Keeping the Craft and Making New Analysts: The Apprenticeship Problem

If AI closes the repetitive alerts, the work through which many analysts have learned their craft goes first, and the experts who remain do less of the work that made them experts. This chapter treats that double problem: where the next analysts come from, and how the present ones keep their skill. It concerns B3 Investigate, where the entry rung of the ladder used to be, B2 Detect, which offers a new first rung, and B5 Learn, whose reviews and exercises are a school for the team; the degraded-mode drills reach B4 Respond. It applies AI Threat, Chapter 14, and the craft-keeping design of The Transformed Security Architect, Chapter 15, to the security operations centre (SOC), stages a debate on whether the junior route is needed, and ends with a plan a team can run.

Figure 23.1: How an analyst is made when triage is automated: unassisted practice, rotation, seeds and degraded-mode drills.

The ladder and the missing rung

A tier 1 analyst is the person who first reads an alert, decides whether it is noise or the start of something, and escalates to tier 2 or tier 3 when it is the latter. In many SOCs that post has been the route into the craft, and for most holders a poor way to spend a working day. The bibliography does not show how common the route is, and it does not show whether entry posts are disappearing: the ISC2 study reports skill needs and not entry-level hiring (Chapter 21) (73, ISC2, 2025). The chapter therefore treats the loss of the entry rung as a risk to design against and not as an established trend.

What the old route taught was real: an analyst who reads alerts day after day learns what the estate's ordinary days look like and when a question is worth an escalation, the hunter's sense of Chapter 9, and learns it by repetition with consequences. What it cost was also real. Qualitative studies of SOC analysts report that validating alarms is tedious and can lead to desensitisation and burnout (69, Alahmadi et al., 2022), and a six-month study of a corporate SOC found burnout leading to poor judgement and turnover, with career progression treating symptoms and not causes (70, Sundaramurthy et al., 2015). Both concern few sites and neither measured AI. They support a limited conclusion: the old tier 1 produced analysts, but also turnover and fatigue, and nobody should aim to restore it unchanged.

Chapter 7 closes the repetitive classes by class, with sampling and a named owner. The queue that reaches a person is then different in kind: the ambiguous, the novel and the high-consequence alerts that no policy lets an AI system close. Two problems follow. The pipeline: if the entry rung shrinks, the next tier 2 and tier 3 analysts must arrive by another route, and a junior placed straight onto the residual queue meets only the hardest cases. The stock: the experts who remain supervise agents (Chapter 13), review their conclusions (Chapter 14) and carry the degraded mode, which needs exercised skill that the same automation removes.

The book's conclusion is that the ladder is rebuilt and not restored. Tier 1 was one way of producing the capabilities investigation requires: reading raw evidence, testing a hypothesis, scoping an incident, writing a query and a detection, and running a containment by hand. A team that lists them can ask, for each, where a junior now practises it and where an expert keeps it.

The pipeline arithmetic

The pipeline problem is a sum, and a team can do it. The sum below uses an assumed attrition of 10 per cent a year, a figure for illustration and not a finding; a team substitutes its own.

	Nordvik Region	Hansa Mutual
Analyst and investigation-lead posts	6 analysts	28 (22 analysts and 6 leads)
Leavers a year at 10 per cent	about 0.6	about 2.8
Posts converted to other roles (AIDR-0719, AIDR-0775)	1 into detection engineering from 2027-07-01	4 over two years, filled from the analysts: 2 a year
Entrants needed a year, to hold the head count	about 1	about 5
Entrants the route provides	1 trainee post, first intake 2027	a cohort of 2 (AIDR-0781)

At Hansa the cohort of two covers about two fifths of the need, and the rest comes from external hiring, which the survey evidence suggests is constrained: 29 per cent of ISC2's respondents said they could not afford the skills they needed (73, ISC2, 2025). At Nordvik one trainee matches the arithmetic but rests on one mentor. The same sum shows the ten-year consequence of an empty pipeline: at 10 per cent a year about 35 per cent of today's team remain after ten years. That is arithmetic from an assumption, not a forecast, and it shows that the gap is invisible until late, because the present experts are still there.

