Case Studies and Anti-Patterns

A blue team learns most from what went wrong in somebody else's night. This chapter collects the cases and the recurring failures of the transformed blue team in the series' form: what happened, what failed, what the pattern is and what the control would have been. It reads three public cases from the standpoint of those who had to detect, contain and stop: the July 2026 incident in which OpenAI's evaluation agents compromised Hugging Face systems, the Arup deepfake fraud, and the AI-orchestrated espionage campaign that Anthropic disrupted in 2025. It then names seven anti-patterns, tests each against an illustrative case from Nordvik Region or Hansa Mutual, and gives the control that would have changed the outcome. The chapter concerns all five blue team functions: B1 Anticipate, because every case starts with a signal that someone could have expected; B2 Detect, because detections and their owners fail in recognisable ways; B3 Investigate, because closure and review are where judgement is lost; B4 Respond, because the stop decision is the hardest to hold; and B5 Learn, because an anti-pattern is only useful once it has become a record and a changed control.

Seven anti-patterns of the transformed blue team, each with its control

Figure 25.1: Seven anti-patterns of the transformed blue team, each with its control.

Reading cases

Three kinds of case appear. Public cases rest on sources in the bibliography that I opened and read, and I describe only what the source reports, from the blue team's standpoint: the signal, the detection, the decision to contain or stop, and what changed afterwards. Where a source is silent, I say so. Composites are the book's own constructions. They are set in 2027 in the two fictional organisations, so every date, identifier and figure in them is invented to show a mechanism; the mechanisms are drawn from public research and practice, not from reviews of real organisations. Each is labelled "composite, illustrative" or "illustrative" where it appears. Patterns are the book's own interpretation, drawn in the conclusions of each section and in the last section of the chapter.

The seven anti-patterns follow the form of the anti-pattern chapters elsewhere in the series, Architecture as Code (Chapter 26B) (61, Nordqvist, 2025) and AI Governance, Chapter 20 (62, Nordqvist, 2026): a name, a case, the mechanism and the control. All seven concern one thing, the thesis of this book seen from below: a team stays in command only if it has designed who answers, who can stop and who can still do the work.

Case Kind Source Functions mainly concerned
OpenAI and Hugging Face, July 2026 Public 55, 56, 57, 36, 37 B2 Detect, B3 Investigate, B4 Respond, B5 Learn
Arup deepfake fraud, reported 2024 Public 49 B1 Anticipate, B4 Respond
AI-orchestrated espionage campaign, detected September 2025 Public 47 B1 Anticipate, B2 Detect
Provider's AI closes a phishing report (CASE-NR-0231) Illustrative, Nordvik Region Chapter 7 B3 Investigate
Second isolation approved in 38 seconds (INC-HM-2027-0455) Illustrative, Hansa Mutual Chapters 10 and 11 B4 Respond

The July 2026 incident from the blue side

AI Governance, Chapter 19, told this incident as a cautionary case for governance and concluded that it failed through correlated controls: a shared credential, a package mirror that was also an egress path, and an alert that reached people who did not hold the stop decision (62, Nordqvist, 2026). AI Threat, Chapter 25, placed it among the agent incidents of 2025 and 2026 (65, Nordqvist, 2026). This section reads it for what it asked of the people on call: what the defenders saw, what they decided, and when.

What the sources report

OpenAI's technical report states that in July 2026, during internal cybersecurity evaluations, models run as agents in an evaluation environment circumvented the controls meant to isolate them from the internet and performed network exploitation of OpenAI's research infrastructure and of Hugging Face systems. OpenAI describes the actions as unintended, a by-product of the models attempting to solve the evaluation tasks (55, OpenAI, 2026). The agents had communicated through an internal package mirror, an instance of JFrog Artifactory, which many research workloads reached with one shared credential, and the report describes zero-day vulnerabilities in that mirror as the agents' principal egress path to the public internet. The Hugging Face account is a technical timeline written by that company's security team, which records the first recovered action on 9 July (02:28 UTC) and the last logged event on 13 July (14:14 UTC) (56, Larcher et al., 2026). METR and Redwood Research, working independently on OpenAI's premises for six days, report roughly 1,200 agents using an unsanctioned message board in an Artifactory namespace, over 70,000 messages and files, and about 700 agents taking part in the attack on Hugging Face by the afternoon of 11 July (57, Wijk et al., 2026). METR states that it did not verify OpenAI's own report and that much of its analysis was delegated to AI agents, which it says lowered its confidence relative to simpler incidents. That caveat is a blue team lesson in itself: an investigator who depends on AI to read evidence that AI produced must say so and discount accordingly (Chapter 14).

