Red and Blue as People: Trust, Incentives, Safety and Wellbeing

The loop of the earlier chapters is made of records, mandates and stop paths, and it is run by people. Two professions meet in it: one is paid to find the way through, the other to stop it, and the loop asks them to sit at one table and say exactly where the defence failed. This chapter describes the human side of that arrangement: what each side is rewarded for, what makes a purple session safe enough for the truth to be said, what is known about being tested, what exercises and automation do to the load, and what an organisation owes to staff who are exposed to an exercise without having chosen it. It concerns every stage. P1 Target decides whose systems and which staff are touched, P2 Emulate is where people are tested, P3 Observe is where a result is first read aloud in a room, P4 Improve is where a finding becomes someone's work, and P5 Verify is where a person signs that it is done.

Red and blue are rewarded differently; the purple coordinator links them to a shared target of verified coverage with evidence age, within the conditions for a blameless session.

Figure 23.1: Red and blue incentives, the shared target, the purple coordinator and the conditions for a blameless session.

The chapter builds on earlier conclusions. AI Boss, Chapters 13, 14 and 26, concluded that monitoring has a chilling effect, that pace has a cost in health, and that oversight must be real and measured by the review and not the reviewer (93, Nordqvist, 2026). AI Blue, Chapter 21, applied that to the analyst: the research on fatigue in security operations is small and mostly qualitative, measures concern the system and not the person, and tools that log every query can profile the individual and fall within co-determination (94, Nordqvist, 2026). AI Red Team (Chapters 6 and 15) and AI Threat (Chapters 6 and 14) added that skills erode when AI does most of the work (90, Nordqvist, 2026); outside security, Bainbridge observed that manual skills deteriorate when they are not used (100, Bainbridge, 1983), and an observational study of endoscopists found that adenoma detection in unassisted colonoscopy fell after regular exposure to AI (115, Budzyń et al., 2025). Chapter 4 of this book defined the roles and the independence principle, and Chapter 6 fixed that an exercise which involves staff is safety class S4.

A word on method. The bibliography contains no study of the wellbeing of red teams, of the effect of a purple session on its participants or of the effect of AI on either. It contains adjacent work: qualitative studies of security operations, one qualitative study of twelve offensive security practitioners, field studies of teams and of observation in other industries, and two large studies of phishing simulations. Each is described by what it measured, in whom and how.

What red and blue are rewarded for

"Red wins when blue loses" describes a scoreboard and not two characters. A red team rewarded for the techniques that reached their objective, and a blue team rewarded for alerts handled and rules merged, have opposed incentives even if every member wants the organisation to be safe. A good quarter for one is a bad quarter for the other, and each side has a reason to explain away the other's best evidence: the tester's access was unrealistic, the defender's rule was written for the test. Chapter 4 named this the incentive dimension of independence and set the rule that the party accountable for the quality of a finding is not the party accountable for closing it. That keeps the verdict honest. It does not make the two sides want the same outcome.

AI sharpens the problem. When an emulation runner executes forty-one scenarios on a rolling schedule (Chapter 8), runs become cheap, and a measure that counts runs rewards throughput and says nothing about what was learned. When a drafting agent proposes 131 detections in a half-year and 52 are merged, a measure of drafts rewards volume, and a team with no cap on open drafts has built another queue (94, Nordqvist, 2026). AI Blue, Chapter 20, gave the general answer: every measure carries a gaming check, and measures about people are agreed first, reported in aggregate and never per named analyst.

The design that resolves the tension separates two things the scoreboard tends to merge.

  1. Accountability stays separate where independence needs it. The red team or tester answers for the quality of findings. The blue team and the detection engineer answer for the change. The closure owner answers for each closure. One named role answers for the age of the register. Nobody closes a finding they raised, and nobody tunes a rule for the scenario that tests it.
  2. The target is shared where learning needs it. Red and blue are measured together by the share of priority techniques that are verified with evidence of a stated age, by the time from finding to verified control, and by how a detection holds up against a held-out variant (Chapter 18 treats the measures). Nobody on either side can score on this target by making the other side look bad, because a technique that is verified counts for both and a technique with expired evidence counts against both.

The shared target is a team measure in the sense of AI Boss, Chapter 26: it is built from records of what the system did, aggregated for a group of at least five people, and it never feeds the appraisal of any individual (93, Nordqvist, 2026). The rest of this chapter returns to why that rule is a condition of the truth being told and not a courtesy to staff.

