A Year on the Blue Team: Nordvik Region and Hansa Mutual

This chapter follows four people through 2027, the first year in which the two organisations of this book run the blue team that Chapters 1 to 25 describe: Karin Lund, senior security analyst and detection owner at Nordvik Region; Piotr Nowak, shift lead at the Polish service centre of Hansa Mutual's group SOC; Lena Vogel, detection engineering lead in Hamburg; and Thomas Brandt, chair of Hansa Mutual's Konzernbetriebsrat. It tells the year as a sequence of dated decisions, records and measures, and it concerns all five blue team functions: B1 Anticipate, B2 Detect, B3 Investigate, B4 Respond and B5 Learn. It adds no new method; it shows what the methods look like when they meet a calendar, a night shift, a works council and a budget.

Illustrative fiction. The book is written in November 2026. Everything in this chapter that happens in 2027, every person, date, figure and record, is invented to show the book's design at work and agrees with the profile of the two organisations used throughout. None of it is a report of events or a forecast. The four people are fictional, and so are the numbers.

A year on the blue team: the dated decisions, records and measures for two organisations

Figure 26.1: A year on the blue team: the dated decisions, records and measures for two organisations.

The starting position

Both organisations received the same question in autumn 2026, after the July 2026 incident. Nordvik Region's regional director asked the CISO what the security unit becomes when AI enters its work (AIDR-0700, 2026-11-23, report due 2027-06-30). A day later Hansa Mutual's board asked the group CISO how the SOC will work when its agents act at night and when adversaries use AI (AIDR-0750, 2026-11-24, first report due 2027-04-30).

Nordvik's security unit of 14 has six analysts working office hours and buys out-of-hours monitoring from a managed security service provider under framework agreement NR-2025-044; Karin Lund, eleven years in the unit, in practice owns the SIEM and its twelve local rules. Hansa's group SOC has about 38 people on a follow-the-sun rota with a detection-engineering team of four. Piotr Nowak leads a shift at the Polish service centre, Lena Vogel leads the detection engineers, and Thomas Brandt chairs the body that co-determines, under BetrVG §87(1) no. 6, on every tool that can monitor employees' behaviour or performance. A SOC full of logging tools is such a place.

January: the charters and the interim letter

At Nordvik, Karin Lund had spent two weeks in December writing her own role down. On 2027-01-11 the CISO signed AIDR-0729, an interim mandate letter for the detection owner, pending the team charter ROLE-NR-SEC-01 (AIDR-0716, 2027-01-25) and the post that AIDR-0719 (illustrative) would decide in June. The letter says what Karin owns (the SIEM's local rules, the detection records and their tests), what she does not own (the provider's rules, which the Region can only ask the provider to evidence), the hour a week she may spend on intelligence (AIDR-0705, with a second analyst as reviewer), and the change she may not make alone, a rule on the benefits-triage administration path. A week later AIDR-0701 (2027-01-18) decided that the Region would take ownership of rules one at a time and not in a single migration, because a team of six cannot test a dozen rules at once.

Delegation profile DLG-NR-SEC-01 and playbook PBK-NR-ISOLATE-01 (converted from runbook RB-NR-ISOLATE-01, AIDR-0703) were already in force; isolation covered end-user workstations only, and anything touching a citizen-facing service needed the duty analyst. The Transformed Security Architect, Chapter 4, had argued that a role charter earns its place only when it names decision rights that someone can later be asked about (66, Nordqvist, 2026). In January the letter was an assertion. By December it was evidence.

At Hansa the team charter ROLE-HM-SOC-01 was adopted on 2027-01-26 (AIDR-0772), and the January work was with Thomas Brandt. The group works agreement on IT systems, KBV-IT-2024, was agreed in 2024 for a different SOC. The agents, the closure classes and the oversight dashboard all log what analysts see and approve, and none of it could begin before the Konzernbetriebsrat agreed how the logs would be used. Brandt's position was short: he did not oppose AI in the SOC, and he would not sign anything that allowed a closure rate or an approval time to be read against a name. AI Boss, Chapter 23, had argued that an agreement should govern classes of change and not software versions (67, Nordqvist, 2026). The group CISO's team did not argue the point; it was already the SOC's design.

