Competences, Training and Keeping the Red Craft

A loop needs people who can do six kinds of work: choose and write scenarios, run emulation, engineer detections, read what happened, control an exercise and keep the evidence. When AI takes the routine part of the first four, the question is where the next people who can do the whole of that work come from, and how the present ones keep what the routine used to teach them. This chapter answers it for the people on both sides of the loop, with the weight on the red side, which AI Blue did not treat. It concerns every stage by name: P1 Target, where the scenario writer's grasp of an adversary's objectives decides what is tested; P2 Emulate, where operators and emulation engineers run, adapt and stop; P3 Observe, where red and blue read the result together; P4 Improve, where detection engineers turn a finding into a change; and P5 Verify, where a person reproduces a result and signs closure.

The chapter builds on three earlier treatments and does not repeat them. AI Blue, Chapter 22, set out a competence framework for the blue team, the competence record and the rule that a competence shown with and without the assistant counts at the lower level; AI Blue, Chapter 23, treated the missing first rung of the analyst's ladder, unassisted practice, the craft register and the SOC apprenticeship (94, Nordqvist, 2026). The Transformed Security Architect, Chapter 15, designed the keeping of a craft for a single role (92, Nordqvist, 2026). This chapter applies their instruments to the loop and its red craft, and stages the debate on whether automated emulation erodes the craft of the adversary's mind.

A learning path from SOC analyst through detection engineering, scenario author and a rotation seat in the red team to emulation engineer, and back, with four unassisted-practice checkpoints.

Figure 24.1: A learning path from analyst to emulation engineer and back, with the unassisted-practice checkpoints.

What the red craft is

The red craft needs a definition before it can be protected, and the one used here is the book's own. It is the capacity to start from an adversary's objective and constraints and to build a path to it that nobody has catalogued; to adapt when a step fails or when the defence reacts; to judge which step to leave out because it would be unsafe, out of scope or not worth its risk; and to explain the result to people who defend. That is the adversary's mind in the working sense of this chapter: a set of skills that can be observed in an exercise, not a talent or a temperament.

The supervisory frameworks describe the same set when they say what a red team must contain. The ECB's guidance on procuring service providers for TIBER-EU requires a red team of at least three people, led by a test manager, and asks that the team together cover knowledge of the business of the financial entity, red team testing, penetration testing, reconnaissance, threat intelligence, risk management, exploit development, physical penetration, social engineering and vulnerability analysis, with the communication skills to explain advanced technical subjects to the blue team and to non-experts (50, ECB, 2025). Two parts of that list, knowledge of the entity's business and the ability to explain a result to the people who must act on it, are not matters of technique.

The chapter separates the craft from the routine. Routine is running a known technique in a known form and writing the entry in the record. Craft is the choice of what to run, the improvisation when the plan meets the estate, and the judgement of what to stop. A great deal of craft is learned inside routine, and that is the apprenticeship problem: the routine that AI now does well was also the school.

A competence framework for the loop

A framework lists what the people of a function must be able to do, at which level and with what evidence. The loop does not fit the framework of the blue team, because it spans both sides and has roles that exist in neither: the scenario author, the emulation engineer, the exercise controller who sits in the white team. Hansa Mutual's group framework LOOP-CF, version 2028.1, has six areas of three identifiers each, 18 in all. It sits beside the SOC framework SOC-CF of AI Blue and uses the same four levels and the same codes only where the competence is the same.