What the evidence shows

The problem is older than AI. Bainbridge's "Ironies of Automation" and the review by Parasuraman and Manzey of complacency and bias in human use of automation are the standard references on people who supervise automated work (75, Bainbridge, 1983) (76, Parasuraman & Manzey, 2010). The more routine work a system takes, the less practised the person is when the system fails, and people who rely on automation check less. Neither paper concerns security operations; the transfer to the SOC is the book's own step. AI Threat, Chapter 14, brought the literature up to date for generative AI and concluded that relying on AI reduces effort, recall and checking among those who trust the tool, and that automating junior work removes the route by which experts are made (65, Nordqvist, 2026). AI Red Team, Chapters 6 and 15, drew the consequence for autonomy (64, Nordqvist, 2026), and The Transformed Security Architect, Chapter 15, turned it into a design with a rule that a class may be delegated to Level 3 Bounded only while enough people can still do it unaided (66, Nordqvist, 2026).

The labels are these.

• Observable. That people who work beside reliable automation check less, and that unexercised skills decay, is documented in settings other than the SOC.
• Expected. That the same happens to SOC analysts as AI takes over triage and summarising. The mechanism is the same and the trend, closure by class and summarising by default, is decided in the two organisations; no source in the bibliography measures it in SOC analysts with a comparison group.
• Speculation. That the entry rung disappears altogether, so that organisations hire no juniors.

Skill depends on practice, practice is a design variable, and the cost of ignoring the variable falls on the day the automated system is unavailable or wrong.

Unassisted practice

The simplest instrument is a share of work done without the assistant, which Chapters 7, 12, 13 and 14 each use. This section adds selection, grading and a floor.

What the share applies to

The unit differs by activity, and a policy that does not say which unit it uses cannot be audited.

Activity	Unit	Nordvik Region	Hansa Mutual
Triage of alerts in a class a person still reviews	Alerts	No separate share; the case share applies	One in five during Step 2 of an agent's introduction (Chapter 13)
Investigation	Cases	One case in ten (AUS-NR-SOC-01, Chapter 12)	One case in five (AIUP-HM-SOC-01, Chapter 12)
Hunting	Hunt queries	One hunt in four written by the hunter (Chapter 9)	One hunt in four (Chapter 9)
A new analyst's core work	Cases and alerts	All, for the first six months	All, for the first six months

Nordvik's case share is lower because a team of six has no slack; the price, that its experts practise less, is recorded in AIDR-0726 (illustrative) below. The apprentice's "all" is stricter than the one-in-two default for new analysts in Chapter 12, by design.

Selection, grading and the floor

Select at random, not by preference. Analysts who choose which cases to work unassisted choose the easy ones. The case tool assigns the flag with a stated probability and hides the AI summary for flagged cases. A flagged case that proves severe keeps the flag and a second analyst joins.

Grade the work, for learning. An unassisted case that no one reads teaches little. A second person grades a sample against a short rubric (the right sources, the timeline, the scope with its limits, the support for the conclusion): by default one in four within five working days, with feedback in conversation. The grade is a development record, not a rating, and is not reported by name.

Hold a floor and measure the actual. A share that is set in policy and not measured erodes first. Hansa's oversight record for 2027-Q3 (Chapter 14) reports an unassisted share of 0.10 where AIUP-HM-SOC-01 sets 0.20. This chapter reads it as a finding. The ordinary reasons are the ones the share exists to resist: review volume at three times the baseline and a night shift with no one to spare. A gap between policy and practice is a finding for B5 Learn, not a matter of individual blame.

The craft register and the supervision rule

A share says how much practice happens. The craft register says what the team can do as a result. It is a table at team level, kept in version control beside the mandate manifests: for each task that the team's agents perform or support, how many analysts have demonstrated it without assistance in the last twelve months, when the last demonstration was, and what the minimum is for the current degree of delegation. A name never appears in it.