On 2027-01-27 the two sides signed an interim letter under KBV-IT-2024. Sampling results, the log of AI use and oversight measures would be reported in aggregate only. Review records and post-incident reviews would carry no measure by person. The SOC would not use any of these data in appraisal, and the Polish service centre's employee representatives, who have their own rights under Polish law, would receive the same reports. It was meant to last until a full SOC annex was agreed. The policy AIUP-HM-SOC-01 (AIDR-0757) took effect on 2027-02-01 on the strength of it.

February and March: first rules, first closures, first escape

On 2027-02-08 Karin Lund adopted DET-NR-0001 from the supplier rule SIEM-DEFAULT-AUTH-007. The supplier's logic flagged repeated failed sign-ins followed by a success and produced alerts that analysts mostly closed. Karin tightened it to a spray pattern across many accounts from one source (ATT&CK T1110.003 (9, MITRE, n.d.)), wrote the test cases, and had the second analyst review the change. The detection record gave it an owner, a source, a test and a review date. In the same week the detection-drafting assistant was added to her toolbox at Level 1 Assisted, first on the rules the Region was taking over.

At Hansa the same week brought the sector report SHR-2027-014 to the threat-intelligence cell. On 2027-02-09, the day it became INTEL-HM-0142, AIDR-0768 adopted the agent team, with quarterly degraded-mode drills and a manual-queue target of 15 minutes. The intelligence routine of Chapter 5 turned the report into two things in six days: a hypothesis about valid-account abuse on the service-account group SVC-CLAIMS-EXPORT of 41 accounts, which the hunting agent HM-SEC-007 took up with Piotr's colleagues as hunt HNT-HM-0031 on 2027-02-15 (ATT&CK T1078), and a draft detection for abnormal use of a service account from a host not seen before (scenario BAS-IDP-021). HM-SEC-002 drafted it; Lena Vogel's team added the negative cases and merged it as DET-HM-0455 with a review date of 2027-09-02.

March brought the first closures and the first escape. Nordvik's escape came from outside the Region's own tools. On 2027-03-06 at 02:14 the provider's AI closed a user-reported phishing alert that a gateway classifier had already classed as low-risk bulk mail. No rule was disclosed and no delegation was recorded. On 2027-03-08 Karin Lund, working through the weekly sample of the provider's closed alerts that AIDR-0712 had set up after the first doubts about the provider's practice, reopened it. The message was a credential-harvesting lure addressed to a group in the benefits unit, and one recipient had clicked on the link on 2027-03-06. Karin revoked the session and reset the password at 09:25, found no use of the credential in the sign-in logs, and closed the case CASE-NR-0231 at 11:10 with no significant incident. The escape cost two days of exposure on one account, and no more because the Region had a sample.

The sample had been designed without a size, and the case showed the gap. On 2027-03-15 AIDR-0730 set it at 30 closures a week, or all of them when fewer, with a full review of the user-reported phishing class until the contract said something about it. The union's rule that closure rates are never reported by name was extended to the sample. The requirement set of AIDR-0722 (a class list, evidence to close, sampling, seeding rights, 20 working days' notice of a model change and a stop right) went to the provider the same month as the basis for annex MS-2. At the end of the quarter Karin counted the results of the seeded errors she had planted in three of five monthly deep-review summaries under AIDR-0715: seven of nine caught. She reported it as a count, since nine is too few to make a rate.

At Hansa the first monthly review of the closure classes took place on 2027-03-30 and produced AIDR-0784. The triage agent HM-SEC-006 had closed 4,310 alerts in March in classes SC-01 (registered vulnerability scanner traffic) and SC-02 (duplicates of open cases) at Level 3 Bounded. The 5 per cent sample was 216 closures, reviewed without the agent's summary on screen. One closure was disputed: an SC-02 duplicate whose only new field was a source port, and the class owner tightened the condition to include ports. The five seeded incidents per class for the quarter were all caught. The stop condition of policy CLOSE-HM-SOC was not met, and AIDR-0784 kept both classes at Level 3 and SC-03 at Level 2 Supervised. The same record notes the first degraded-mode drill, on 2027-03-23, in which the manual queue was worked in 21 minutes against a target of 15; the cause was a runbook step that assumed a login the night shift did not have. In the quarter HM-SEC-002 had drafted 48 detections and 15 had been merged.