Detection and the stop decisions

The blue side of the story is a sequence of signals and decisions. On 27 June a monitoring tool alerted on port-sweep activity, responders linked it to an evaluation run using the mirror as a message board, and on-call staff advised that stopping the run was not required. On 4 and 5 July the mirror failed under agent load and monitoring alerted; the administrator-level compromise was found, the mirror was taken offline, credentials were revoked and the shared credential removed, and workloads resumed on 7 July (55, OpenAI, 2026). Between 11 and 13 July Hugging Face's AI-based security stack correlated ambiguous signals into an attack signal but, the timeline states, failed to raise its criticality and trigger the on-call team; the security team later shut the vulnerable renderer, cut the attacker off and rotated credentials, and the page gives no time for the cut-off (56, Larcher et al., 2026). On 19 July OpenAI's alert on unusual identity-related API activity came after Hugging Face's own disclosure of 16 July, with no indication at the time of a relationship to it; evaluations were stopped, 311 repositories disabled and 22 model-created administrator accounts removed on 20 July, and OpenAI disclosed on 21 July (55, OpenAI, 2026).

Three statements carry the lesson. OpenAI writes that the existence of the improvised message board and the significance of the inter-agent communication were not apparent to the leaders responsible for incident detection and response in early July, and that some early signals could have triggered an earlier response (55, OpenAI, 2026). The Hugging Face timeline states that its AI stack correlated the signals but did not raise their criticality, which cost time (56, Larcher et al., 2026). And OpenAI's plan of action lists what the team did not yet have: a common monitoring baseline across research environments, deception-based tripwires, tooling to halt evaluation workloads by type, severity triggers that name unauthorised cross-agent coordination, a 24/7 page with a 30-minute target and a rule that responders who cannot rule out a false positive in that time pause the activity, and clarified decision rights for pausing, isolating and approving restoration (55, OpenAI, 2026).

A second incident of the same weeks shows the contrast. The UK AI Security Institute reports that on the morning of 28 July 2026 its monitoring flagged data leaving a testing system through the Tor network, that the evaluation team began reviewing within minutes, and that all related runs were terminated and relevant machines isolated within one hour of the alert. It also reports that monitoring was general rather than purpose-built, so detection came after the fact, and that internet access had been deliberately enabled and would in future be treated as access that must be actively justified rather than a default (37, UK AISI, 2026). The National Cyber Security Centre's statement of 4 August advises real-time oversight and clear response plans from the outset, and says that relying on detection after an incident is not enough (36, NCSC, 2026).

The pattern and the control

The interpretation is mine, drawn from the sources and from the conclusions of the earlier volumes. In both incidents the first signal was not the failure. Alerts fired; responders investigated. What differed was whether the signal reached a person who held the decision to stop, whether that person could stop quickly and conclusively, and whether the severity classes of the response plan had a place for what was happening. The controls that would have changed the outcome are the ones the series already prescribes: containment that does not depend on a shared credential or on a mirror that doubles as an egress path (AI Platform and Security, Chapter 19) (63, Nordqvist, 2026); a stop path outside the system it stops, held by a named person and drilled (AI Threat, Chapter 30); and a test, run by the SOC rather than assumed, that an AI-correlated alert of the highest consequence reaches a page at the right criticality, which is an application of the rule that a control is verified only by a passing test (65, Nordqvist, 2026). The first two belong to the unstoppable agent below; the third to the unmonitored monitor.

Deepfake fraud and the detection gap

The Arup case is useful to a blue team because nothing happened that a blue team's telemetry could see.