Task	Agent or tool involved	Delegation now	Minimum able to work it unaided in the rota pool
Triage of a closure class	Triage agent	Level 3 Bounded with 5 per cent sampling	2
Investigation from raw data to scoped case	Investigation agent	Level 2 Supervised	2
Manual isolation of a workstation by playbook	Isolation playbook	Level 3 Bounded for a defined action	2
Writing and testing a detection	Detection drafting	Level 1 Assisted	1 per team

The rota is the pool of people who can be rostered for the class at a site, not one shift, in the sense of Chapter 22, where the Level 3 rule requires at least two evidenced holders of the bounding competence. The register counts who can work a class by hand, which is a lower bar than writing the playbook (AGT-03 at Advanced); the two counts are kept side by side. The rule is the book's own conclusion and follows The Transformed Security Architect, Chapter 15 (66, Nordqvist, 2026): a class stays at Level 3 Bounded only while the register shows the minimum number of people able to work it manually in the pool. When the count falls below the minimum, the class returns to Level 2 Supervised until it is restored, and Chapter 21 explains why proposals are capped at the same moment so that the reviewer's load does not rise.

Apprenticeship routes

An apprenticeship route is a designed path from a person with little experience to an analyst who can work a case unaided and supervise an agent. It replaces the part of tier 1 that taught and drops the part that tired. Four mechanisms carry it.

Structured shadowing. The apprentice takes alternate roles in a live case: reader of the evidence, scribe of the case record and questioner of the senior's reasoning. The senior states hypotheses aloud before looking at the data, and the two compare conclusions at the end. Two night shifts and two major-incident calls in the first quarter are a minimum, because deciding under time pressure can be learned only by watching it.

Rotation between engineering and operations. AI Governance, Chapter 14, recommended a specialist ladder and a path between building and verifying (62, Nordqvist, 2026). In the SOC the two sides are detection engineering and operations. A junior who spends a fifth of the week in detection engineering learns why a rule fires and how it is tested against a scenario. That is the new first rung of B2 Detect: because detections are code (Chapter 6) and AI drafts are reviewed by people (Chapter 14), a junior can write the tests that accompany a detection, review a draft against its scenario and read a rule's history, with consequences small enough to learn from.

Seeded incidents and case replays. The Transformed Security Architect, Chapter 14, introduced seeded errors for review (66, Nordqvist, 2026). For apprentices the same instrument teaches. A replay takes a closed case from the case store, strips the conclusion, and gives the apprentice the evidence as it stood at the start. The apprentice works the case unassisted, and the mentor compares the result with the original and with the post-incident review. A replay has the realism of a real case and none of its consequences. Replays use cases scrubbed of direct identifiers, and special-category data stays on the Region's own capacity (AI Platform and Security, Chapter 15) (63, Nordqvist, 2026).

Graduated responsibility. The apprentice earns authority in stages, and each stage names what the apprentice may and may not do: work alerts in a shadow queue beside the live one, so that answers are compared and nothing is closed on the apprentice's word; work a low-severity class in that shadow queue under a senior's review; take a hunt as reader of results (Chapter 9); sit as scribe of a post-incident review (Chapter 11); and only then review the proposals of an agent at Level 2, because reviewing a machine's conclusion needs the skill the earlier stages build. The apprentice who first learns by approving learns to approve.

The apprentice and the assistant

An assistant can be an excellent tutor, and the rule that reconciles the two is attempt first, then ask. During the first six months the apprentice works every core case and alert without the assistant's summary. After committing a hypothesis in writing, the apprentice may ask the assistant to explain a field, critique the reasoning or propose what was missed, and the case record notes it. The sequence keeps the effort that builds recall and still gives what a patient senior would give; it is the "draft first" of AI Threat, Chapter 14 (65, Nordqvist, 2026).

