Nordvik Region and Hansa Mutual: Conclusions for Two Organisations

In the autumn of 2026 two governing bodies asked the same question about the same function. Nordvik Region's regional director asked the chief information security officer (CISO) what the security unit becomes when AI enters its work (AIDR-0700). Hansa Mutual's executive board asked the group CISO to show how the security operations centre (SOC) will work when its agents act at night and when adversaries use AI too (AIDR-0750). Chapter 26 followed four people through the year that answered them. This chapter draws the book together into a conclusion and a two-year plan for each organisation, across all five blue team functions: B1 Anticipate, B2 Detect, B3 Investigate, B4 Respond and B5 Learn. It compares the two, says what each should stop doing and limits what each takes to its management body to three decisions that are still open.

Both organisations are fictional and the year is illustrative. The recommendations are the book's own conclusions from Chapters 4 to 26, drawn here and not forecast: they say what a good choice looks like given what the records of the year showed. The plans run from 2027-10-01 to 2029-09-30.

A two-year plan for each organisation across the five functions with measures and a review

Figure 27.1: A two-year plan for each organisation across the five functions with measures and a review.

The series makes one argument: keep decisions as records that can be corrected, keep the ability to stop outside the system being stopped, keep people able to do the work and judge the output, keep dependence reversible, and match autonomy to reversibility (65, Nordqvist, 2026). AI Boss added a commitment for people: a named person sits in the chair for every consequence, and no decision about a named person's access to work is delegated at Level 4 Autonomous (67, Nordqvist, 2026). This book applied the argument to a team through a team charter, a delegation profile per function and action class and a delegation register (Chapter 4), built on the autonomy levels of AI Red Team, Chapter 6, and the role charter of The Transformed Security Architect (64, Nordqvist, 2026) (66, Nordqvist, 2026). Every measure below is one of those commitments made testable.

Nordvik Region: the plan

The Region has a security unit of 14, six analysts who work office hours, an out-of-hours service bought from a managed security service provider (MSSP) under framework agreement NR-2025-044, and at the start of the book no detection engineer, no intelligence analyst and no hunting practice. Its constraints are public pay scales, procurement lead times, a preference for EU-hosted and self-hosted models because alert data contains personal and health data, and public-access rules that make some records requestable. Its advantage is that a small team can see all of its own work.

What the chapters concluded for the Region

B1 Anticipate stays small: one weekly hour for the detection owner, a second analyst as reviewer, extraction on reserved capacity (AIDR-0705; Chapter 5). B2 Detect is where the leverage lies: the Region owns rules one at a time (AIDR-0701), starting with DET-NR-0001, and runs at most two hunts a year (Chapter 6). B3 Investigate exposed the Mode 0 blind spot: the provider's AI closed CASE-NR-0231 under no stated rule, and a weekly sample (AIDR-0712) found it (Chapter 7). Inside the unit, seeding caught seven of nine errors, reported as a count (AIDR-0715). B4 Respond is held where the Region owns the console: PBK-NR-ISOLATE-01 lets the provider isolate an end-user workstation and nothing more, and the first out-of-hours stop drill failed for want of a console role before it was fixed (AIDR-0731; Chapter 26). B5 Learn is written for the audit committee and the provider, and reuses the annual penetration test and the quarterly injected test of annex MS-1 as its purple loop (Chapter 11). Underneath all five lies the people question: a team of six has no slack, the union has ruled that closure rates and the AI-use log are never reported by name (AUS-NR-SOC-01, AIDR-0706), and the decisions that built the roles are already taken: the detection-engineering post and the shared agent operator role (AIDR-0719, illustrative), the trainee post (AIDR-0726, illustrative), with AIDR-0732 recording the answer to the regional director and the post's funding for 2028.

The answer to the regional director

The Region's conclusion, recorded in AIDR-0713, is that a small hybrid team transforms by owning the few things that decide its quality and by making the rest visible through its contract. It owns detection content, the sample, the stop and the entry rung. It buys 24/7 monitoring, and with it a provider's AI, and the question is no longer whether the provider's AI acts but at what level, on which classes, under whose sampling and with what notice. This is the contractual leverage that Nordvik, a deployer and buyer, holds in place of the platform leverage of a builder. The Region's plan is AIDR-0736.