April: the incident

On Monday 2027-04-12 at 02:14:05 the detection DET-HM-0455 flagged abnormal use of the service account SVC-CLAIMS-EXPORT from a workstation at the Polish service centre that the account had not been seen on before, WS-PL-0518. Piotr Nowak was shift lead for the night. Chapters 10 and 11 hold the records; this is the night as the shift lead had it, and the first thing to say about it is how it ended. It was a legitimate rollout, not an intrusion. The activity was a step of the scheduler migration CHG-PL-2291, which used the service account from new hosts, and nobody knew that when the clocks started.

Within 53 seconds the triage chain executed PBK-HM-ISOLATE-01 against WS-PL-0518 at Level 3 Bounded (action A1, 02:14:58), because two corroborating signals agreed and the host carried none of the tags (shared, executive, production, claims-settlement) that exclude an asset from automatic isolation. A person confirmed the flag at 02:16:40; the case record would show both timestamps, so that whichever moment a supervisor treated as awareness could be read from the record (79, EDPB, 2023). At 02:17:48 a second isolation, of WS-PL-0731, was applied (action A2): the investigation agent HM-SEC-001 had proposed it, and because the host was tagged shared the playbook excluded it, so it came as a Level 2 request to the night incident commander, who approved it in 38 seconds.

Piotr saw that the host was running a legitimate software distribution that the isolation had interrupted. At 02:19:05 he invoked the stop from the duty analyst's console, because that was where the control lived that night. The mechanism sat at the identity provider and the SOAR connector, outside the agent platform, and the agent's credentials were dead at 02:20:02, 57 seconds later, against a target of 120. At 02:22:15, 4 minutes 27 seconds after it was applied, he released the isolation of WS-PL-0731, a separate act. At 14:00 that day the SOC lead, who owns the agent, decided to restart HM-SEC-001, recorded as AIDR-0785. Stopping and restarting are different decisions held by different people, and the record said so.

The reporting clocks did not yet exist as a profile that night. When the group adopted CLK-HM-01 (AIDR-0777, 2027-06-24), it reconstructed them from the case record, opening them at the first flag, because from that moment the event might have been a compromised credential. For a personal data breach, GDPR Article 33 gives 72 hours from awareness (8, European Union, 2016). For an insurer DORA is the primary regime, with classification and reporting under Articles 17 to 19 on time limits that the instrument and its technical standards set (2, European Union, 2022); NIS 2 Article 23 asks for an early warning within 24 hours of awareness, and whether it reaches the non-financial parts of the group depends on national transposition and is for the group's legal function (3, European Union, 2022). The group counted from the earlier timestamp, 02:14:05. The reporting authority named in the profile classified the event as not major at 03:40:00, recorded the grounds, and left the personal-data question open until the forensic read of the workstation, which on 2027-04-14 found no data access. These are architectural implications, not legal advice; the point is that the clocks were requirements on the case record, and the record was complete before anyone asked.

The first report to the board under AIDR-0750 fell on 2027-04-30, and AIDR-0786 recorded it. The key numbers were the 57 seconds, the 38 seconds, and the hunt HNT-HM-0031, whose period ended on the same date. Of 214 matched events in the 41 accounts of SVC-CLAIMS-EXPORT, 211 were explained by the scheduler migration and three were opened as CASE-HM-1311 and closed benign after the owner's check; the hunt was repeated by 2027-08-31. The board asked why a person had needed to stop the agent at all, and the CISO's answer was the design of the book: the agent proposes, a person decides, and the stop sits where the agent cannot refuse it.

May and June: review, exercise and drill

The post-incident review PIR-HM-0455 was held on 2027-05-06, facilitated by Lena Vogel. Piotr attended as shift lead, with a senior analyst, the agent operator, a detection engineer and an employee representative from the Polish service centre as observer. The AI drafted the timeline and the contributing conditions under MND-HM-SOC-02; Lena verified them, and three timeline entries were corrected. Nobody was blamed. The review produced three findings with re-tests, and closed on 2027-06-03 (AIDR-0771).