Records, people and representatives

An apprenticeship record is personal data about a named person, and its use is a matter for employee representatives. AI Governance, Chapter 14, concluded that competence is assessed by practical demonstration and that results are personal data whose use is agreed with employee representatives (62, Nordqvist, 2026). GDPR Article 88 allows member states to set specific rules for the processing of employees' data (8, European Union, 2016), and in Germany the works council co-determines technical systems suited to monitor behaviour or performance (BetrVG §87(1) no. 6) (67, Nordqvist, 2026).

Chapter 21's annex prohibits per-person measures in reporting, and the record respects that. Progression is assessed by demonstration agreed with the representatives in advance, not by a score from the tooling. A named mentor and the SOC lead decide whether a stage is complete; no tool decides. A stage not yet complete leads to an extension and extra mentoring, never to removal from the post, and the results are visible only to the apprentice and the mentor. The competence record receives the levels shown and nothing else, as Chapter 22 fixes for its readers. Oversight metrics stay aggregate. The record also evidences the Article 4 AI literacy duty of the AI Act (1, European Union, 2024).

Worked example: apprenticeship record for a junior analyst at Hansa Mutual

The record below is illustrative. It belongs in version control beside the SOC's role charters and feeds the apprentice's competence record CMP-HM-33 with levels only. The decision to create the route is AIDR-0781.

# Illustrative apprenticeship record. Development record: owned by the apprentice.
id: APP-HM-2027-01
decision: AIDR-0781
competence_record: CMP-HM-33          # receives levels only
site: polish-service-centre
start: 2027-11-01
mentor_role: shift-lead
rotation_host: detection-engineering  # one day in five, from stage S2
works_agreement: KBV-IT-2024 (SOC annex, development records)
visible_to: [apprentice, mentor, soc_lead_stage_only]
forbidden_uses: [pay, ranking, dismissal, performance_rating, team_reporting_by_name]
assistant_rule: attempt_first_then_ask    # recorded in the case
unassisted_share: {core_work: 1.0, until: 2028-04-30}
stages:
  - id: S1
    window: [2027-11-01, 2028-01-31]
    may: [shadow_queue, case_replay, hunt_reader, post_incident_scribe]
    may_not: [close_on_live_queue, approve_agent_proposal]
  - id: S2
    window: [2028-02-01, 2028-04-30]
    may: [work_SC-03_alerts_in_shadow_queue, write_detection_tests]
    may_not: [approve_agent_proposal]
  - id: S3
    window: [2028-05-01, 2028-10-31]
    may: [review_level_2_proposals_tier_T1, run_manual_isolation_in_drill]
    may_not: [owner_of_a_level_3_class]
stage_gate:
  assessed_by: demonstration      # method agreed with representatives before day one
  demonstrations:
    - cases worked unassisted and read by the mentor against the rubric
    - replays and seeded incidents judged against a written answer
    - manual isolation by PBK-HM-ISOLATE-01 in a drill, within the playbook's drill target
    - two detection tests merged
    - two night shifts shadowed
  decided_by: [mentor, soc_lead]  # the tooling never decides
  tool_decides: false
  on_not_met: [extend_stage, add_mentoring]
  never: [removal_from_post]
review: {dates: [2028-02-01, 2028-05-02, 2028-08-01, 2028-10-31], by: [mentor, soc_lead, apprentice]}

Three features carry the design. The may_not lists make each stage a boundary the tooling can enforce, as it enforces an agent's permission manifest. The forbidden_uses list states in the record what the works council agreed. And the stage gate names what is demonstrated and who judges, with the consequence of a miss written down. The manual isolation target is the drill target of the playbook and not the 15-minute target of Chapter 13, which is the time to a worked manual queue.