The six measures

The measures aim at what the year left open. The findings of Chapters 25 and 26 that closed on a passing re-test are not targeted again.

Id Function Measure Owner Date Verification
N1 B1 Anticipate Two hunts a year, each tied to a hypothesis and ending in a detection or a dated coverage statement Detection owner Every six months from 2028-03-31 Each hunt record HNT-NR-* closed within 60 days
N2 B2 Detect The Region owns all twelve local rules, each with a record, a test and a second reviewer, and a second analyst can change and test one unaided CISO 2028-09-30 Tests passed within the last 90 days; the second analyst passes an exercise
N3 B3 Investigate Annex MS-2 signed, including notice of model change, and the provider's closed classes sampled and seeded CISO 2028-03-31 Five seeded incidents per class per quarter, at least four escalated, otherwise the class returns to a person
N4 B4 Respond The stop of the provider's AI drilled under MS-2 and the Region's own out-of-hours stop held to its budget CISO with the on-call manager 2028-06-30, then every six months Provider's AI stopped within 15 minutes of the instruction; own stop within 10 minutes (AIDR-0731); one drill out of hours
N5 B5 Learn Findings close only on a passed re-test; the penetration test and the injected test serve as the purple loop; one joint exercise a year with a neighbouring region Detection owner 2028-09-30 and 2029-09-30 No finding older than 180 days without a recorded decision
N6 B3 Investigate and B5 Learn The trainee post filled and paired with the detection owner; half of the trainee's cases unassisted in the first year CISO with the HR lead Post filled by 2028-06-30 Competence record shows a seeded incident worked unaided within 12 months of starting

The order follows reversibility. N1 and N5 are cheap and reversible and run from the first quarter. N2 and N3 build the capacity and the visibility on which the larger commitments rest. N4 comes after N3, because the Region cannot drill a stop for classes it has not yet named in a contract; the 15 minutes is the provider-stop budget of MS-2 and the 10 minutes the Region's own out-of-hours budget, and they are not interchangeable. N6 depends on vetting and on the pay scale.

Three things are left out on purpose. The plan adds no agent team and no Mode 5 agent; the Region's single assistant NR-SEC-001 keeps its mandate MND-NR-SOC-01 at Level 1 Assisted (AIDR-0714). It sets no speed target for closure, because closure rates reward the wrong thing (Chapter 20). And it does not ask the provider to be better; it asks the provider to be visible.

Hansa Mutual: the plan

The group SOC has about 38 people, 22 analysts across Hamburg and the Polish service centre on a follow-the-sun rota with a UK late shift, six senior analysts and investigation leads, a duty manager per shift and a SOC lead. Beside it sit the threat-intelligence cell of three, the detection-engineering team of four, the incident-response team and the red team of five. It runs five agents under mandate manifests MND-HM-SOC-01 to MND-HM-SOC-05 and a delegation profile DLG-HM-SOC-01. Its constraints are seven legal regimes, consultation of works councils and unions, DORA third-party risk for every security AI service, telemetry rules for the UK and Swiss entities and a night shift to staff in two countries.

What the chapters concluded for the group

B1 Anticipate is a pipeline with human decision points: INTEL-HM-0142 became a hunt and a detection (Chapter 5), and no Mode 5 agent changes detection content on the strength of what it reads (AIDR-0755). B2 Detect shows pressure in numbers: 131 drafts in the half-year, 52 merged, 79 open until the queue limits of AIDR-0789 (Chapter 6). B3 Investigate is where review quality became the binding constraint: closure classes SC-01 and SC-02 run at Level 3 Bounded under CLOSE-HM-SOC (AIDR-0765; Chapter 7), and the review protocol of AIDR-0769 answered the fall in approval time with tiers, caps and seeds (Chapter 14), leaving reproduction at 0.71 against 0.80 in the third quarter. B4 Respond was tested by INC-HM-2027-0455: the bounded action held, the 38-second Level 2 approval is what review design exists to prevent, and the stop, slower in its first drill than on the night, closed on a passing re-test (Chapters 10 and 26). B5 Learn turned the incident and the red-team exercise into findings that closed on re-tests (Chapter 11). Behind all five stand the people and the regimes: the SOC annex to KBV-IT-2024 signed on 2027-10-28 (Chapter 26), and four tier-1 posts moving into engineering and investigation-lead roles under AIDR-0775.