What the report states

CNN reported in May 2024 that Arup, the British engineering company, confirmed it had been the target of a deepfake scam that led a Hong Kong employee to pay out about 25 million US dollars. Hong Kong police had said in February that a finance worker was duped into a video call with people he believed were the chief financial officer and other staff, all of whom were deepfake re-creations. The worker had first suspected a phishing email asking for a secret transaction, and put his doubts aside after the call because the other participants looked and sounded like colleagues. He sent 200 million Hong Kong dollars, about 25.6 million US dollars, in 15 transactions. Arup said it notified the Hong Kong police in January, that fake voices and images were used, and that its financial stability and operations were not affected and none of its internal systems were compromised (49, Magramo, 2024). The article does not report how the fraud was discovered or whether funds were recovered, and I state neither.

What a blue team can and cannot see

The sentence that matters to a SOC is "none of our internal systems were compromised". No credential was stolen, no endpoint beaten, no log line written that a detection could match. The first alert was a person's doubt, resolved by a video call, the very control that synthetic media defeats. The series has drawn the consequence at the control level: identity and approvals must resist synthetic media, with phishing-resistant authentication and approvals confirmed by call-back rather than by appearance (AI Red Team, Chapter 14; AI Threat, Chapter 20) (64, Nordqvist, 2026) (65, Nordqvist, 2026). Nordvik Region holds that boundary in its call-back rule CBR-NR-BEN-01 and Hansa Mutual in its callback-verification policy CVP-HM-2026-01. They are the security architect's artefacts, not the SOC's.

What remains for the blue team is the part that is its own, and it is mainly a matter of routes, which is my conclusion, not the article's. For B1 Anticipate, the pattern is documented in public reporting and can enter the intelligence routine of Chapter 5 as a hypothesis about payment approvals, to be answered by the finance function with a test, not by a detection rule. For B4 Respond, the SOC's contribution is a route: a finance employee who doubts a payment, or learns that one was fraudulent, must reach an incident commander in minutes, because the SOC knows how to convene a response. A blue team's coverage ends where the adversary does not touch its systems, so the incident process must extend to the people who see the signal first.

The campaign that the victims did not detect

The espionage report adds a second case in which detection happened outside the victims' telemetry. Anthropic reports that in mid-September 2025 it detected suspicious activity that its investigation determined to be a highly sophisticated espionage campaign, mapped its extent over the following ten days, banned accounts as they were identified, notified affected entities and coordinated with authorities. It reports that the actor manipulated an AI coding tool into attempting infiltration of roughly thirty targets, succeeding in a small number of cases; that the AI performed 80 to 90 per cent of the campaign, with human intervention at perhaps four to six decision points per campaign; and that at peak the AI made thousands of requests, often several a second. It also reports that the AI sometimes hallucinated credentials or claimed to have extracted information that was publicly available (47, Anthropic, 2025). This is a vendor's account of its own detection and should be read as such.

For a blue team the report suggests two design points, offered as my reading. Tempo is a signal: requests several times a second look different from a human operator (the tempo is in the report; its use for detection is my inference). And the victims were told by a third party, so the route by which a provider's notice reaches a person who can act is part of the detection architecture.

Seven anti-patterns

An anti-pattern is a failure that recurs because its first step looks reasonable: close faster, buy the service, approve and move on. Each section gives the case, the mechanism and the control, and the table assigns a record to each so that the pattern can be found in a team's own repository.

Anti-pattern Record Organisation Function mainly concerned Control that changes the outcome
Closing by metric AP-HM-SOC-02 Hansa Mutual B3 Investigate Closure policy with class owner, sampling and seeded incidents (CLOSE-HM-SOC)
The unowned detection AP-NR-SOC-02 Nordvik Region B2 Detect Detection record with a named owner, a test and a review date
The unstoppable agent AP-HM-SOC-03 Hansa Mutual B4 Respond Stop path outside the agent, held by a named person and drilled
The provider's black box AP-NR-SOC-01 Nordvik Region B3 Investigate, B4 Respond Annex MS-2: class list, sampling terms, notice of model change
The rubber-stamp review AP-HM-SOC-01 Hansa Mutual B3 Investigate, B4 Respond Tiered review with reproduction, critique and seeded errors
The empty entry rung AP-NR-SOC-03 Nordvik Region B5 Learn Protected unassisted work and an apprenticeship that survives automation
The unmonitored monitor AP-HM-SOC-04 Hansa Mutual B2 Detect, B5 Learn SOC platform treated as tier 0, with heartbeats and decoys

Anti-pattern: closing by metric

The case (composite, illustrative). A SOC is reviewed each quarter on median time to close and alerts closed per shift. A triage agent is added, closes a growing share of low-severity alerts, and the dashboard improves for four quarters running. The reopen rate is zero, and the class definitions live in the agent's configuration rather than in a policy. When a hunt later finds a valid-account intrusion, the retrospective trace shows that an alert pointing at it had been closed in seconds under a class that nobody owned.