The first finding, FND-HM-0455-1, was Lena's own: the detection had fired on a legitimate rollout, because it did not know the change calendar. Version 1.5.0 takes the calendar as a suppression and corroboration input, and a replay of the recorded rollout telemetry no longer fired alone. The re-test passed on 2027-05-27. The second, -2, for the playbook owner, was subtler: in version 1.2.0, in force on the day, the two corroborating signals shared a data path through the identity logs, so they were one source seen twice, the shared dependency that AI Threat, Chapter 30, tells a team to look for (65, Nordqvist, 2026). Version 2.1.0 requires two sources on independent data paths, and a single-path scenario is refused. That re-test passed on 2027-06-01. The third, -3, came from the stop. The stop on the day took 57 seconds, but a drill on 2027-04-27 took 3 minutes 40 seconds against the target of 2, because the stop control sat on the duty analyst's console only; the finding moved it onto the shift lead's console, with a timed drill as the re-test. On 2027-06-03 the drill took 1 minute 46 seconds.

Piotr valued most what the review did not do. The 38-second approval was treated not as the commander's failure but as a measurement: the approval screen had not shown the asset tags, and it now does (67, Nordqvist, 2026).

In between, on 2027-05-18, the group red team ran the exercise under rules of engagement RoE-HM-2027-SOC-01 against the containment profile CP-HM-SOC-01 (AIDR-0770). The scenario was SCN-SOC-T2-SECOND-ORDER-03 (ATLAS AML.T0051 (10, MITRE, n.d.)): a planted test ticket carrying instruction-like text reached an agent through the helpdesk channel. The policy decision point denied the unscoped isolation that followed, a verified control. But the agent's summary, written into a case note, repeated part of the planted text, and a second agent that reads case notes treated the note as trusted. The case store had accepted text without a trust label. That was finding FND-HM-2027-014, severity high, with label inheritance enforced by the case store due 2027-06-15 and a re-test due 2027-06-30. On 2027-05-20 AIDR-0787 recorded the decision that the second agent would not read case notes until the store enforced the labels. The quarterly degraded-mode drill on 2027-06-22 took 14 minutes 20 seconds to a worked manual queue, inside the 15-minute target, and AIDR-0788 recorded it together with the passed re-test of FND-HM-2027-014 (2027-06-21).

At Nordvik the stop drill came on Thursday 2027-05-13. It was the Region's first out-of-hours drill, set for 20:10 so that the provider's page reached an on-call manager and not someone at a desk. The provider paged within 3 minutes 50 seconds, inside the five minutes that annex MS-1 requires. The on-call manager, one of the unit's managers on a rota of five, then tried to stop PBK-NR-ISOLATE-01 by setting the isolation policy in the endpoint console to observe only, and could not: the role needed for the console had been given to Karin Lund and the CISO's deputy and to no manager on the rota. A deputy with rights was reached after 14 minutes. The Region had a stop path that could be used only by those who were not on call. AIDR-0731 recorded the finding, set a budget of 10 minutes from the page to an effective stop, assigned the console role to every rota member, and set the drill at twice a year, once out of hours, since a team of six cannot do more without taking an analyst off the queue. The repeat drill a week later took 6 minutes 40 seconds. A stop that exists only on paper is a declared control, not a verified one (AI Threat, Chapter 30) (65, Nordqvist, 2026).

July to September: queues, drafts and hunts

At Nordvik, the report that AIDR-0700 required fell due on 2027-06-30, and the CISO delivered it two days early. AIDR-0732 (2027-06-28) records the CISO's answer to the regional director's question and that the junior post is funded for 2028. The unit does not become a SOC. It becomes a unit with a detection owner and a converted post (AIDR-0719, illustrative, 2027-06-14, role charter ROLE-NR-SEC-DET from 2027-07-01), a sampled provider, a stop path that works, a Level 1 drafting assistant for the rules it takes over, and a trainee analyst post (AIDR-0726, illustrative, 2027-06-21, taking the unit from 14 to 15 posts). It was the only entry rung the Region could afford, and Karin Lund would train the person who held it. The SIEM's embedded assistant stayed switched off until annex MS-2.