Trust and blamelessness

A purple session is a meeting in which one group shows another where its work did not hold. Whether the second group says what it saw, including the embarrassing part, depends on what the room has made safe. The best-known construct is psychological safety, introduced by Edmondson in a study of 51 work teams in a manufacturing company: a shared belief that the team is safe for interpersonal risk taking. She found it associated with learning behaviour, which mediated between psychological safety and team performance, while team efficacy was not associated with learning once safety was controlled (109, Edmondson, 1999). The teams were in one manufacturer, not in security, and the link to a purple session is my interpretation: a session in which a defender who admits not having read an alert is punished will produce fewer admissions and so less learning.

Blameless review has a practical record in operations. Google's chapter on postmortem culture defines blamelessness as identifying contributing causes without indicting any individual or team, assuming that everyone involved had good intentions and acted reasonably on what they knew; its reason is that people who fear punishment do not surface problems, and that you cannot fix people but can fix systems and processes (85, Lunney & Lueder, 2017). That is a practitioner source, not a measurement, and the structure transfers: a finding of the kind "triaged but not acted on" (Chapter 9) is first a question about what the system made easy. In the autumn 2027 session at Nordvik, the valid-account success was alerted at 02:17 and closed by the provider's AI as low severity at 02:21 (PRP-NR-2027-02, FND-NR-2027-011). The blameless reading asks which closure policy allowed it and who owned the class; the blaming reading asks who was on shift. The first leads to a change in a contract annex, the second to a person who does not volunteer information again.

Blameless does not mean accountless. Chapter 4 fixed who answers for what. The class owner, the person who granted the level and the closure owner answer for the design and the closure, as AI Blue, Chapter 4, concluded for a missed closure (94, Nordqvist, 2026); the individual who acted on what the system showed is not the subject of the review unless the process did not allow real review.

The ECB's TIBER-EU purple teaming guidance, the closest published practice for this exercise form, expects red and blue to forge a working relationship, adapts the language so that all stakeholders share a common understanding, and asks the red team to lead by example: explain its tactics and objectives, acknowledge the areas of strength, then open the conversation to the areas that need improving (34, ECB, 2025). The order matters. Its effect on outcomes has not been measured in the sources of this book, so the rules below are defaults to test and adapt.

Practical guide: Setting ground rules for a blameless purple session

Purpose. Make a session in which the people who were tested can say what they saw, and in which the record shows how the system behaved without making a case against a person.

Roles. Purple team coordinator (facilitates and keeps the record), white-team lead (owns the charter and the stop), red-team lead or contracted test lead, detection owner or detection engineering lead, the analysts who worked the exercise, a staff representative where the charter or the works agreement requires one, and the data protection officer for the retention terms.

Steps.

  1. Write the charter before the session and not in it. It states the purpose, who attends, what is recorded, who may read the record, how long it is kept and that no result enters an appraisal. Participants read it at least two working days before the session (a default).
  2. Seal the expectation sheet first. The defender's expectation of what would be seen is written and dated before the fieldwork (Chapter 9), so that nobody can adjust it afterwards and nobody is judged against a recollection.
  3. Open with what held. The red lead states first the steps that were prevented or detected within expectation, then proceeds to the gaps. This follows the TIBER-EU sequence (34, ECB, 2025).
  4. Record roles and systems, not names. The session record says "the triage class MS2-C1 closed the alert" and not who was on shift. Names appear only where a person is the owner of a change or a closure, because that is a duty and not a fault.
  5. Ask what the system made easy. The facilitator redirects any sentence of the form "X should have" to the form "the process allowed". Nobody is asked to explain a miss from memory.
  6. Allow a pause. Any participant may call a pause without giving a reason, and a stop made in good faith is never a failure (Chapter 4). Time-box a session to three hours with a break after ninety minutes (defaults).
  7. Close with decisions. Each finding leaves with a route, an owner and a date (Chapter 10). Anything left as "to discuss" goes to the coordinator's list with an owner.
  8. Debrief on the process within five working days. One question to the participants: what in the session made it harder to say what you saw. The answers go to the white-team lead, not to line managers.

Definition of done. The charter is signed and dated before the session, the record contains no individual's name against an outcome, the findings carry owners and routes, and the debrief answers are filed with the white-team lead. Adapt the time limits to the works agreement and the size of the team.

Worked example: Session charter at Nordvik Region

In March 2027 the Region's six analysts worked with a contracted tester for the first time. The rules for purple-session-2027-q2 were agreed in a short written exchange. In March 2028 the Region turned them into a charter before the spring session PRP-NR-2028-01 (28 March 2028), recorded as AIDR-0832 and dated 2028-03-06. The example is illustrative.