The answer to the executive board

The group's conclusion, recorded in AIDR-0767, is that the SOC can work when its agents act at night if every delegation is a record with a class owner, if every stop path sits outside the SOC platform and is drilled, and if review is measured and not assumed. This is the platform leverage of a builder: Hansa can enforce a mandate on agents it runs, and the price is that it must keep a large number of people consistent across two sites and seven regimes. The group's plan is AIDR-0793.

The six measures

Id Function Measure Owner Date Verification
H1 B3 Investigate Extend Level 3 Bounded to the next closure class only on that class's own evidence, with review quality as a second condition SOC lead; the group AI governance board grants Earliest decision 2028-04-01 Class record under CLOSE-HM-SOC: no escape in the class's own sample and seeded-incident catch at or above 0.85 for two consecutive quarters; and OQM-HM-SOC-01 catch at or above 0.80 with reproduction at its 0.80 target; below 0.80 the class returns to Level 2 (AIDR-0769)
H2 B1 Anticipate and B2 Detect Keep drafting inside engineering capacity: no rule merged without a test; accepted intelligence converted to a detection, a hunt or a dated rejection Head of detection engineering 2028-03-31, then quarterly Oldest unreviewed AI draft no more than 10 working days; conversion within 30 days
H3 B4 Respond Keep the stop of HM-SEC-001 at target and degraded mode alive SOC lead with the duty managers 2028-06-30 Two consecutive quarterly drills at or under 120 seconds; manual queue worked within 15 minutes (AIDR-0768)
H4 B3 Investigate and B5 Learn Carry out the pyramid change of AIDR-0775 and bring the observed unassisted share to the policy of one case in five SOC lead with group HR Observed share 0.20 by 2028-06-30; posts as AIDR-0775 Observed share read quarterly; each analyst completes a seeded-incident exercise unaided each year; nothing reported by person
H5 B5 Learn No finding older than 90 days without a decision; repeat the containment exercise each May with a new scenario Head of detection engineering Exercise each May from 2028 Findings register
H6 B4 Respond Run the reporting and consultation across seven regimes as one practice Group CISO Exercise by 2028-06-30 and 2029-06-30 Notices drafted to the named signatory before half of the shortest applicable clock has run; consultation completed in each entity before a new tool goes live

H1 is the measure that matters most, and it is written as a gate with two keys. The first is the class's own evidence, because a closure class is controlled by its own sample and its own seeded incidents; the oversight-quality metric measures the review of HM-SEC-001's Level 2 proposals and says nothing about whether SC-03 is safe to close. The second is review quality, because a class can be sound while the people who supervise it are not. A rate on a count as small as 24 of 28 is a weak instrument, and the plan says so by requiring two consecutive quarters and by reading the count beside the rate.

H3 and H4 mean the same thing from two sides. Level 3 is acceptable to the extent that a person who does not depend on the system can stop it and the people who remain can still do the work. Bainbridge's ironies of automation explain why this has to be practised: the more of the routine work a system takes, the less practised the person is when the system fails (75, Bainbridge, 1983). Research on complacency and bias in human use of automation adds that reliance reduces checking (76, Parasuraman & Manzey, 2010). The plan therefore pairs every extension of delegation with a drill and a unit of unassisted work.

H6 reflects the reporting clocks of Chapter 19. For the group's financial entities DORA Articles 17 to 19 are the primary regime, on time limits that the instrument and its technical standards set; GDPR Article 33 applies to personal data breaches; and whether NIS 2 Article 23 reaches the non-financial parts of the group depends on national transposition and is for the group's legal function (2, European Union, 2022) (8, European Union, 2016) (3, European Union, 2022). The UK and Swiss entities follow their own regimes. The architectural implication is that the case record must carry the timestamps from which each clock starts, so that notices can be drafted by machine, checked by a named person and sent by the signatory. This is an organisational reading, not legal advice.