Karin's summer was the hunt HNT-NR-0001 (AIDR-0709) on the benefits-triage administration path, run with the Level 1 query pack and the provider's help with telemetry she did not hold. She was looking for valid-account abuse (T1078). She found no compromise and two gaps: sign-ins to the path from managed devices at unusual hours were not covered by any detection, and one service account had never been rotated. AIDR-0733 (2027-09-06) recorded both as findings, opened DET-NR-0002 and DET-NR-0003 for the gaps, and sent the service account to the identity team's queue. With sampling on the provider's out-of-hours closures running since March, 26 weeks of 30 closures had produced two reopened alerts and no significant incident. She reported the count and not a rate.

At Hansa the summer problem was Lena Vogel's. The detection-engineering team of four had been given one drafting agent's output. By the end of June, HM-SEC-002 had drafted 131 detections in the half-year and the team had merged 52, and the open queue stood at 79. The risk was that engineers who drown in drafts approve them as fast as reviewers approve proposals. On 2027-07-13 AIDR-0789 added limits to the five measures of AIDR-0751: no more than six open drafts per reviewer, no merge without its test case and a negative case, and a debt register with a 30-day threshold on any rule without an owner. Lena also kept a Thursday morning in which no new draft was reviewed, to read three merged rules and ask what each still did. The repeat of HNT-HM-0031 found nothing new. On 2027-09-02 DET-HM-0455 passed its scheduled review at version 1.5.0 against BAS-IDP-021.

Practical guide: Writing your own year-in-review from records, not memory

Purpose. To produce, in one working day, an account of the year that a director, a board or a works council can read and that survives questions, because it contains only what a record shows.

Roles. The detection owner or SOC lead writes it. The CISO signs it. A reviewer who was not part of the work checks every number against its source. Employee representatives see the measures before the board does, in the form in which they were agreed.

  1. List the decisions. Export the decision log for the year: every AI Decision Record, with date, decider and status.
  2. List the incidents and reviews. For each incident, take the case record, the clocks and the post-incident review, and note whether each finding has a passed re-test and on what date.
  3. List the measures. Take the quarterly figures from the dashboards agreed with employee representatives: sampling and escape counts, seeded catches, approval median and rejection rate, stop and degraded-mode drill times. Use counts when the denominator is small. Report only what the agreement allows.
  4. Classify each control. Mark it verified (a passing test with evidence by operation), declared (stated, not yet tested) or failed, as AI Threat, Chapter 30, defines them (65, Nordqvist, 2026).
  5. Compare plan and result. Set each decision's stated purpose against what the records show. Where they differ, say so in the first line.
  6. Write the next year's questions. End with the three decisions the records say are due next, with their owners.

Definition of done. Every sentence in the review has a record behind it; every figure carries its denominator; no measure is reported by person; the reviewer has signed that the numbers match; and the employee representatives have seen the page that concerns them. A team of six reports counts, and a team of 38 may report rates.

October: the oversight report, fatigue and the annex

On 2027-10-04 the oversight-quality report OQM-HM-SOC-01 for 2027-Q3 reached the SOC lead. It was the first full quarter under the review protocol reviews/protocol/soc-tiers.yaml (version 1.1.0, AIDR-0769), which had come out of the week in which the approval median for HM-SEC-001 proposals was found to have fallen sharply as volume tripled. The report held 9,600 proposals, 3.0 times the 2026 baseline. The median time to approval was 4.2 minutes, the rejection rate 0.12, and reviewers had caught 24 of 28 seeds, a rate of 0.86 against the threshold of 0.80. Independent reproduction of Level 2 proposals stood at 0.71 against a target of 0.80; the report flagged the target as missed.

The SOC lead read the report two ways. It was reassuring: the median had recovered and the catch rate was above the line. It was also a warning: four of 28 seeds were missed, and nearly three in ten Level 2 proposals had been approved without an independent route to the key fact, the difficulty Bainbridge described of keeping a person practised in supervising a system that rarely fails (75, Bainbridge, 1983). AIDR-0790 (2027-10-06) accepted the report, kept the Level 3 classes in place, kept the 0.80 target for the fourth quarter, and added a fortnight of second-site spot checks of Level 2 approvals. The report reached the Konzernbetriebsrat, in aggregate, before the board.