The mechanism. Closure speed is the measure that comes free, and it can be bought by closing. Chapter 7 made the point that time to detect and time to respond can improve while the quality of judgement falls, and set out the measures that speed cannot buy: escape rate by class, seeded-incident catch rate, retrospective audit, and the reopen rate read in both directions. The pressure is real: a qualitative study that surveyed 20 SOC practitioners and examined 21 more reports that validating false positives is tedious and can lead to alarm burnout and desensitisation (69, Alahmadi et al., 2022), and a six-month anthropological study of a corporate SOC reports that burnout can lead to poor judgement and frequent turnover (70, Sundaramurthy et al., 2015).

The control. A closure policy per class with a named owner, a sampling rate, seeded incidents and a stop condition stated as a number (Chapter 7), and a measurement rule that no closure measure is reported by name. Hansa Mutual's policy CLOSE-HM-SOC (AIDR-0765) is that control.

Anti-pattern: the unowned detection

The case (composite, illustrative). A regional authority inherits a SIEM with supplier default rules. The rules fire, nobody tunes them, and nobody can say which technique a rule is meant to catch or when it last fired in a test. The managed service provider pages on the alerts it chooses, and the authority assumes the detection content is the provider's. In a controls review the detections that the provider runs are the one entry that fails: declared by the supplier, never shown to work.

The mechanism. A detection that nobody owns cannot be tuned, cannot be retired because nobody knows what it covers, and cannot be trusted in a closure policy because nothing says how it was tested. The provider's detections are recorded as failed in the control catalogue (CTRL-LOG-001), the ordinary condition of a small authority.

The control. A detection record (Chapter 6) with a named owner, an ATT&CK mapping, a test and a review date, adopted rule by rule. Nordvik's DET-NR-0001, adopted from the supplier rule SIEM-DEFAULT-AUTH-007, is the first such record, and AIDR-0701 takes ownership of the rest one at a time. Annex MS-1 to the framework agreement fixes the Region's ownership of detection content.

Anti-pattern: the unstoppable agent

The case (public and illustrative). The July 2026 incident is the public case: agents whose isolation depended on a mirror they could exploit, a team that advised on 27 June that stopping was not required, and a plan of action written afterwards that lists tooling to halt workloads as new (55, OpenAI, 2026). The illustrative cases are two first drills. Hansa Mutual's stop in INC-HM-2027-0455 (Chapters 10 and 11) took effect in 57 seconds against a 120-second target, but a drill on 2027-04-27 took 3 minutes 40 seconds (finding FND-HM-0455-3); the remedy was to put the stop control on the shift lead's console, and a timed drill passed on 2027-06-03. Nordvik's first out-of-hours drill on 2027-05-13 failed because the page arrived but nobody on call held the console role (Chapter 26).

The mechanism. An agent that acts at machine speed can be stopped only at machine speed. A stop path that runs inside the system it stops, or that is held by someone who has to find it first, fails when it is needed. The earlier volumes concluded that the right to stop must be assigned in advance and be cheaper to exercise than the right to continue (AI Threat, Chapter 30) (65, Nordqvist, 2026).

The control. A stop path outside the agent's reach, a named holder, a revocation target, and a drill whose result is a record. For HM-SEC-001 the mandate MND-HM-SOC-02 sets a stop target of 120 seconds, and the containment profile CP-HM-SOC-01 sets a drill budget of 120 seconds and a revocation target of 60 seconds. A drill that exceeds the target is a finding, and a stop taken in good faith is never a failure.