Area Identifiers What the competence is Stages
SD Scenario design SD-01 write a scenario record from intelligence; SD-02 set the safety class and expected outcome per layer; SD-03 write a novel scenario from an objective and constraints and keep it held out The scenario library and the held-out set P1 Target
EE Emulation engineering EE-01 build and maintain an emulation runner or plan; EE-02 run a scenario by hand, in its manual form, inside the manifest; EE-03 adapt when a step fails and decide what to leave out Running and adapting P2 Emulate
DE Detection engineering DE-01 write and test a detection as code; DE-02 draft detections from the technique and the telemetry, not from the scenario; DE-03 review an AI-drafted detection against held-out scenarios The defender's half of the change P4 Improve
OA Observation and analysis OA-01 write the expectation before the run and read outcomes by layer; OA-02 classify outcomes and raise findings; OA-03 check a correlator's conclusions against the raw record Reading the result P3 Observe
XC Exercise control XC-01 coordinate a purple session; XC-02 hold and exercise the stop path; XC-03 act for the white team on scope, safety class and staff exposure Governing the exercise P2 Emulate, P3 Observe
EV Evidence EV-01 write and sign an evidence manifest; EV-02 reproduce a result from the manifest; EV-03 state a coverage claim with what was tested, when and with what result Closing and claiming P5 Verify

Three design decisions are worth stating. First, the adversary's mind has an address: SD-03 and EE-03 are the identifiers in which it is evidenced. Second, the competences that exist only beside an assistant are named as such: DE-03 and OA-03, the review of an AI draft and of a correlator, are assessed in the assisted form alone, as AGT-02 is in AI Blue. Third, the two-form rule applies to the rest. A scenario that an operator writes well only when the curator proposes the shape has not shown SD-03. The lower of the two forms counts, and the level scale is that of Architecture as Code (Chapter 18), Foundation, Practitioner, Advanced and Expert, which AI Governance, Chapter 14, follows with Awareness as the name of the first level (87, Nordqvist, 2025) (88, Nordqvist, 2026).

The framework maps to external ones so that a role is legible to a recruiter and an auditor. ENISA's European Cybersecurity Skills Framework describes role profiles, among them a penetration tester and a cyber threat intelligence specialist (102, ENISA, 2022), and SFIA 9 describes skills in levels of responsibility (103, SFIA Foundation, 2024).

Nordvik Region has no red team and no emulation engineers, so a framework of 18 identifiers would describe a team it does not have. Its subset LOOP-CF-NR, version 2028.1, has nine: SD-01, DE-01, DE-02, OA-01, OA-02, XC-01, XC-02, EV-01 and EV-02. It leaves out EE and SD-03 because the contracted tester holds them, and it records that omission as a decision: the competences of the red craft are bought, and the Region's task is to be able to commission, read and challenge them. That is what XC-01, OA-01 and EV-02 evidence. A Region that cannot reproduce a tester's result from the evidence manifest has bought a report, not a loop.

Competence records

A competence record CMP-* is, as in AI Blue, Chapter 22, a record of judgement exercised: the levels a person has shown, the evidence, the validity period and the development plan (94, Nordqvist, 2026). Everything that chapter concluded about records as personal data carries over unchanged: exercise evidence only, no ranking, the subject reads all of it, and use agreed with employee representatives. The Region's union has agreed that exercise results are reported in aggregate and never by name, and the Konzernbetriebsrat of Hansa Mutual co-determines under BetrVG §87(1) no. 6 (11, Bundesrepublik Deutschland, n.d.) and extended the SOC annex to exercises through KBV-IT-2024-SOC-05 (93, Nordqvist, 2026). GDPR Article 88 lets member states set specific rules for employment data (7, European Union, 2016).

Red-team staff and detection engineers are covered by the same rule as analysts, as the exercise clause already says.

Worked example: A competence record for a purple-team coordinator

Illustrative example. On 2028-03-30, two days after the spring purple session PRP-NR-2028-01, Nordvik Region assessed Karin Lund, the detection owner who is also the purple-team coordinator, against LOOP-CF-NR. The exercise was EX-NR-2028-01: a synthetic replay of the autumn session's chained scenario, which she led with and without the correlator's summary, and a stop drill that she ran at night with the MSSP shift lead. The record is CMP-NR-21. Earlier records CMP-NR-02 to -07 belong to the analysts of AI Blue; this one is the first for the loop.