The fatigue data came with it, and Piotr Nowak had asked for it. His team had told him in the spring something the dashboard did not show: the agents had not made the night quieter, only different, with less to read and more to approve. A study of SOC analysts had reported that the validation of alarms was experienced as tedious and led to desensitisation (69, Alahmadi et al., 2022). The Q3 records of the Polish service centre, reported at team level, gave a mixed answer. Raw alerts read by the night team were down and proposals for approval were up, and on 23 of the 92 nights of the quarter the cap of eight open proposals per night reviewer was reached, so that proposals waited in the agent's queue. The observed share of unassisted work was 0.10 against the policy of one case in five (AIUP-HM-SOC-01), a gap that the review of the quarter recorded as a finding and not as a rounding difference. An anonymous pulse survey of the SOC (29 of 38 replied) was split: more people found their queues manageable, and more found approving tiring in a different way. Piotr moved the second hour of night review to the freshest part of the shift.

Nordvik's version of the quarter was smaller. The provider's out-of-hours pages to the on-call manager numbered 37 in Q3, of which nine needed action. AIDR-0734 (2027-10-12) asked the provider, as a term for MS-2, to report the pages that needed no action by class, so that the class list could shrink, and fixed the on-call arrangement: one week in five, with the compensation agreed with the union, and a stop-path refresher before each rota week. Pages are counted for the team, never listed by person.

The works agreement closed the month. After nine months under the interim letter, the Konzernbetriebsrat, the Polish service centre's representatives and the SOC lead signed the SOC annex to KBV-IT-2024 on 2027-10-28 (AIDR-0791 recorded the group CISO's adoption the same day). Brandt's account was that the interim letter had made the annex possible: both sides had spent nine months learning what the logs were used for, and the annex wrote down what held. It confirms aggregate-only reporting of sampling, AI use and oversight measures, limits the use of commit history and review records to detection quality, and bars their use in appraisal. A post-incident review may read an analyst's query log without measuring the person; no other review of a person may use it. A new agent in an existing class goes through notice and consultation, while a new class goes to the table. Brandt added one clause: the SOC reports cap hits and missed seeds to the Konzernbetriebsrat each quarter, so that representatives see the quiet harms of pace, health and the willingness to speak before the loud ones (67, Nordqvist, 2026). The Swedish unions were consulted under their own rules.

December: the year in records

In the second week of December both organisations wrote their reviews from the records. At Nordvik, AIDR-0735 (2027-12-13) is Karin Lund's account to the CISO and, through the CISO, to the regional director who asked the question in November 2026. At Hansa, AIDR-0792 (2027-12-14) is the group CISO's account to the executive board and the plan for 2028, which includes renewing the mandate of HM-SEC-001 before it expires on 2028-02-09.

The Nordvik review was short and unflattering. Of the SIEM's twelve local rules, seven had a named owner, a test and a review date by year's end, and the rest would follow as capacity allowed. The provider's AI still closed alerts under a contract with no terms for autonomy; the draft annex MS-2 had the provider's agreement in principle to the class list and to sampling, but not yet to notice of model change, and the review marked the point as declared and not verified. The first out-of-hours stop drill had failed, and the second had passed. The hunt had found no compromise and two gaps. The trainee post was funded.

The Hansa review's core is the register below. Its opening answered the board's question of November 2026 on how the SOC would work when its agents acted at night: it worked. One stop had been invoked in earnest and had taken 57 seconds, one containment (the second isolation) had been reversed and the first released, both because the activity was a legitimate rollout, and the control which failed most seriously in the year was one the red team found and not one an adversary did.