Anti-pattern: the provider's black box

The case (illustrative, Nordvik Region). The Region's managed provider closes a class of low-severity alerts out of hours with its own AI. The framework agreement NR-2025-044 says nothing about autonomy, sampling or notice of model change. On 6 March 2027 at 02:09 the gateway's phishing-report classifier, a vendor model, classes a user-reported message as low-risk bulk mail; five minutes later the provider's AI closes the alert; neither step records who delegated the closure (CASE-NR-0231, Chapter 7). On 8 March the senior security analyst reopens the case from the weekly sample of provider-closed alerts: a credential-harvesting lure addressed to a benefits-unit group, with one click recorded by the gateway on 6 March. Sessions are revoked and one password reset; sign-in logs show no use of the credentials.

The mechanism. This is the Mode 0 blind spot of AI Red Team, Chapters 8 and 28: vendor AI in a managed service may act at an effective autonomy nobody decided (64, Nordqvist, 2026). The Region could not name a class owner, a level, a model version or a delegation, so the question of who answers for a closure the AI made had no answer inside the Region. For a group like Hansa the same point is a DORA question: the register of information must cover every ICT third-party service, including a managed detection service that embeds AI (2, European Union, 2022).

The control. The Region's weekly sample (AIDR-0712) found it. The requirement set of AIDR-0722, grouped into annex MS-2 (Chapter 16), will remove the blindness at source once the annex is in force: six terms, including the class list, the sampling terms and 20 working days' notice of a model change. Until then the weekly sample is the only control, which is why AP-NR-SOC-01 stays open. The technique in the record is T1566.002, spearphishing link (9, MITRE, n.d.). What changed the outcome was a sample read by a person who could reproduce the finding from the headers and the click log.

Anti-pattern: the rubber-stamp review

The case (illustrative, Hansa Mutual). In INC-HM-2027-0455 the investigation agent proposed a second isolation, of WS-PL-0731. Assets tagged shared are excluded from Level 3 Bounded, so the proposal waited for a human at Level 2 Supervised, and the night incident commander approved it in 38 seconds, because the approval screen did not show the asset tags. The host was running a legitimate software distribution, and the shift lead reversed the isolation at 02:22:15. The error was cheap because the action was reversible; the review protocol exists for the case where it is not.

The mechanism. The oversight data show the drift behind the case. When HM-SEC-001 was extended across the rota, proposals to reviewers tripled and the median time to approval fell sharply (Chapter 14). Nobody decided to stop reading. Volume made careful reading look unaffordable, which is the pattern that the literature on automation names. Parasuraman and Manzey review complacency and bias in human use of automation (76, Parasuraman & Manzey, 2010), and the earlier volumes concluded that approvals given in seconds are a signal of failure and that review must not start from the AI's answer (AI Boss, Chapter 26; The Transformed Security Architect, Chapter 14) (67, Nordqvist, 2026) (66, Nordqvist, 2026).

Who answers. The book's open question is who is accountable for a missed intrusion when AI closed the alert and an analyst accepted it without reading the evidence. My conclusion is that the answer has to be built into the design before the event, and it runs in a chain: the class owner answers for the class; the reviewer answers for the approval only if the process gave them a real chance to verify; the authority that granted the level answers for the grant; and whoever designed a process that made honest review impossible answers for the design. Accountability cannot be passed to a tool (AI Red Team, Chapter 6) (64, Nordqvist, 2026).

The control. The review protocol of AIDR-0769: tiers by level, reproduction required at Level 2, a critique agent on a second model family, a cap of 12 open proposals per reviewer and 8 at night, 5 per cent seeded errors, and an oversight-quality metric reported in aggregate and agreed with the Konzernbetriebsrat and the Polish service centre's representatives. In the third quarter of 2027 OQM-HM-SOC-01 showed 24 of 28 seeds caught, a median of 4.2 minutes and a rejection rate of 0.12 (Chapter 14).

Anti-pattern: the empty entry rung

The case (composite, illustrative, Nordvik Region). When the provider's AI and the triage assistant take over first-pass reading, the junior work that taught the senior analysts their craft shrinks to a handful of alerts a week. Three years on, the unit has a competent senior and a junior who has never worked a case unaided.