Similarities and differences

What the organisations share

Both were asked the same question in the same autumn, and both answered it with records. Each has a delegation profile that says, per function and action class, who decides: DLG-NR-SEC-01 and DLG-HM-SOC-01. Each has a closure class that someone owns, a sample that someone reviews and a stop path that someone can use without asking. Each keeps Level 4 Autonomous out of every irreversible B4 Respond action and out of any decision about a named person's access to work, and each has had a union or works council agree that measures about analysts are aggregate. Each found that the failure in the record was a soft one: a provider's AI closing alerts under no rule, an approval in seconds, a stop slower than its budget. None of these needed an adversary.

Where they differ and why

Dimension Nordvik Region Hansa Mutual
Source of leverage The contract and the rules it owns The platform, detections as code and the agent team
Where the limit sits One person and six analysts without slack Review capacity and consistency across two sites and seven regimes
Who holds the AI that acts A provider, visible only through an annex The group, under mandates it enforces
How quality is shown Counts from small samples and seeds Rates from protocols, tiers and metrics at volume
Entry rung One trainee post to protect A pyramid being reshaped with representatives
Monitoring of analysts By tools the provider chooses; no per-name reporting By tools its works council has agreed to; aggregate only
Law One jurisdiction and public law; NIS 2 as nationally transposed DORA as primary regime for its financial entities, GDPR, national supervision in several states; UK and Swiss regimes outside the AI Act and DORA

The differences explain the order of each plan. Nordvik starts with the capacity and the visibility it lacks, because a team of six cannot supervise what it cannot see. Hansa starts with the gate on its own delegation, because a team of 38 supervises a great deal and the risk is that supervision thins as volume grows. A team of six has no slack for degraded-mode drills, so Nordvik drills twice a year; a team of 38 can drill every quarter, and must, because it has more to lose when an agent stops.

What generalises

Five conclusions are proposed here as general. Their support is the research and the instruments cited in Chapters 4 to 24, not the fictional year. The first is that delegation is set by class and by reversibility, and recorded: a Level 3 class has an owner, a sample, a seeded rate and a stop rule written as numbers. The second is that the stop sits outside the system it stops, and a stop that has not been timed is a declaration, not a control (65, Nordqvist, 2026). The third is that quality of judgement is measured by what speed cannot buy, seeded catch, reproduction and escape rate, and not by closure rate or mean time to respond. The fourth is that the craft is kept by design: unassisted work, a route for the next analyst and a drill that proves the fallback. The fifth is that measures about people are agreed with their representatives before the first reading is taken, and are reported in aggregate.

The plans also answer, for these two cases, questions the book raised. Which functions may be delegated, and to what degree (Chapter 4)? Hansa delegates the closure of defined low-risk classes, evidence collection from defined sources and the isolation of an end-user workstation or the revocation of a session at Level 3 Bounded and no higher. Nordvik's own team delegates workstation isolation under a playbook, which its provider's AI already runs for end-user workstations (MS2-ISO, PBK-NR-ISOLATE-01, AIDR-0703), and annex MS-2 sets the levels for the provider's closure classes once it is in force. At both, detection content, the containment of production and executive accounts, notification to a regulator and anything about a named person remain with named people. How is a blue team measured when speed can be improved by closing alerts faster? By the measures in the verification columns above, none of which can be improved by closing faster. Whether there will be a SOC in 2036 is a question for Chapter 24; the plans do not depend on the answer.

Decisions for the management body

NIS 2 Article 20 places accountability for cybersecurity risk-management measures on the management body, and DORA Article 5 does so for the management body of a financial entity (3, European Union, 2022) (2, European Union, 2022). Neither instrument allows that accountability to pass to a tool or to a provider. The management body should receive one page and at most three decisions, the discipline that AI Threat, Chapter 32, set for the threat register (65, Nordqvist, 2026). The decisions below are the ones still open. The posts, the charters and the pyramid change were decided in AIDR-0716, AIDR-0719, AIDR-0726, AIDR-0732, AIDR-0772 and AIDR-0775, and the management bodies are asked only to confirm what follows from them.