Degraded mode

Chapter 13 described four degraded states and the quarterly drill; Chapter 15 sets the stop-path rules. The drill tests people as well as systems: a SOC can restore its agents in five minutes and still have no one on the night shift who can run the manual path. It runs in three variants, one for each way the AI can be missing: unavailable (the team works the queue by hand; Hansa's target is a worked queue within 15 minutes of the switch to the manual-queue runbook, and the classes that no analyst on shift could handle unassisted go into the craft register), untrusted (the AI runs but its output is suspect, so the team quarantines its closures for the window and reopens a sample from the raw data) and slow (summaries arrive late, and the measure is whether anyone still opens the raw evidence first). Apprentices take part from the start, as time-keeper and scribe at S1, as an unassisted analyst on a shadow queue at S2 and as a worker on the live manual queue at S3. The drill is announced to employee representatives as an exercise that records team-level results only.

The debate

The question is whether the junior route is needed. One side holds that it is, and that without it the craft ends; the other holds that the old route was a poor school and that AI lets the team teach better.

The case for concern

Those who hold this position start from the mechanism and not from nostalgia. Expertise in investigation is built from a very large number of ordinary cases in which a person is right or wrong and learns which. Closure by class removes them, and a junior who meets only the hardest cases has no ordinary days against which to recognise that something is wrong. The human-factors literature on automation names the same pattern in other work: the person is left with the exceptions and loses the practice that prepared them for the exceptions (75, Bainbridge, 1983), and people who rely on automation check less (76, Parasuraman & Manzey, 2010). AI Threat, Chapter 14, applied the point to generative AI (65, Nordqvist, 2026).

Four consequences follow. The first is delay: a missing rung produces no visible harm for years. The second is dependency: an organisation whose experts cannot work without the AI cannot supervise it or take over when it fails. The third is the learner's bias: a junior who learns from AI-triaged cases learns to approve, because approval is what the queue rewards. The fourth is the hiring incentive, the point the sceptic must answer: a manager choosing between a senior hire and a junior who now spends the first year on exceptions will fund the senior, and each organisation's rational choice empties the pipeline for all. The bibliography holds no measurement of entry-level hiring, so the fourth point is an argument and not a finding.

The case for calm

Those who hold the opposite position begin with the old route and not with the new tool. The tier 1 that the concern defends was, on the evidence of the practitioner studies, tedious and associated with desensitisation and burnout (69, Alahmadi et al., 2022), and the burnout study found turnover and poor judgement as its products, with progression through the old route treating only symptoms (70, Sundaramurthy et al., 2015). The argument is that nothing sacred attaches to that route; the capability matters, and the capability can be taught better.

On the sceptic's account it can be, for four reasons. An assistant can explain a log field at the moment the learner needs it, which a busy senior cannot, and the attempt-first rule keeps the effort that builds recall. Juniors can do investigation, detection-testing and hunting work early, because the queue no longer consumes them (Chapters 6 and 9). Replays and seeded incidents give more varied practice than a tier 1 queue did, without the consequences. And the constraint in the market is skills and money and not work: ISC2's respondents report skills needs, and 29 per cent could not afford the skills they needed (73, ISC2, 2025). Training a junior is the cheaper way to buy a skill that cannot be hired. As to the hiring incentive, the sceptic points to the supervision rule: a class stays at Level 3 only while enough people can work it by hand, so an organisation that stops making analysts finds its own delegation withdrawn, and the cost of not training appears in its own register and board pack. The risk, on this view, is not that juniors will not learn but that organisations will cling to a ladder designed for a different queue. The sceptic concedes that no source in the bibliography measures how fast an apprentice taught with an assistant reaches independent competence, and that is the reason to build the measurement into the route.

Where the positions meet

Both positions accept that learning needs practice with consequences, that unassisted work has to be designed in because left alone it disappears, that the old tier 1 should not be restored unchanged, that skill is measured by demonstration with a development record held by the person, and that the experts' skill is a safety property: supervision needs it.