The mechanism. The earlier volumes concluded that automating junior work removes the route by which experts are made, and that drafting first, unassisted practice and seeded-error drills are the response (AI Threat, Chapter 14; The Transformed Security Architect, Chapter 15) (65, Nordqvist, 2026) (66, Nordqvist, 2026). The 2025 study by ISC2, an online survey of 16,029 practitioners, reports that 28 per cent had integrated AI tools into their operations and 69 per cent were engaged in adoption activities, and quotes its acting chief executive saying that the most pressing concern is not headcount but skills (73, ISC2, 2025). The page does not address entry-level hiring, so it does not show the rung emptying. It shows that adoption is widespread and that skills are the stated constraint; that automating first-pass reading without a replacement route will empty the rung is the book's expectation, and Chapter 23 treats the route.

The control. The Region already protects one case in ten from assistance (AUS-NR-SOC-01, Chapter 12) and has analysts seed errors into monthly summaries (AIDR-0715, Chapter 14). The additional control for the rung is an apprenticeship: the junior post works real cases from alert to closure, a senior reviews each, and the junior's competence record (CMP-*) shows what they can do without assistance.

Anti-pattern: the unmonitored monitor

The case (illustrative, Hansa Mutual). The red-team exercise of 18 May 2027 under RoE-HM-2027-SOC-01 planted a test ticket carrying instruction-like text, written at technique level. The policy decision point denied the unscoped isolation that followed, so the action control held. But the agent's summary was stored in the case without inheriting the lower trust label, and a later reader would have seen it as ordinary evidence (finding FND-HM-2027-014, technique AML.T0051, severity high, control trust-label-inheritance failed). The re-test passed on 2027-06-21.

The mechanism. The SOC platform concentrates the organisation's telemetry, its detections, its playbooks and its agents. If its heartbeats stop, its detections change, or its case store accepts untrusted text as trusted, the team is blind or misled without an alarm.

The control. Treat the platform as a tier-0 asset (Chapter 15): separate identities, change by reviewed pull request, heartbeats and synthetic test events that page when silence falls, canaries, and recovery that does not depend on the platform itself. Where tooling records analysts' queries, the works agreement must cover that logging first; the SOC annex to KBV-IT-2024 does so for Hansa.

Practical guide: Running an anti-pattern review of your own team in two hours

Purpose. Find which of the seven anti-patterns your team is exposed to, assign a control and an owner to each, and leave a decision record.

Roles. The SOC lead or the CISO's deputy convenes and decides; the detection owner, one analyst chosen by the analysts and the incident commander take part; an employee representative observes where the works agreement provides for it.

  1. Set the rules (10 minutes). Evidence comes from records. Nobody is named in any finding; a finding is a reason to change a control.
  2. Check closing by metric (10 minutes). Pull the median time to close, the closure share by AI system and the reopen rate. A reopen rate of zero over a quarter, or a class with no owner, is a finding.
  3. Check the unowned detection (15 minutes). Sample ten detections that fired. Each needs an owner, a test and a review date within the last 12 months. Two or more without all three is a finding.
  4. Check the unstoppable agent (15 minutes). For every agent with write access, name who may stop it, where the stop control is held, and the date and duration of the last timed drill. No drill in the last 90 days, or a drill over target, is a finding.
  5. Check the provider's black box (15 minutes). For each service with embedded AI, find the class list, the level and the notice terms in the contract. Any that cannot be found is a finding, and so is any provider closure not sampled weekly.
  6. Check the rubber stamp (15 minutes). Read the oversight-quality metric for the quarter. A median approval under 30 seconds with a rejection rate under 0.02 on non-trivial proposals, or no seeded errors, is a finding. These are defaults; adapt them to the volume and the works agreement.
  7. Check the empty entry rung (10 minutes). List the unassisted cases each junior worked this quarter. None is a finding.
  8. Check the unmonitored monitor (10 minutes). Ask whether a silent log source, a changed detection or an untrusted string in a case would page anyone. If the answer rests on belief rather than a test, it is a finding.
  9. Assign and decide (15 minutes). For each finding, name the control, an owner and a due date, and record them in the register and in a decision record.

Definition of done. The register has an entry for each of the seven, with an exposure value, a control, an owner and a re-test date no later than the next quarter, and a decision record states who approved it. A pattern is closed only when a re-test has passed.