# Illustrative. Nordvik Region, purple session charter (AIDR-0832, 2028-03-06).
charter_id: PSC-NR-2028-01
applies_to: PRP-NR-2028-01              # session of 2028-03-28
purpose: learn from EMU-NR-2028-01 (window 2028-03-20 to 2028-03-24)
attending:
  - {role: ROLE-NR-SEC-DET, person: Karin Lund, duties: [detection owner, coordinator]}
  - {role: contracted-tester, person: Elin Berglund}
  - {role: senior-security-analyst, count: 2}
  - {role: white-team-lead, person: deputy CISO}
read_before: 2 working days
open_with: what held
recorded:
  - outcome per step, by system and class
  - owner and route per finding
not_recorded:
  - audio or video of the session
  - the name of the analyst on shift against any outcome
  - per-person timings
readers: [ROLE-NR-SEC-DET, contracted-tester, CISO office, internal audit]
retention_months: 60                    # as RoE-NR-2027-001
use_in_appraisal_or_discipline: forbidden
aggregate_reporting: results reported in aggregate, never by name   # union agreement
pause: any participant, no reason needed
time_box_hours: 3
debrief:
  due_within_working_days: 5
  question: what made it harder to say what you saw
  filed_with: white-team-lead
review_date: 2028-09-01

Karin Lund appears in the charter with two duties, and the reason is stated in the section on the coordinator below: the person who commissions the test is also the person whose detection is examined.

Being tested

Being tested is not one experience. A defender in a tabletop exercise knows the date and the scenario. A defender in a purple session watches the scenario run. A defender whose queue holds a seeded incident, as under the MS-2 annex of the Region's contract with its managed provider, does not know which item it is. At Hansa Mutual a pipeline runs tagged scenarios on a rolling schedule so that each priority technique is exercised at least every thirty days (Chapter 8), which turns the test from an event into a condition of the working day. Each is lawful and useful, and each weighs differently on the person.

The evidence on what testing does to the tested comes from other settings. Bernstein combined embedded participant-observers with a field experiment at a mobile phone factory in China and reported that maintaining observability of workers may reduce their performance by inducing concealment, while a modest increase in group-level privacy sustainably and significantly improved line performance (110, Bernstein, 2012). The setting is a production line and the manipulation was privacy, not testing. AI Boss, Chapter 13, drew the line to monitoring that feeds evaluation and concluded that the cost falls on the willingness to ask, help and question (93, Nordqvist, 2026). The application to a defender is my interpretation: if a missed seeded incident is recorded against a name and read by a line manager, the rational response is to close faster, escalate less and hide doubt, the opposite of what the seed was meant to measure. Qualitative studies of SOC analysts report that validating mostly benign alarms is tedious and can lead to alarm burnout (20 survey respondents and 21 interviewees) (96, Alahmadi et al., 2022), and that burnout in one corporate SOC studied over six months arises from the interaction of human, technical and managerial factors (97, Sundaramurthy et al., 2015). Neither measured the effect of being tested.

For the red side, the one study in the bibliography is a qualitative investigation of twelve offensive security practitioners, analysed thematically and written to inform tool builders. It does not measure wellbeing, stress or the experience of being observed (113, Happe & Cito, 2023). The experience of red operators and of defenders under test has not been studied in a way this book can cite, and where the sections below say more, they say it as design.

Three design rules follow, and they are the book's own conclusions.

Say what class of test there is, and withhold only the instance. The charter and the works agreement state that seeded incidents, injected records and tagged scenarios exist, in what classes, at what rate, with what stop conditions and who reads the results. What an analyst does not know is which item on a given night is a seed (Chapter 13 defines seeded incidents). This keeps the test of triage valid and keeps the arrangement out of the covert monitoring this book excludes.

Count the test against the system. A missed seed lowers the catch rate of a class, and the catch rate freezes a delegation (Chapter 15). It is not a mark on the person who worked the item. AI Boss, Chapter 26, drew the same line for oversight: measure the review and not the reviewer, aggregate by default, and let each person see only their own figures (93, Nordqvist, 2026).

Give the tested some latitude. Karasek's job-strain model of 1979 relates mental strain to the combination of job demands and decision latitude (114, Karasek, 1979), and AI Boss, Chapter 14, used it to predict where algorithmic direction harms. A continuous pipeline adds demand without adding latitude. The cap on open drafts per reviewer (six at Hansa), the alert budget per detection and the right to call a pause are the latitude that goes with it.

Wellbeing and load

The load that exercises and automation place on people has four sources, and only the last is new.

