\cleardoublepage \part{The Blue Team in Question} \setbookpart{The Blue Team in Question}

Part I: The Blue Team in Question

At 02:10 an alert fires. In one organisation a managed provider's AI reads it, finds it similar to a thousand earlier alerts and closes it. In another an investigation agent enriches it, proposes isolating a host and waits for a person. A few years ago a tier-1 analyst would have opened both. This part asks what the blue team is, what it did before AI entered its work, what presses on it now and what it becomes. It defines the book's frame: five functions, five degrees of delegation and one question, namely what remains for people to do and to answer for.

Chapters in this part:

  • Chapter 1, Introduction: The Blue Team Transformed, sets out the question, the thesis the book tests, what would show it wrong and how the book builds on the seven earlier volumes.
  • Chapter 2, What the Blue Team Does: Five Functions, Tiers and the Alert Queue, describes the team before the transformation and defines B1 Anticipate, B2 Detect, B3 Investigate, B4 Respond and B5 Learn.
  • Chapter 3, The Pressure on the Blue Team: Machine-Speed Adversaries, Alert Volume and Scarce Talent, sets out what presses on the team, by what the evidence shows and with each outlook labelled observable, expected or speculation.
  • Chapter 4, The Transformed Blue Team Defined: Mandate, Functions and Degrees of Delegation, joins the functions to the series' autonomy levels and usage modes, and states the rule the rest of the book applies: Level 4 Autonomous is never used for an irreversible containment action.

Blue team functions in this part. Part I defines all five functions and does not yet judge any of them. It establishes the distinction on which the book's argument rests: functions whose outputs can be checked and reversed (enrichment, drafting, search) differ in kind from those whose outputs change the estate or a person's situation (containment, account disablement, disclosure).

The thread from the series. AI Red Team put AI to work in cyber defence under a written mandate at an autonomy level matched to reversibility, and The Transformed Security Architect concluded that a role is transformed rather than abolished when accountable human judgement remains its scarce part. This part takes both conclusions to the team.

What you will learn in this part:

  • The five blue team functions and why separating them is the first step to governing AI in the team
  • What presses on the team, and what the evidence does and does not show
  • How degrees of delegation, usage modes and accountability fit into one definition
  • The thesis the book tests, and the evidence that would refute it

The chapters in Part I are the frame. Part II turns from definitions to the craft, function by function.