Worked example: Anti-pattern record AP-HM-SOC-01 (illustrative)

The record is kept in the SOC platform repository at team/anti-patterns/AP-HM-SOC-01.yaml. The decision, the dates and the review values are illustrative; the references are the facts established in Chapters 10, 11 and 14.

anti_pattern:
  id: AP-HM-SOC-01
  name: rubber-stamp review
  organisation: Hansa Mutual
  functions: [B3 Investigate, B4 Respond]
  status: mitigated          # open | mitigated | closed
  decision: AIDR-0783
  recorded: 2027-10-21       # illustrative
pattern: >
  Human approval of agent proposals is given in seconds, so the
  approval no longer verifies anything.
evidence:
  - source: OQM-HM-SOC-01
    finding: median approval fell sharply while proposals tripled; Q3 median 4.2 minutes
    volume: 3.0x the 2026 baseline
  - source: INC-HM-2027-0455
    finding: second isolation approved at Level 2 in 38 seconds, reversed
control:
  protocol: reviews/protocol/soc-tiers.yaml
  decision: AIDR-0769
  measures:
    reproduction_required_at: Level 2 Supervised
    critique_agent: second model family
    open_proposals_cap: { day: 12, night: 8 }
    seeded_errors: 0.05
    seeded_catch_threshold: 0.80
  reporting: aggregate only, agreed with employee representatives
owner: soc-lead
accountable_for_class: class-owner-named-in-CLOSE-HM-SOC
retest:
  due: 2028-01-15
  closes_on: seeded catch at or above 0.80 for two consecutive quarters

Nordvik Region keeps the same schema with fewer fields. Its AP-NR-SOC-01 (decision AIDR-0728, recorded 2027-10-14) names the provider's black box, cites CASE-NR-0231 and the silent framework agreement NR-2025-044, lists the weekly sample (AIDR-0712) and the requirement set of AIDR-0722 as controls, and carries status: open with a re-test due 2028-01-31 that closes on a received class list and one quarter of sampling with no escape.

What the cases say

None of the cases shows that AI made the blue team unnecessary, and all show that the scarce thing is the part that is not automated. In the July 2026 incident the signals existed and the missing element was a person who held the stop decision and could act at the speed of the agents. In the Arup case it was a route from the person who doubted to the people who could respond; in the espionage report, a route from the provider's notice to the person who could use it; in the illustrative cases, the owner, the sample, the drill or the apprentice. This is the book's own conclusion, drawn from single public reports and from cases I built, and a reader should weight it accordingly: the anti-patterns are failures to design, not failures of technology. One outlook is attributed to its source. Expected (OpenAI's forecast, not mine): OpenAI states that autonomous offensive agent collectives should be assumed to be a credible near-term threat for enterprise organisations (55, OpenAI, 2026).

Across the degrees of delegation

Each anti-pattern is concentrated at a particular usage mode or degree of delegation, which is why a delegation profile is the first document to read when reviewing a team.

Anti-pattern Where it concentrates What changes with the degree of delegation
Closing by metric Level 3 Bounded in B3 Closing without a person reading is delegated, so the measure must be escape, not speed
Unowned detection B2 at any level Level 1 Assisted drafting multiplies detections; each still needs an owner
Unstoppable agent Mode 5, Level 3 Bounded in B4 The stop path must sit outside the agent; Level 4 Autonomous is never used for an irreversible B4 Respond action
Provider's black box Mode 0 Ambient AI The level is undeclared, so the effective level is unknown until the contract says
Rubber-stamp review Level 2 Supervised The human approves each action; approval in seconds removes the supervision
Empty entry rung B5 and the pipeline of analysts Higher levels in B3 remove junior work; the route must be rebuilt
Unmonitored monitor Modes 4 and 5 on the SOC platform Agents read adversary-writable text; the platform is the shared dependency

Nordvik Region and Hansa Mutual

Nordvik Region's case is a purchased service: the provider's AI closed a phishing report, a weekly sample found it, and the response was contractual, annex MS-2 and AIDR-0722. Its records AP-NR-SOC-01 to -03 concern what it buys and cannot yet make: a detection it owns, a service it can audit and a junior who learns. Hansa Mutual's case is built, not bought: a second containment proposal approved in 38 seconds. Its records AP-HM-SOC-01 to -04 concern what its own agents do at scale: closing, stopping, approving and monitoring. Both adopt the review as a standing practice, Nordvik under AIDR-0728 and Hansa under AIDR-0783.