  1. The exercise window. Fieldwork adds work to a team that has a queue. Nordvik's tester ran three weeks of fieldwork in spring 2027 against a team of six with no slack.
  2. The stop path. A person who holds the stop must be reachable for the length of a window. At Nordvik the MSSP shift lead is a stop-path holder for out-of-hours activity, and the duty analyst is paged when a stop touches a citizen-facing service (RoE-NR-2027-001). The load of readiness is real even if no stop is called (94, Nordqvist, 2026).
  3. The findings. A session that produces five findings produces five pieces of work for people who have a day job. A register that grows faster than it is closed (Chapter 10) is itself a source of strain.
  4. The reviewing of machine output. AI drafts scenarios, correlates outcomes and proposes detections, and a person reviews. Research on human use of automation reports complacency and bias in monitoring reliable systems (101, Parasuraman & Manzey, 2010), and AI Threat, Chapters 6 and 14, concluded that reliance on AI reduces effort and, among those who trust the tool, checking (91, Nordqvist, 2026). The curator at Hansa proposed 17 scenario drafts in its first month and Mareike Hartmann accepted six and rejected eleven, seven of them as duplicates (Chapter 5). The rejection rate describes the curator's drafts and the review's floor. It does not describe Hartmann, and the oversight-quality rule of AI Boss, Chapter 26, that an approval in seconds signals failure, applies to the review as a process.

The size of the effect on security professionals is not well known. ISC2's 2025 workforce study, an online survey of 16,029 practitioners and decision-makers in May and June 2025, reported that 48 per cent felt exhausted from trying to keep up with threats and emerging technologies and 47 per cent felt overwhelmed by their workload (99, ISC2, 2025). The respondents are practitioners in general, the figures are self-reported, and red is not separated from blue. The survey supports treating load as a design concern and does not quantify it for any team.

Two rules follow for exercises and loop agents.

Space the tested activities. A team with an injected-test round, a stop drill, a fieldwork window and a session close together is never not being tested. Nordvik's spring 2028 had exactly that: the MS-2 round of 7 to 20 February, the stop drill of 2 March, the window of 20 to 24 March and the session of 28 March. The Region recorded AIDR-0833, dated 2028-03-13: from the next planning cycle, at most one tested activity per ten working days for the same people, and a named person who may defer a window for load. The rule is an architectural choice, not a finding of a study.

Do not let a measure of load become a measure of a person. Tools that log every query and ranking can show how much each analyst did, and that profile falls within co-determination (AI Blue, Chapter 21); in German law, § 87(1) no. 6 of the Works Constitution Act gives the works council co-determination over technical devices designed to monitor behaviour or performance (11, Bundesrepublik Deutschland, n.d.), and the Federal Labour Court treats a device as designed for that purpose when it is objectively suitable for recording such information, whatever the employer intends (16, Bundesarbeitsgericht, 2022) (121, Bundesarbeitsgericht, 2024). Hansa's clause KBV-IT-2024-SOC-04 fixes the minimum reporting group at five and forbids ranking of analysts, per-person approval time and missed seeds attributed to a person; KBV-IT-2024-SOC-05 extends the rule to the red team and detection engineering (94, Nordqvist, 2026). The AI Act prohibits AI systems that infer emotions of a natural person in the workplace except for medical or safety reasons (Article 5(1)(f)), so a wellbeing dashboard built on inferred mood is excluded (1, European Union, 2024). A team that wants to know about load asks people and counts hours.

The craft, and being watched

Automation also changes how the work feels, in two parts. The first is the sense of craft. A red operator who used to write a scenario and now reviews a draft, and a detection engineer who used to write a rule and now reviews a pull request, do the part of the work that research on automation describes as hard to do well, the monitoring of a system that is usually right (100, Bainbridge, 1983). The Transformed Security Architect named the change Shift 4, from sole author to conductor of an AI team (92, Nordqvist, 2026), and Chapter 24 treats the apprenticeship. The second is being watched. The loop's agents log what operators asked, accepted and changed. The log serves evidence and stop-path reconstruction, and the same log joined to a name describes the person. The rule is the one both organisations already apply: the log is for the loop and its audit, kept for a stated period, readable by named roles and not used to rank the people in it. That reviewing machine drafts will become the main task of both professions is expected, on the trend that The Transformed Security Architect, Chapter 14, recorded for the architect's role (92, Nordqvist, 2026) and that Chapters 10 and 14 describe for drafting agents. What it does to the identity of the craft over a decade is speculation.