Nordvik Region: three decisions

  1. Make the provider's AI visible by condition of renewal. Require annex MS-2, signed with notice of model change, in the renewal of framework agreement NR-2025-044, and accept the consequence, a re-tender or a change of provider, if it is refused. The committee should know before it decides that this is a procurement decision with a cost.
  2. Confirm funding for 2028. Fund a named second maintainer of the Region's detections and the detection owner's protected hours, and confirm the trainee post's protected learning time of 20 per cent in the first year, so that the knowledge of one person becomes the capacity of a team.
  3. Accept the cost of the drills. Accept two stop drills a year, one out of hours, as a standing cost of buying a provider's AI, and receive the result once a year.

Hansa Mutual: three decisions

The executive board, as the management body for DORA purposes, is asked to take three decisions.

  1. Accept the conditions for further delegation. No closure class moves above Level 2 Supervised unless the class's own sample and seeded incidents meet the gate of H1, a class owner is named, a stop rule is written as numbers and consultation is complete in the entities concerned. The group AI governance board grants the level within these conditions, and delegation is withdrawn below 0.80.
  2. Fund the protected time. Fund the time that unassisted work, review and the apprenticeship route of AIDR-0775 require, so that the observed unassisted share can reach one case in five without taking analysts off the night queue.
  3. Own the risk appetite for the night. Accept the degraded-mode objective of 15 minutes for the manual queue, the quarterly stop drills and the yearly cross-regime exercise as a standing cost of delegating to agents, and receive the result once a year.

Measures and review

Practical guide: turning a conclusion into a plan

Purpose. Turn a year of records into a plan that a CISO can fund, a management body can follow and an auditor can check.

Roles. The SOC lead or, in a small unit, the senior analyst drafts; the CISO approves; the management body endorses the decisions that need funding or policy; internal audit receives the verification evidence; employee representatives are consulted on every measure about people.

  1. List the year's decision records as done, in progress or reopened. Where two records disagree, the later-dated one governs. Never ask the management body to decide what a record has already decided.
  2. For each of the five functions, name the constraint that most limits it, such as one person, review capacity or a provider's silence, and write down the conclusion the chapters support. If none is supported by a record, the function gets no measure. Target what is still open, not what a passed re-test has closed.
  3. Write at most six measures, normally one per function and one for people. Each has a verb, an owner by role, a date and a verification that produces evidence.
  4. Order the measures by reversibility: cheap and reversible first, commitments that are hard to undo last and conditional.
  5. Write every increase in delegation as a gate on the class's own evidence, with review quality as a second condition: a threshold, a period, a named grantor and a stop rule. A default is two consecutive quarters; adapt it to the risk appetite and to the size of the sample.
  6. Agree every measure about people with the representatives before the first reading is taken, and report it in aggregate.
  7. Keep the plan as code beside the charter and the delegation register, set a review each half-year and list the triggers that reopen it.

Definition of done. Every measure has an owner, a date and a verification; at most three decisions go to the management body; every increase in delegation is conditional on recorded evidence; and the plan names the signals on which it would be revised.

Worked example: the two plans as code

Illustrative example. Nordvik's plan, recorded in AIDR-0736 on the strength of the conclusion in AIDR-0713, builds ownership and visibility before it commits to anything the Region cannot undo.