What they do not share is a prediction. The concern expects teams to stop practising when the queue is long; the calm expects an assistant-supported route to produce independent analysts at least as fast as the old one. The sources report what practitioners experienced in the old setting and what people do beside automation elsewhere. None measures an assistant-supported SOC apprenticeship. The stage gate above measures its own results, and a team that runs the route will know sooner than the literature does.

What can be done

• Analysts and apprentices: write the hypothesis before asking the assistant, and tell the lead when a task you could once do alone slips.
• Mentors: shadow in alternating roles, state hypotheses aloud and grade unassisted cases within five working days.
• SOC leads: keep the craft register, apply the supervision rule and report the measured share, not the policy share.
• CISOs: fund the entry post and the mentor's hours as a cost of the delegation the team has chosen, give the mentoring to someone with the time, and ask the managed provider what its junior route is.
• Boards: ask how many people can work each Level 3 class manually, and when that was last demonstrated.
• Employee representatives: agree that development records belong to the person and are never reported by name or used for pay or ranking.

Verdict

For B3 Investigate, that unexercised skills decay when automation does the routine work is observable outside the SOC. That SOC analysts lose investigative skill as AI takes over triage and summarising is expected, on the stated trend of closure by class, and the expectation lapses for a team that measures its unassisted share and holds it. That organisations stop hiring juniors, so that the supply of future experts fails, is speculation and a risk that no team can recover from in one budget cycle. For B2 Detect, that detection engineering becomes a first rung, where juniors write the tests for detections and review AI drafts against scenarios, is expected where detections are code and drafts are reviewed (Chapters 6 and 14); the apprenticeship record is the means to test it. For B5 Learn, that reviews, purple exercises and case replays teach more than a queue is the book's design argument and is speculation: nothing cited measures it, and the stage gate is where a team can find out.

People and organisations can influence nearly all of it: the entry post, the measured share, the rotation, the minimum in the register and whether the team has ever worked its queue with its agents off. They cannot influence how capable the models become.

A twelve-month plan

Practical guide: Setting up a craft programme

Purpose. Establish, within twelve months, an entry post, a share of unassisted work that is measured and a craft register that governs delegation, so that the team can make new analysts and keep the skill of the present ones.

Roles. The SOC lead owns the programme. The mentor, normally a senior analyst or shift lead with the time, owns each apprentice's route. The detection engineering lead hosts the rotation. The CISO funds the post and approves the share. The data protection officer reviews the records, and employee representatives agree the records, the rotation and the drill.

Steps.

1. Build the craft register. List the tasks the agents perform or support, count the people in the rota pool who can work each unaided, and set the minimum for the current degree of delegation. Return any class below the minimum to Level 2 Supervised, with proposals capped, until it recovers.
2. Do the pipeline sum. Count the posts, assume an attrition rate and compare the entrants needed a year with the route's intake.
3. Set the unassisted share by activity, using the units of the table above, with randomised selection. Report the measured share monthly at team level.
4. Grade a sample: one in four unassisted cases within five working days, kept in the development record and out of any report by name.
5. Create the entry post and name the mentor. Protect the mentor's time, by default four hours a week per apprentice, and show it in the mentor's role charter (ROLE-*, Chapter 17).
6. Write the route as an apprenticeship record with stages, may and may_not lists, a stage gate and reviews, and agree its uses with employee representatives before the first day.
7. Schedule rotation: a day a week (Hansa) or a day a fortnight (Nordvik) for apprentices in detection engineering or rule ownership, and a fortnight a year in the opposite direction for each detection engineer.
8. Run case replays, one a fortnight for apprentices and one a month for everyone else, from closed cases scrubbed of direct identifiers.
9. Drill the degraded mode in all three variants, quarterly at Hansa's size and twice a year at Nordvik's, and update the register from the results.
10. Review at six and twelve months the measured share against policy, the seeded-incident catch rate of the team, the classes at or above the minimum and the apprentices' progress, and record in an AI Decision Record whether to widen the route, narrow a delegation or change the share.