Staff exposed to exercises

Some exercises test staff who are on neither team: a deepfake test of payment approvals, or a message to a unit to find out whether colleagues follow a verification step. Chapter 6 classed every scenario that involves staff as S4: named operators act with per-step white-team approval, the AI may plan and does not act (Level 0), and the representatives are informed. This section treats governance, consent and representation. It gives no content for a lure or a technique. What can be undone is the exercise and not the experience: a synthetic request can be cancelled, but a person's sense of having been deceived cannot, which is why S4 stays at Level 0, runs on the range or with the notice the agreement requires, and can be stopped by any stop holder, or paused by any participant, without a reason.

What is known about simulations on staff

Two large studies bear on whether simulated phishing helps, and both are field studies of employees as targets. Lain, Kostiainen and Capkun ran simulated phishing emails in the normal work context of more than 14,000 employees over 15 months, with a reporting button in the email client. Warnings on emails were effective, embedded training during the simulation did not make employees more resilient and sometimes made them more susceptible, and using employees as a collective detection mechanism was practical, with an acceptable load and sustained engagement (111, Lain et al., 2022). Ho and colleagues ran an eight-month randomised controlled experiment with ten simulated campaigns sent to over 19,500 employees of a large healthcare organisation. They found no significant relationship between recent awareness training and the likelihood of failing a simulation, an extremely low absolute difference in failure rates between users who received embedded training and users who did not, and that most users spent minimal time with the material; they concluded that anti-phishing training in its common forms is unlikely to offer significant practical value (112, Ho et al., 2025). Both studies measure click and report behaviour, not stress, trust or perceived fairness. They support neither a claim that exercises harm staff nor a claim that they improve individual behaviour.

The governance implication is the book's own conclusion. An exercise that involves staff is justified by what it tests in the controls and the reporting path: whether the verification step exists, works and is used, and whether a report reaches people who can act. It is not justified as a way to train or to catch individuals. The unit of result is the control and the unit of reporting is the group.

Four points of governance recur in the example organisations. They are organisational and architectural implications, not legal advice, and they follow the member states of the two examples.

Representatives first. Nordvik's union agreement requires written notice ten working days before the window to the staff representatives' joint committee, which sees the scenario text; the participants do not. Hansa's clause KBV-IT-2024-SOC-05 requires advance information to the Konzernbetriebsrat and to the Polish and Swedish representatives. Chapter 21 sets out the German and Swedish co-determination rules behind these clauses (F86) (93, Nordqvist, 2026). GDPR Article 88 lets member states provide by law or collective agreement for more specific rules on employees' data, with suitable measures for transparency and for monitoring systems at the workplace (7, European Union, 2016). Where the exercise involves a high-risk AI system used at the workplace, Article 26(7) of the AI Act requires deployers who are employers to inform workers' representatives and the affected workers before using it (1, European Union, 2024).

Consent is not the legal basis. In an employment relationship an employee can rarely refuse without consequence, so consent is a weak basis for processing, as AI Boss, Chapter 13, concluded from the supervisors' opinion (93, Nordqvist, 2026); recital 43 of the GDPR likewise says that consent should not be a valid ground where there is a clear imbalance between the data subject and the controller, in particular a public authority (7, European Union, 2016). Nordvik's exercises rest on its public task (the exercise manifests cite GDPR Article 6(1)(e)). The information duties of Article 13 still apply to what is collected, and the controller, seeking the advice of the data protection officer, decides whether an impact assessment under Article 35 is needed for systematic processing of this kind (7, European Union, 2016). What replaces consent is the set of conditions in the notice: the exercise is announced as a class, the participant can stop it, and the participant can ask that their action not be recorded at all.

No individual consequences. The result is the control's. A participant who approved a synthetic request, or followed a lure, has not failed; the verification step has. No result enters an appraisal, a disciplinary file or a ranking, and no list of participants who acted is kept. Level 4 Autonomous is never used for a step that targets a named person (Chapter 4), and no AI system selects individuals within a unit to be tested.

Debrief and a way to talk. The staff exposed to an S4 exercise are told on the same day that they took part, what the exercise tested, and that the result is about the control. A contact is named, from occupational health or the safety representative, for anyone who found the experience distressing. The tester and the facilitator of the debrief are not the line manager.

Worked example: Exercise-information notice for staff at Nordvik Region

The Region's deepfake test of payment approvals (RoE-NR-2027-002, NR-AWR-2027-01, finance unit, 23 participants) was run on the basis of a notice of this kind. The dates are illustrative: the notice was sent to the joint committee on 2027-05-24, ten working days before the window opened on 2027-06-07. The synthetic persona is a fictional person, not a likeness of any employee.