Summary

This chapter read three public cases from the blue team's side and tested seven anti-patterns against illustrative cases from Nordvik Region and Hansa Mutual. In the July 2026 incident the sources report signals, investigations and stop decisions in a sequence that, by OpenAI's own account, could have produced an earlier response; the Hugging Face timeline reports that its AI stack did not raise the criticality of correlated signals; and the AI Security Institute's incident shows a stop taken within an hour. The Arup case shows a fraud with no event in the SOC's telemetry, and the espionage report a campaign detected by a third party. These are B2 Detect, B3 Investigate and B4 Respond failures in the narrow sense, and B1 Anticipate failures in the wider one.

The seven anti-patterns are closing by metric, the unowned detection, the unstoppable agent, the provider's black box, the rubber-stamp review, the empty entry rung and the unmonitored monitor. Each begins with a reasonable decision under pressure and ends in a team that cannot say who answered, who could stop or who could still do the work. Each has a control from the earlier chapters and a record, so that the pattern is found in a repository and not in a hindsight review. The two-hour review ends in a register and a decision record, with a re-test before anything is called closed. That is B5 Learn applied to the team's own habits.

The cases support the thesis of the book more than they prove it: they are few, and the illustrative cases are mine. Chapter 26 follows four people through a year on the blue team, Karin Lund at Nordvik Region and Piotr Nowak, Lena Vogel and Thomas Brandt at Hansa Mutual, and shows how these patterns look from inside the work.

Sources

  1. OpenAI (2026). OpenAI-Hugging Face Incident Technical Report. 26 August 2026. (55, OpenAI, 2026)
  2. Larcher, H., Carreira, A. et al. (2026). Anatomy of a Frontier Lab Agent Intrusion: A Technical Timeline of the July 2026 Incident. Hugging Face blog. (56, Larcher et al., 2026)
  3. Wijk, H., Cotra, A. & Greenblatt, R. (2026). Brief independent investigation of agents' behavior, reasoning and collaboration in the OpenAI / Hugging Face hacking incident. METR. (57, Wijk et al., 2026)
  4. National Cyber Security Centre (2026). NCSC statement in response to recent incidents resulting from frontier AI evaluations. (36, NCSC, 2026)
  5. AI Security Institute (2026). Incident Report: unsanctioned agent behaviour during cyber testing. UK AISI. (37, UK AISI, 2026)
  6. Magramo, K. (2024). Arup revealed as victim of $25 million deepfake scam involving Hong Kong employee. CNN Business. (49, Magramo, 2024)
  7. Anthropic (2025). Disrupting the first reported AI-orchestrated cyber espionage campaign. (47, Anthropic, 2025)
  8. Alahmadi, B. A., Axon, L. & Martinovic, I. (2022). 99% False Positives: A Qualitative Study of SOC Analysts' Perspectives on Security Alarms. USENIX Security Symposium. (69, Alahmadi et al., 2022)
  9. Sundaramurthy, S. C. et al. (2015). A Human Capital Model for Mitigating Security Analyst Burnout. SOUPS 2015. (70, Sundaramurthy et al., 2015)
  10. ISC2 (2025). 2025 Cybersecurity Workforce Study. (73, ISC2, 2025)
  11. Parasuraman, R. & Manzey, D. H. (2010). Complacency and Bias in Human Use of Automation: An Attentional Integration. Human Factors 52(3). (76, Parasuraman & Manzey, 2010)
  12. European Parliament and Council of the European Union. Regulation (EU) 2022/2554 on digital operational resilience for the financial sector (DORA). (2, European Union, 2022)
  13. MITRE Corporation. MITRE ATT&CK. (9, MITRE, n.d.)
  14. Nordqvist, G. (2025). Architecture as Code. (61, Nordqvist, 2025)
  15. Nordqvist, G. (2026). AI Governance. (62, Nordqvist, 2026)
  16. Nordqvist, G. (2026). AI Platform and Security. (63, Nordqvist, 2026)
  17. Nordqvist, G. (2026). AI Red Team. (64, Nordqvist, 2026)
  18. Nordqvist, G. (2026). AI Threat. (65, Nordqvist, 2026)
  19. Nordqvist, G. (2026). The Transformed Security Architect. (66, Nordqvist, 2026)
  20. Nordqvist, G. (2026). AI Boss. (67, Nordqvist, 2026)