Definition of done. The register is in version control and read by the delegation process; the measured share is reported monthly; at least one apprentice is in post with a record the representatives have agreed; one drill in each variant has been run and its results are in the register; and the twelve-month review is dated and owned.

Defaults to adapt. All numbers here are starting points. A team of six lengthens the cycle and borrows rotation from the provider or a neighbouring authority; a team of 38 on two sites sets them per site; a works agreement overrides them.

Across the degrees of delegation

Function and action class	Degree of delegation	What stays with people	Craft condition
B3 Investigate: closure of a low-risk class	Level 3 Bounded with sampling	Sampling from raw data; the class owner	At least two people in the rota pool able to work the class manually
B3 Investigate: case summaries and timelines	Level 1 Assisted to Level 2 Supervised	Reading the evidence; the conclusion	Unassisted share of cases, graded
B2 Detect: drafting detections	Level 1 Assisted	Writing the test; merging the rule	Apprentices write tests unassisted; one engineer per team can draft unaided
B4 Respond: isolation of a defined asset class	Level 3 Bounded, reversible, outside the hard exclusions	The decision to widen the class; the stop	Two people in the pool able to run the playbook by hand, shown in the drill
B5 Learn: reviews and replays	Level 0 Advisory to Level 1 Assisted	The reading of the contested decision	Apprentices as scribes; replays with the answer withheld

Level 4 Autonomous does not appear. No action in the table decides about a named person's access to work, and none is an irreversible B4 Respond action.

Nordvik Region and Hansa Mutual

Nordvik Region. The security unit has six analysts and a public pay scale. AIDR-0719 (illustrative, 2027-06-14) converted one analyst post into detection engineering (ROLE-NR-SEC-DET, effective 2027-07-01, held by Karin Lund), and AIDR-0726 (illustrative, 2027-06-21) created one trainee analyst post, taking the unit from 14 posts to 15. The mentor is the second senior analyst, not Karin Lund, whose duties Chapter 21 lists and whose time budget in AIDR-0724 contains no mentoring. AIDR-0726 protects four hours a week of the mentor's time and names the CISO as the person who adjusts the mentor's load. It records that the unassisted case share for the analysts stays at one in ten (AUS-NR-SOC-01, AIDR-0706) because there is no slack for more, a price accepted knowingly. The trainee works every core case unassisted for six months, under the attempt-first rule, and joins Karin Lund's protected engineering morning once a fortnight for the rules the Region has taken over from the provider, starting from DET-NR-0001; that morning is counted inside her time budget and does not add to it. The first replay is CASE-NR-0231, which the provider's AI closed and sampling reopened, with the technique (T1566.002) left for the trainee to name. The weakness is single dependency: one mentor, one detection engineer, one junior; the plan asks for a placement with a neighbouring region's security unit, to be agreed.

Hansa Mutual. The group SOC has about 38 people, 22 analysts and 6 senior analysts and investigation leads among them, and a works council. AIDR-0781 (illustrative, 2027-10-11) starts the apprenticeship route with a first cohort of two, one at the Polish service centre (APP-HM-2027-01) and one in Hamburg (APP-HM-2027-02), against the need of about five entrants a year in the sum above. The rotation host is the detection-engineering team of four under Lena Vogel, and mentors are shift leads, among them Piotr Nowak at the Polish service centre. The Konzernbetriebsrat, chaired by Thomas Brandt, and the Polish employee representatives agree the development record as an addition to the SOC annex of KBV-IT-2024, with the forbidden uses written into it. Degraded-mode drills run each quarter, the three variants in turn, and the first plan measure is to close the gap between the 0.20 in AIUP-HM-SOC-01 and the 0.10 the Q3 oversight record reports.

Nordvik has one rung and one mentor and must borrow practice from outside; Hansa has a pyramid to reshape across two sites and seven regimes. Both accept the same rule: no class stays at Level 3 Bounded when the people who could work it by hand have gone.