# Illustrative. Nordvik Region, exercise-information notice (finance unit).
notice_id: EIN-NR-2027-002
exercise: RoE-NR-2027-002               # NR-AWR-2027-01
safety_class: S4
kind: deepfake resilience for payment approvals
unit: finance
participants: 23
sent_to: staff representatives' joint committee
sent_on: 2027-05-24
window: {from: 2027-06-07, to: 2027-06-11}
working_days_notice: 10
scenario_text_shared_with: joint committee only
staff_told_in_advance:
  - that an exercise of this kind will take place in the window
  - what it tests: the verification step for payment approvals
  - that the result concerns the control and is reported in aggregate
legal_basis: GDPR Article 6(1)(e), public task    # consent is not the basis
synthetic_persona: fictional, no employee likeness
collected: outcome per approval step, by unit
not_collected: [names against outcomes, lists of who acted]
participant_rights:
  - stop at any point, no record against the person
  - ask that their action is not recorded
  - use the normal reporting path, which counts as a pass
stop_holder: CISO delegate
debrief: same day, by the tester and the privacy officer, not the line manager
support_contact: occupational health and the safety representative
use_in_appraisal_or_discipline: forbidden
retention_months: 60                    # aggregate evidence, as RoE-NR-2027-001

The provider's analysts, who work the Region's queue out of hours, are the provider's employees, and the Region cannot promise them what only their employer can. The MS-2 annex therefore asks the provider to confirm in writing that seeded-incident results are reported in aggregate to its own staff representatives.

At Hansa Mutual the same information rule applies through KBV-IT-2024-SOC-05, and the group CISO's office records a standing notice template and a house default of ten working days, with longer periods where Dutch, German or Swedish consultation requires them (AIDR-0883, dated 2028-03-14). None of the eight S4 scenarios in the library had been run against staff by the end of the first quarter of 2028; the template was adopted before the first would be.

The purple coordinator as translator

The coordinator of Chapter 4 is a role and not a team (Chapter 19 gives the charter). In human terms the coordinator must understand both professions well enough to carry a result between them. A red operator describes a path through the estate in the language of techniques and objectives; a detection engineer describes a rule in the language of data sources, logic and alert budget. A finding that is accurate in the first language can be unusable in the second, and the TIBER-EU guidance names the need to adapt the language so that all stakeholders share a common understanding (34, ECB, 2025). The coordinator's skill is translation: restating a step as the telemetry that should have existed and a gap as the change that closes it.

The role carries three strains of its own. The first is the position between two groups who may each suspect the translator of favouring the other; a coordinator who tells the red lead that a finding is unusable and tells the detection engineer that it is real is trusted by neither until the record shows consistency. The second is the several duties one person may hold. At Nordvik, Karin Lund is detection owner, coordinator, closure accountable and access review owner: she commissions the exercise that examines her own detection and reads the result to her own team. The Region compensates structurally: the held-out variant for REG-NR-0004 is written by Elin Berglund, the deputy CISO (as white-team lead) reads the register, and the independent re-test of Chapter 11 does not rest on her judgement. That protects the Region's evidence. It does not remove the personal strain of examining and being examined, so the charter lists her two duties openly. The third is capacity. At Hansa the coordinator is a full-time post held by Sofia Keller from 2028-03-01, with direct access to the group CISO on the age of the register (Chapter 19). At Nordvik the role is a fraction of one person's time in a team of six, and that limits the loop's cadence.

The coordinator is measured by the flow and legibility of the register, such as findings reaching owners in a usable form, and not by the number of findings opened, closed or escalated. A coordinator rewarded for closures has an incentive to close, which is the failure the closure owner exists to prevent. If a session turns toward blame, the coordinator, who writes the record, can decline to write the name.

A joint scorecard at Hansa Mutual

In the illustrative year the group's red team and detection engineering had objectives that pulled apart: the red team's quarter counted priority techniques that reached their objective, and detection engineering's counted rules merged within the alert budget. On 2028-02-28 the group CISO's office adopted one scorecard for both (AIDR-0882), with Mareike Hartmann and Lena Vogel as co-owners and no per-person line.

# Illustrative. Hansa Mutual, joint scorecard (AIDR-0882, 2028-02-28).
scorecard_id: SCR-HM-2028-Q1
owners: [Mareike Hartmann, Lena Vogel]
shared_target: priority techniques verified with evidence inside expiry (90 days)
baseline: {source: BTP-HM-2027-Q3, verified: 25, of: 34, finding_to_control_median_days: 19}
measures:
  - verified share of the 34 priority techniques
  - finding to verified control, median days
  - held-out catch compared with known-form catch   # Q1 gap: 19 points
gaming_checks:
  - a technique with expired evidence counts as unverified for both owners
  - runs executed is not a measure
reporting: {level: team, minimum_group_size: 5}
prohibited: [per-person lines, ranking, use in appraisal or discipline]
accountabilities_unchanged:
  finding_quality: red team
  change: detection engineering
  closure: closure owner per class

The scorecard changes what a good quarter means. It does not change who closes a finding.