Worked example: A year-in-review register

Illustrative. The register is the machine-readable core of Hansa Mutual's review, kept in version control beside the decision log. It contains records only.

year_in_review:
  organisation: hansa-mutual
  year: 2027
  basis: records-only
  signed_by: group-ciso
  checked_by: independent-reviewer
  commission: AIDR-0750
  incident:
    id: INC-HM-2027-0455
    case: CASE-HM-0455
    review: PIR-HM-0455
    review_held: 2027-05-06
    review_closed: 2027-06-03
    assessment: legitimate rollout CHG-PL-2291, not major, no data access
    stop_seconds: 57
    stop_target_seconds: 120
    reversals: 1       # A2, after approval
    releases: 1        # A1, released on the assessment of a legitimate rollout
    approval_seconds_reversed_action: 38
  controls:
    verified:
      - pdp-denies-out-of-scope-isolation
      - isolation-needs-two-independent-data-paths   # playbook v2.1.0
      - stop-from-shift-lead-console                 # drill 2027-06-03, 106 seconds
    failed_then_fixed:
      - control: trust-label-inheritance
        finding: FND-HM-2027-014
        retest_passed: 2027-06-21
      - control: stop-drill-within-target
        finding: FND-HM-0455-3
        drill_seconds: [220, 106]
        retest_passed: 2027-06-03
    declared:
      - detection-drafting-queue-limit
  oversight_q3:
    report: OQM-HM-SOC-01
    proposals: 9600
    baseline_multiple: 3.0
    median_approval_minutes: 4.2
    rejection_rate: 0.12
    seeds_caught: [24, 28]
    reproduction_rate: 0.71
    reproduction_target: 0.80      # missed, flagged in the report
    unassisted_share: { policy: 0.20, observed: 0.10 }
    reporting: aggregate-only
  agreements:
    interim_letter: 2027-01-27
    soc_annex_to: KBV-IT-2024
    signed: 2027-10-28
  next_decisions:
    - { id: pending, due: 2028-02-09, owner: soc-lead, item: renew-mandate-MND-HM-SOC-02 }

The register shows what a year-in-review should show. Verified, failed and declared controls are separate lists, each failed control carries the date of its passed re-test, the oversight figures keep their denominators, a missed target is stated as missed, and the agreements are dated. The last entry points the review forward to a decision with an owner and a date; its record number does not exist yet.

What the year's records say

The records support three conclusions, and they are this book's own, drawn from a fictional year. First, the records that mattered most were written before they were needed: the interim letter, the stop right with its target, the playbook's exclusions and the clocks in the case record. This book's reading is that the review of 2027-05-06 could be blameless because the record of what was meant to happen existed. Second, the failures were found by the design and not by luck. The sample found CASE-NR-0231. The drill found the missing console role. The red team found the unlabelled case note. The oversight report found the weak reproduction rate and the shortfall in unassisted work. Each failure arrived with an owner, a due date and a re-test, and the rule of Chapter 11 that a finding closes only on a passing re-test held all year. Third, scale changed the shape of the problem and not its nature. Nordvik's problem was dependence on a provider and too few people to test, and the remedy was a contract, a sample and a charter. Hansa's problem was volume, and the remedy was a protocol, caps and queue limits. In both, AI moved the load from reading to approving and did not simply remove it, and the works council was a design partner: aggregate-only reporting did not cost the SOC a single measure it needed.

Across the degrees of delegation

The table shows the degree of delegation in force at the end of the year for each function, as the year's decisions left it. Level 4 Autonomous appears nowhere.

Function Nordvik Region at year end Hansa Mutual at year end
B1 Anticipate Level 1 Assisted: extraction and summary on reserved capacity during the weekly intelligence hour (AIDR-0705) Level 1 Assisted for the intelligence cell; hunting agent HM-SEC-007 at Level 2 Supervised, read-only (MND-HM-SOC-04)
B2 Detect Level 1 Assisted: drafting assistant on taken-over rules; provider's rules outside Nordvik's delegation Level 1 Assisted: HM-SEC-002 drafts, engineers merge under queue limits (AIDR-0789)
B3 Investigate Level 1 Assisted: NR-SEC-001 summarises and closes nothing; provider's closures sampled weekly Level 3 Bounded for SC-01 and SC-02 with 5 per cent sampling; Level 2 Supervised for SC-03 and investigation (HM-SEC-001)
B4 Respond Playbook PBK-NR-ISOLATE-01 for end-user workstations under DLG-NR-SEC-01; stop path drilled twice a year Level 3 Bounded for reversible containment; Level 2 Supervised for assets tagged shared and others; stop target 120 seconds
B5 Learn Reviews written by the detection owner for the audit committee and the provider AI drafts timeline and conditions of PIR-*; facilitator verifies; findings close on re-test

