist, 2026)
  7. European Parliament and Council of the European Union. Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act). (1, European Union, 2024)
  8. European Parliament and Council of the European Union. Regulation (EU) 2022/2554 on digital operational resilience for the financial sector (DORA). (2, European Union, 2022)
  9. European Parliament and Council of the European Union. Directive (EU) 2022/2555 on measures for a high common level of cybersecurity across the Union (NIS 2 Directive). (3, European Union, 2022)
  10. European Parliament and Council of the European Union. Regulation (EU) 2016/679 (General Data Protection Regulation). (8, European Union, 2016)
  11. MITRE Corporation. MITRE ATT&CK: Adversarial Tactics, Techniques, and Common Knowledge. (9, MITRE, n.d.)
  12. European Central Bank. TIBER-EU: Threat Intelligence-Based Ethical Red Teaming framework. (12, ECB, 2025)
  13. Rinehart, A. & Shortridge, K. (2023). Security Chaos Engineering: Developing Resilience and Safety at Speed and Scale. O'Reilly Media. (58, Rinehart & Shortridge, 2023)
  14. ISC2 (2025). 2025 Cybersecurity Workforce Study. (73, ISC2, 2025)
  15. Bainbridge, L. (1983). Ironies of Automation. Automatica 19(6). (75, Bainbridge, 1983)
  16. Parasuraman, R. & Manzey, D. H. (2010). Complacency and Bias in Human Use of Automation: An Attentional Integration. Human Factors 52(3). (76, Parasuraman & Manzey, 2010)
  17. European Union Agency for Cybersecurity (2022). European Cybersecurity Skills Framework (ECSF) Role Profiles. ENISA. (77, ENISA, 2022)
  18. SFIA Foundation (2024). SFIA 9: the global skills and competency framework for the digital world. (78, SFIA Foundation, 2024)