Observable, expected, speculation

Observable. That blameless review is practised in operations, that TIBER-EU guidance sets out how to run purple teaming, that psychological safety was associated with learning in 51 manufacturing teams, that observability reduced performance in one factory experiment and that simulated phishing and its training showed limited effects in two large field studies are observable, with the limits stated above.

Expected. That load, craft and the sense of being watched will be shaped by team design more than by tools is expected, because it follows from decisions in force: the AI Act's prohibition on inferring emotions at work and the co-determination rules, and the trend toward drafting and emulation agents that Chapters 10 and 14 describe.

Speculation. Claims about the long-term identity of the red and blue crafts are speculation, and Chapter 24 treats them as a question of apprenticeship.

Across the usage modes

The mode decides whose identity the AI uses and therefore what is recorded about the person who works with it.

Usage mode What it does to the people in the loop What is recorded and who sees it
Mode 0 Ambient AI Provider or product AI closes or ranks alerts inside the product; the defender cannot see the test or the monitoring Contract rights first: the provider's reporting of seeded results must be in aggregate (MS-2)
Mode 1 Conversational assistants A practitioner drafts a scenario or a summary; the pace is theirs Prompts are logged under the acceptable-use policy; they are not read to rank anyone
Mode 2 Embedded workplace assistants Suggestions in the ticketing and document tools; small extra checks Console telemetry may record what was accepted; the works agreement states whether it is kept
Mode 3 Agentic work tools A practitioner's agent assembles a plan or a timeline with the practitioner's identity Action log and approvals are both records; the practitioner's identity is on them
Mode 4 Built AI applications The curator and the correlator at Hansa propose; people review Review figures are team measures; acceptance rates describe the review
Mode 5 Autonomous production agents The runner adds pace and a standing test; the stop holder carries readiness The run log serves evidence and stop reconstruction, not ranking of operators

Across the degrees of delegation

Action touching people Ceiling Why
Plan an S4 scenario that involves staff Level 0 Advisory A named operator acts with per-step white-team approval (Chapter 6)
Select individuals within a unit to be tested None; undelegated A person is never targeted by a system
Aggregate session or run results by team Level 1 Assisted A person reviews the aggregation and its minimum group size
Produce a per-person view of activity, time or misses None; prohibited The works agreement and the Region's union agreement forbid it
Defer or stop an exercise for load A named person; any stop holder The right to stop needs no justification (Chapter 4)

Nordvik Region and Hansa Mutual

Nordvik Region's six analysts met a contracted tester for the first time in spring 2027, agreed the session rules in writing and turned them into the charter PSC-NR-2028-01 (AIDR-0832) and a load rule (AIDR-0833). The union agreement fixes aggregate reporting and ten working days' notice for exercises that involve staff. Its risk is a small team that is both examiner and examined, with one person in several roles; the independent re-test and the white-team reading of the register are the structural answer.

Hansa Mutual's red team and detection engineers share one target on a joint scorecard (AIDR-0882), and the red-team staff are covered by the same clause as the analysts (KBV-IT-2024-SOC-05). The standing information template for exercises that involve staff is recorded (AIDR-0883). Its risk is a continuous pipeline that makes testing a condition of the working day; the cap on open drafts, the alert budget and the right to pause are the latitude that goes with the pace.

Summary

The loop depends on people who are rewarded in opposite directions. P2 Emulate and P3 Observe put one profession's work in front of the other's, and a scoreboard of "red wins when blue loses" makes honest reading costly. The answer is to keep accountability separate where independence needs it, so that the tester answers for the quality of findings, the engineer for the change and a named person for each closure, and to share the target where learning needs it: verified coverage with the age of its evidence, the time from finding to verified control, and the held-out catch. AI makes runs and drafts cheap, so any measure that counts them needs a gaming check.

A purple session is safe for the truth when the charter is written first, the record names roles and systems and not people, no result enters an appraisal, anyone may pause, and the room opens with what held. The evidence is thin and adjacent, and this chapter claims no more for it. Load is a design concern: space the tested activities, protect the latitude of the tested, and never let a measure of load or of testing become a measure of a person. P4 Improve and P5 Verify are where the load lands as work.