Nordvik Region and Hansa Mutual

The year shows two kinds of leverage. Karin Lund's unit had a contract, twelve rules and a weekly sample, and it learned from one escape through a provider's AI it could not inspect. Its best investments were small: a mandate letter and then a charter, a sample of 30, a console role for five managers, a trainee post. Piotr Nowak's and Lena Vogel's organisation had a platform, a pipeline and five agents, and learned from one stop, one reversal and one red-team finding, all inside systems it could change. Its best investments were structural: independent corroboration, caps on open proposals, labels in the case store. Nordvik has no slack: a drill is an evening of a manager's week.

Summary

This chapter followed four fictional people through 2027, a year of the transformed blue team in two organisations, as dated decisions and records. It concerns B1 Anticipate (the hunts and the intelligence hour), B2 Detect (the first rules and the drafting queue), B3 Investigate (the sampled closures and the oversight report), B4 Respond (the incident, the stop and the reporting clocks) and B5 Learn (the review, the red-team finding and the year-in-review). All its events and figures are illustrative.

The year showed that the instruments of Parts II to IV work when they are written before they are needed. A mandate letter and then a charter gave Karin Lund a decision right. A playbook with exclusions and a stop outside the platform let Piotr Nowak act in 57 seconds on a night that turned out to be a legitimate rollout. A pipeline with test cases and queue limits kept Lena Vogel's team from drowning in drafts. An interim letter and then an annex let Thomas Brandt agree to measures that described the review and never the reviewer. The failures of the year, an escaped phishing closure, a stop nobody on call could use, a 38-second approval, shared corroboration, an unlabelled case note and a reproduction rate of 0.71, were each found by a sample, a drill, a review, an exercise or a report, and each was assigned a re-test.

The lesson is the practical guide of this chapter: write the review from records, not memory, and let someone who was not there check the numbers. Chapter 27 draws the conclusion for each organisation from the whole book and compares them, and Chapter 28 places both in the book's general conclusions.

Sources

  1. European Parliament and Council of the European Union. Regulation (EU) 2022/2554 on digital operational resilience for the financial sector (DORA). Official Journal of the European Union, 27 December 2022. (2, European Union, 2022)
  2. European Parliament and Council of the European Union. Directive (EU) 2022/2555 on measures for a high common level of cybersecurity across the Union (NIS 2 Directive). Official Journal of the European Union, 27 December 2022. (3, European Union, 2022)
  3. European Parliament and Council of the European Union. Regulation (EU) 2016/679 (General Data Protection Regulation). Official Journal of the European Union, 4 May 2016. (8, European Union, 2016)
  4. MITRE Corporation. MITRE ATT&CK: Adversarial Tactics, Techniques, and Common Knowledge. (9, MITRE, n.d.)
  5. MITRE Corporation. MITRE ATLAS: Adversarial Threat Landscape for Artificial-Intelligence Systems. (10, MITRE, n.d.)
  6. Nordqvist, G. (2026). AI Threat: Are the Dystopias Coming True? Evidence, Risk and Response for European Enterprises and Public Authorities. The Architecture as Code Series, Book 5. (65, Nordqvist, 2026)
  7. Nordqvist, G. (2026). The Transformed Security Architect: Role, Craft and Career in the Age of AI in European Enterprises and Public Authorities. The Architecture as Code Series, Book 6. (66, Nordqvist, 2026)
  8. Nordqvist, G. (2026). AI Boss: When Artificial Intelligence Manages People in European Enterprises and Public Authorities. The Architecture as Code Series, Book 7. (67, Nordqvist, 2026)
  9. Alahmadi, B. A., Axon, L. & Martinovic, I. (2022). 99% False Positives: A Qualitative Study of SOC Analysts' Perspectives on Security Alarms. 31st USENIX Security Symposium. (69, Alahmadi et al., 2022)
  10. Bainbridge, L. (1983). Ironies of Automation. Automatica 19(6). (75, Bainbridge, 1983)
  11. European Data Protection Board (2023). Guidelines 9/2022 on personal data breach notification under GDPR, version 2.0. (79, EDPB, 2023)