# plans/blue-team-2027-2029.yaml (Nordvik Region, illustrative)
plan: PLAN-NR-BT-2027
decision_record: AIDR-0736
conclusion_record: AIDR-0713
owner: chief-information-security-officer
approved_by: regional-executive-committee
period: {from: 2027-10-01, to: 2029-09-30}
constraint: six analysts working office hours; detection content partly held by the provider
already_decided: [AIDR-0719, AIDR-0726, AIDR-0732]
measures:
  - id: N1-B1
    what: Two hunts a year, each ending in a detection or a dated coverage statement
    owner: detection-owner
    due: every six months from 2028-03-31
    verify: hunt records closed within 60 days
  - id: N2-B2
    what: All twelve local rules owned, with test and second reviewer; a second analyst can change one unaided
    owner: chief-information-security-officer
    due: 2028-09-30
    verify: tests passed within 90 days; exercise passed
  - id: N3-B3
    what: Annex MS-2 signed with notice of model change; provider closures sampled and seeded
    owner: chief-information-security-officer
    due: 2028-03-31
    verify: five seeded incidents per class per quarter, at least four escalated, otherwise the class returns to a person
  - id: N4-B4
    what: Stop of the provider's AI drilled under MS-2; own out-of-hours stop held to budget
    owner: chief-information-security-officer
    due: 2028-06-30
    verify: provider's AI stopped within 15 minutes; own stop within 10 minutes (AIDR-0731); one drill out of hours
  - id: N5-B5
    what: Findings close on a passed re-test; one joint exercise a year with a neighbouring region
    owner: detection-owner
    due: 2028-09-30
    verify: no finding older than 180 days without a decision
  - id: N6-B3B5
    what: Trainee post filled; half of the trainee's cases unassisted in year one
    owner: chief-information-security-officer
    due: 2028-06-30
    verify: seeded incident worked unaided within 12 months
decisions_for_regional_executive_committee: [MS-2 as a condition of renewal, funding for 2028, cost of the drills]
review: {quarterly: CISO, half_yearly: regional-executive-committee, first: 2028-03-31, final: 2029-09-30}
revise_on: [provider change of control, notice of a model change, detection owner leaves, relevant alert closed by provider AI]

Hansa's plan, recorded in AIDR-0793 on the strength of AIDR-0767, holds the gate on its own delegation and treats stop time and review quality as the constraints.

# plans/blue-team-2027-2029.yaml (Hansa Mutual, illustrative)
plan: PLAN-HM-BT-2027
decision_record: AIDR-0793
conclusion_record: AIDR-0767
owner: soc-lead
approved_by: group-ciso
period: {from: 2027-10-01, to: 2029-09-30}
constraint: review capacity; two sites; seven regimes
already_decided: [AIDR-0765, AIDR-0769, AIDR-0775]
measures:
  - id: H1-B3
    what: Level 3 Bounded for the next closure class only on its own evidence, with review quality as a second condition
    owner: soc-lead
    grantor: group-ai-governance-board
    due: earliest 2028-04-01
    verify: class record shows no escape in the sample and seeded catch at or above 0.85 for two quarters; OQM-HM-SOC-01 catch at or above 0.80 and reproduction at target; below 0.80 the class returns to Level 2
  - id: H2-B1B2
    what: No rule merged without a test; accepted intelligence converted or dated-rejected
    owner: head-of-detection-engineering
    due: 2028-03-31
    verify: oldest unreviewed AI draft at most 10 working days; conversion within 30 days
  - id: H3-B4
    what: Stop of HM-SEC-001 kept at target; degraded mode drilled each quarter
    owner: soc-lead
    due: 2028-06-30
    verify: two consecutive drills at or under 120 seconds; manual queue within 15 minutes
  - id: H4-B3B5
    what: Pyramid change of AIDR-0775 carried out; observed unassisted share brought to one case in five
    owner: soc-lead
    due: 2028-06-30
    verify: observed share 0.20 read quarterly; seeded exercise unaided each year; nothing by person
  - id: H5-B5
    what: No finding older than 90 days without a decision; containment exercise repeated each May
    owner: head-of-detection-engineering
    due: exercise each May from 2028
    verify: findings register
  - id: H6-B4
    what: Reporting and consultation across seven regimes run as one practice
    owner: group-ciso
    due: 2028-06-30
    verify: notices drafted before half of the shortest clock has run   # clocks: limit per_instrument
decisions_for_executive_board: [conditions for further delegation, protected time, risk appetite for the night]
review: {quarterly: group-ciso, half_yearly: group-ai-governance-board, yearly: executive-board, first: 2028-03-31}
revise_on: [seeded catch below 0.80, new Mode 5 agent, change in UK or Swiss regime, change to KBV-IT-2024, stopped agent in a major incident]

Neither plan raises autonomy unconditionally. Nordvik's measures create the visibility on which any later delegation would have to rest, and Hansa's single extension waits on recorded evidence.