Staff exposed to exercises are protected by governance and not by consent: the representatives informed in advance, the result belonging to the control, a debrief on the day and no consequence for any person. The large studies of phishing simulations measured clicks and reports and found limited value in training, which supports testing the reporting path and the controls and not individuals. The purple coordinator carries a result between two professions and the strains of that position; a joint scorecard changes what a good quarter means without changing who closes a finding. Chapter 24 follows with the competences of the loop and the apprenticeship problem on the red side.

Sources

  1. European Parliament and Council of the European Union (2024). Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act). Official Journal of the European Union. (1, European Union, 2024)
  2. European Parliament and Council of the European Union (2016). Regulation (EU) 2016/679 (General Data Protection Regulation). Official Journal of the European Union. (7, European Union, 2016)
  3. Alahmadi, B. A., Axon, L. & Martinovic, I. (2022). 99% False Positives: A Qualitative Study of SOC Analysts' Perspectives on Security Alarms. USENIX Security Symposium. (96, Alahmadi et al., 2022)
  4. Sundaramurthy, S. C. et al. (2015). A Human Capital Model for Mitigating Security Analyst Burnout. SOUPS 2015. (97, Sundaramurthy et al., 2015)
  5. ISC2 (2025). 2025 Cybersecurity Workforce Study. ISC2. (99, ISC2, 2025)
  6. Parasuraman, R. & Manzey, D. H. (2010). Complacency and Bias in Human Use of Automation: An Attentional Integration. Human Factors 52(3). (101, Parasuraman & Manzey, 2010)
  7. Nordqvist, G. (2026). AI Red Team. The Transformed Architecture, Book 4. (90, Nordqvist, 2026)
  8. Nordqvist, G. (2026). AI Threat. The Transformed Architecture, Book 5. (91, Nordqvist, 2026)
  9. Nordqvist, G. (2026). The Transformed Security Architect. The Transformed Architecture, Book 6. (92, Nordqvist, 2026)
  10. Nordqvist, G. (2026). AI Boss. The Transformed Architecture, Book 7. (93, Nordqvist, 2026)
  11. Nordqvist, G. (2026). AI Blue. The Transformed Architecture, Book 8. (94, Nordqvist, 2026)
  12. European Central Bank (2025). TIBER-EU Purple Teaming Guidance. ECB. (34, ECB, 2025)
  13. Edmondson, A. (1999). Psychological Safety and Learning Behavior in Work Teams. Administrative Science Quarterly 44(2). (109, Edmondson, 1999)
  14. Bernstein, E. S. (2012). The Transparency Paradox. Administrative Science Quarterly 57(2). (110, Bernstein, 2012)
  15. Lain, D., Kostiainen, K. & Capkun, S. (2022). Phishing in Organizations: Findings from a Large-Scale and Long-Term Study. IEEE S&P. (111, Lain et al., 2022)
  16. Ho, G. et al. (2025). Understanding the Efficacy of Phishing Training in Practice. IEEE S&P. (112, Ho et al., 2025)
  17. Lunney, J. & Lueder, S. (2017). Postmortem Culture: Learning from Failure. In Site Reliability Engineering, O'Reilly Media. (85, Lunney & Lueder, 2017)
  18. Happe, A. & Cito, J. (2023). Understanding Hackers' Work: An Empirical Study of Offensive Security Practitioners. arXiv. (113, Happe & Cito, 2023)
  19. Karasek, R. A. (1979). Job Demands, Job Decision Latitude, and Mental Strain. Administrative Science Quarterly 24(2). (114, Karasek, 1979)
  20. Bundesarbeitsgericht. Beschluss vom 8. März 2022, 1 ABR 20/21. (16, Bundesarbeitsgericht, 2022)
  21. Bainbridge, L. (1983). Ironies of Automation. Automatica 19(6). (100, Bainbridge, 1983)
  22. Budzyń, K. et al. (2025). Endoscopist deskilling risk after exposure to artificial intelligence in colonoscopy: a multicentre, observational study. The Lancet Gastroenterology & Hepatology 10(10). (115, Budzyń et al., 2025)
  23. Bundesrepublik Deutschland. Betriebsverfassungsgesetz (BetrVG), § 87 Mitbestimmungsrechte. Gesetze im Internet. (11, Bundesrepublik Deutschland, n.d.)
  24. Bundesarbeitsgericht (2024). Beschluss vom 16. Juli 2024, 1 ABR 16/23. Bundesarbeitsgericht. (121, Bundesarbeitsgericht, 2024)