Summary

The apprenticeship problem has two halves: where the next analysts come from if closure by class removes the tier 1 queue through which many learned, and how the present experts keep a skill their own automation no longer exercises. The chapter concerned B3 Investigate, where the entry rung was, B2 Detect, which offers a new first rung in writing and reviewing the tests of detections, and B5 Learn, whose reviews, replays and exercises are a school for the team; the degraded-mode drills reached B4 Respond.

That unexercised skills decay beside reliable automation is documented outside the SOC and is observable. That the same happens to SOC analysts is expected, and no source this book relies on measures it. That organisations stop hiring juniors altogether is speculation and a risk, and the pipeline sum shows what an empty pipeline costs under a stated assumption. The debate found the positions closer than they sounded: both accept that learning needs practice with consequences, that unassisted work must be designed in and measured, and that the old tier 1 should not be restored unchanged. They differ on a prediction the sources cannot settle, so the route measures its own results by demonstration and keeps the figures with the apprentice and the mentor.

The design has five parts: a measured, randomised share of unassisted work; a craft register with a supervision rule; an apprenticeship route with attempt-first use of the assistant, rotation, replays and shadowing; a development record the apprentice owns; and degraded-mode drills. Skill is a design variable of the delegation: a team that measures what its people can still do will know when to withdraw an autonomy level, and a team that does not will find out during an incident. Chapter 24 asks what the blue team becomes over the next decade and sets out, as the author's judgement, what the evidence of the book supports.

Sources

1. European Parliament and Council of the European Union. Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act). Official Journal of the European Union, 12 July 2024. (1, European Union, 2024)
2. European Parliament and Council of the European Union. Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation). Official Journal of the European Union, 4 May 2016. (8, European Union, 2016)
3. Nordqvist, G. (2026). AI Governance: Governing Artificial Intelligence in European Enterprises and Public Authorities. The Architecture as Code Series, Book 2. (62, Nordqvist, 2026)
4. Nordqvist, G. (2026). AI Platform and Security: Building and Securing AI Platforms in European Enterprises and Public Authorities. The Architecture as Code Series, Book 3. (63, Nordqvist, 2026)
5. Nordqvist, G. (2026). AI Red Team: AI as an Active Part of Cyber Defence in European Enterprises and Public Authorities. The Architecture as Code Series, Book 4. (64, Nordqvist, 2026)
6. Nordqvist, G. (2026). AI Threat: Are the Dystopias Coming True? Evidence, Risk and Response for European Enterprises and Public Authorities. The Architecture as Code Series, Book 5. (65, Nordqvist, 2026)
7. Nordqvist, G. (2026). The Transformed Security Architect: Role, Craft and Career in the Age of AI in European Enterprises and Public Authorities. The Architecture as Code Series, Book 6. (66, Nordqvist, 2026)
8. Nordqvist, G. (2026). AI Boss: When Artificial Intelligence Manages People in European Enterprises and Public Authorities. The Architecture as Code Series, Book 7. (67, Nordqvist, 2026)
9. Alahmadi, B. A., Axon, L. & Martinovic, I. (2022). 99% False Positives: A Qualitative Study of SOC Analysts' Perspectives on Security Alarms. 31st USENIX Security Symposium. (69, Alahmadi et al., 2022)
10. Sundaramurthy, S. C. et al. (2015). A Human Capital Model for Mitigating Security Analyst Burnout. Eleventh Symposium On Usable Privacy and Security (SOUPS 2015). (70, Sundaramurthy et al., 2015)
11. ISC2 (2025). 2025 Cybersecurity Workforce Study. (73, ISC2, 2025)
12. Bainbridge, L. (1983). Ironies of Automation. Automatica 19(6). (75, Bainbridge, 1983)
13. Parasuraman, R. & Manzey, D. H. (2010). Complacency and Bias in Human Use of Automation: An Attentional Integration. Human Factors 52(3). (76, Parasuraman & Manzey, 2010)