What the plans assume

The plans rest on statements about the future, labelled as the series requires (62, Nordqvist, 2026).

  • Observable. Anthropic reports a campaign in which the AI performed 80 to 90 per cent of the work, at several requests a second (Chapter 25) (47, Anthropic, 2025). This is a vendor's account of its own detection.
  • Expected (OpenAI's forecast, not the book's). OpenAI states that autonomous offensive agent collectives should be assumed to be a credible near-term threat for enterprises (55, OpenAI, 2026). If machine-speed adversaries become the normal case, pressure to widen delegation follows, which is why the plans fix the conditions before the pressure arrives.
  • Speculation. That a team could one day be run without a named human for every consequence is speculation. No evidence in the sources of this book supports it, and the plans do not depend on it.

Review

The owner of each measure reports quarterly to the plan owner on one page, with the verification evidence attached. The plan is reviewed by the management body's delegate every half-year and in full on 2029-09-30, and it is reopened on any trigger in revise_on. A measure that fails its verification twice in a row is not extended; it is reconsidered. Nordvik's first review, on 2028-03-31, checks N3 first, because the other measures depend on a contract that either exists or does not. Hansa's first review, the same day, checks H1 and H3 first, because a rate below the gate or a stop above its target stops every other extension. Both reviews also check the people measures with the representatives.

What each should stop doing

A plan that adds without retiring turns into the thing it was meant to prevent. Several of the practices below are anti-patterns that Chapter 25 names.

Organisation Stop Replace with Evidence
Nordvik Region Treating the provider's closure rate as evidence of coverage A sample, seeds and the terms of MS-2 Seeded escalation count each quarter
Nordvik Region Holding the knowledge in one person A second maintainer and an exercise Second analyst passes the exercise
Hansa Mutual Counting drafts as progress, or reading a fast approval as efficiency Merged rules with tests, and tiers, caps, reproduction and seeded errors 15 of 48 is a conversion rate, not an output; median approval, rejection and reproduction read together
Hansa Mutual Extending delegation by exception A gate with a rate, a period and a grantor AIDR-0767 and the minutes of the group AI governance board
Both Reporting speed measures as the quality of the team, or introducing a measure about analysts before it is agreed Seeded catch, reproduction, escape rate and recoverability, agreed with representatives first The board page of Chapter 20; signed clause

Across the degrees of delegation

The table shows the highest degree of delegation each organisation reaches by the end of its plan, per function and action class. Level 4 Autonomous appears nowhere.

Function and action class Nordvik Region Hansa Mutual
B1 Anticipate: extraction of intelligence, hypotheses Level 1 Assisted Level 1 Assisted; hunting agent HM-SEC-007 at Level 2 Supervised, read-only
B2 Detect: drafting a detection Level 1 Assisted, on adopted rules Level 1 Assisted; no Mode 5 agent changes detection content
B2 Detect: closing a defined low-risk alert class Provider's AI at Level 3 Bounded for named classes only once MS-2 is in force, declared until seeds verify; otherwise Level 2 Supervised HM-SEC-006 at Level 3 Bounded for SC-01 and SC-02; SC-03 at Level 3 only through gate H1
B3 Investigate: summary, correlation NR-SEC-001 at Level 1 Assisted HM-SEC-001 at Level 2 Supervised
B3 Investigate: evidence collection from defined sources Level 1 Assisted Level 3 Bounded; imaging at Level 2 Supervised
B4 Respond: isolating an end-user workstation, revoking a session Workstation isolation at Level 3 Bounded under PBK-NR-ISOLATE-01 Level 3 Bounded under playbook manifests, workstation isolation under PBK-HM-ISOLATE-01
B4 Respond: servers, accounts, citizen-facing or production services, notification A named person decides A named person decides; production hosts and executive accounts at Level 2 Supervised
B5 Learn: drafting a review Level 1 Assisted Level 1 Assisted or Level 2 Supervised
Any decision about a named person's access to work or an irreversible B4 Respond action Never Level 4 Autonomous Never Level 4 Autonomous

Nordvik Region and Hansa Mutual

For Nordvik Region the chapter means that annex MS-2, a second maintainer and the stop drills are the three things to confirm, and that the Region's strongest instrument is a sentence in a contract it can test. For Hansa Mutual it means a gate on its own delegation and a drill on its own stop: the group has the platform, the engineering and the agents, and what it needs is the discipline not to widen what it cannot yet show it can supervise. Both reach the same conclusion by different instruments: the agents act within a written mandate, a person who does not depend on them can stop them, and the people who remain can still do the work.

Summary

Nordvik Region and Hansa Mutual answered the same question of the same function in the autumn of 2026. Nordvik's conclusion, AIDR-0713, is that a small hybrid team transforms by owning detection content, the sample of its provider's AI, the stop and the entry rung, and by making the rest visible through its contract; its plan, AIDR-0736, has six measures and three open decisions for the regional executive committee. Hansa's conclusion, AIDR-0767, is that a large in-house SOC can let agents act at night when every delegation is a record with an owner, every stop sits outside the platform and is drilled, and review is measured; its plan, AIDR-0793, has six measures and three open decisions for the executive board.

The five blue team functions each have a measure in both plans. B1 Anticipate is held to conversion: an accepted hypothesis ends as a detection, a hunt or a dated rejection. B2 Detect is held to ownership at Nordvik and to engineering capacity at Hansa. B3 Investigate is held to a sample and seeds of the provider's closures at Nordvik and to a gate on the class's own evidence at Hansa. B4 Respond is held to a timed stop and, at Hansa, to a practice that spans seven regimes. B5 Learn is held to the rule that a finding closes only on a passed re-test. A measure on the entry rung and the craft completes each plan.

What the two organisations share is a method: delegate by class and reversibility, record it, put the stop outside the system it stops, measure judgement by what speed cannot buy, keep the craft by design and agree measures about people with their representatives first. What they do not share is the instrument. Nordvik has the contract and Hansa has the platform. Neither management body can hand its accountability to a tool or to a provider, and each can show, from its own records, who decided what and whether it can stop and recover. Chapter 28 draws the whole book's conclusions: it tests the thesis against the evidence of the preceding chapters, gives the author's labelled projection, and sets out what an analyst, a SOC lead, a CISO, a board member and an employee representative can do on Monday.

Sources

  1. European Parliament and Council of the European Union. Directive (EU) 2022/2555 on measures for a high common level of cybersecurity across the Union (NIS 2 Directive). (3, European Union, 2022)
  2. European Parliament and Council of the European Union. Regulation (EU) 2022/2554 on digital operational resilience for the financial sector (DORA). (2, European Union, 2022)
  3. European Parliament and Council of the European Union. Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data (General Data Protection Regulation). (8, European Union, 2016)
  4. Anthropic (2025). Disrupting the first reported AI-orchestrated cyber espionage campaign. (47, Anthropic, 2025)
  5. OpenAI (2026). OpenAI-Hugging Face Incident Technical Report. (55, OpenAI, 2026)
  6. Nordqvist, G. (2026). AI Governance: Governing Artificial Intelligence in European Enterprises and Public Authorities. (62, Nordqvist, 2026)
  7. Nordqvist, G. (2026). AI Red Team: AI as an Active Part of Cyber Defence in European Enterprises and Public Authorities. (64, Nordqvist, 2026)
  8. Nordqvist, G. (2026). AI Threat: Are the Dystopias Coming True? Evidence, Risk and Response for European Enterprises and Public Authorities. (65, Nordqvist, 2026)
  9. Nordqvist, G. (2026). The Transformed Security Architect: Role, Craft and Career in the Age of AI in European Enterprises and Public Authorities. (66, Nordqvist, 2026)
  10. Nordqvist, G. (2026). AI Boss: When Artificial Intelligence Manages People in European Enterprises and Public Authorities. (67, Nordqvist, 2026)
  11. Bainbridge, L. (1983). Ironies of Automation. Automatica 19(6), 775-779. (75, Bainbridge, 1983)
  12. Parasuraman, R. & Manzey, D. H. (2010). Complacency and Bias in Human Use of Automation: An Attentional Integration. Human Factors 52(3), 381-410. (76, Parasuraman & Manzey, 2010)