# competence/records/CMP-NR-21.yaml (illustrative)
competence_record:
  id: CMP-NR-21
  person_ref: NR-EMP-40102
  role: ROLE-NR-SEC-DET          # also purple-team coordinator
  framework: {id: LOOP-CF-NR, version: "2028.1"}
  assessed_on: 2028-03-30
  exercise: EX-NR-2028-01        # synthetic replay of the autumn chain, plus a night stop drill
  assessors: [deputy_ciso_as_white_team_lead, contracted_tester]
  purposes: [development_plan, input_to_closure_accountability_review]
  not_used_for: [individual_performance_ranking, pay_setting, disciplinary_process]
  readers: [record_subject, ciso, hr_competence_partner]
  competences:                   # both forms; the lower counts; DE-02 unassisted only
    - {id: OA-01, level: practitioner, unassisted: EX-NR-2028-01/a, assisted: EX-NR-2028-01/b}
    - {id: OA-02, level: practitioner, unassisted: EX-NR-2028-01/c, assisted: EX-NR-2028-01/d}
    - {id: SD-01, level: practitioner, evidence: SCN-NR-0013}   # library kept alive, 13 scenarios
    - {id: DE-02, level: practitioner, unassisted: EX-NR-2028-01/e}
    - {id: XC-01, level: practitioner, evidence: PRP-NR-2028-01}
    - {id: XC-02, level: foundation,   evidence: EX-NR-2028-01/f}  # night drill: 7 min to revoke against 2
    - {id: EV-02, level: foundation,   evidence: EVD-NR-2028-0003} # reproduced the base pass, not the variants
  subject_comment: agrees; asks to see the tester's stop procedure at first hand
  development_plan:
    learning_path: LP-NR-LOOP-2028-01        # AIDR-0835
    protected_time_share: 0.05
    items:
      - {competence: XC-02, target: practitioner, by: 2028-10-31, means: "stop drill led with the MSSP shift lead, twice"}
      - {competence: EV-02, target: practitioner, by: 2028-10-31, means: "reproduce two variants from the manifest with the tester"}
      - {competence: SD-03, target: foundation,   by: 2029-01-31, means: "shadow Elin Berglund through the autumn 2028 run"}
  valid_until: 2029-03-30

The record shows what it was designed to show. She holds the reading of results at Practitioner in both forms, and the stop path only at Foundation: the Region's target for revoking the test identity is 120 seconds (LOOP-NR-2028-01) and the night drill took seven minutes, a gap the daytime drills had hidden. EV-02 stands at Foundation because she reproduced the base result and could not yet reproduce the variants without the tester. Both gaps are on the development plan with dates, and the plan includes a competence, SD-03, that the Region's framework otherwise leaves to the tester: the coordinator who has watched a novel scenario written is better placed to read the next one. The record informs who holds closure accountability; the CISO decides.

What the evidence says about skill beside automation

The evidence base has a long theory and a short, recent set of measurements, and none of it concerns red teaming.

The theory is old. Bainbridge's "Ironies of Automation" argued in 1983 that automating the routine part of a task leaves the person with the residue that is hardest to do, while removing the practice that would have made them able to do it (100, Bainbridge, 1983). Parasuraman and Manzey's review reports complacency and automation bias in people who work with automated aids (101, Parasuraman & Manzey, 2010). AI Threat, Chapter 14, brought this up to date for generative AI and drew the consequence that automating junior work removes the route by which experts are made (91, Nordqvist, 2026).

The measurements are these. In a multicentre observational study of colonoscopy at four Polish centres, the adenoma detection rate in procedures done without AI fell from 28.4 per cent (226 of 795) before the centres introduced AI assistance to 22.4 per cent (145 of 648) afterwards, an absolute difference of 6.0 percentage points (95 per cent confidence interval 1.6 to 10.5) (115, Budzyń et al., 2025). The design is observational and the authors present the finding as a risk. In a field experiment with nearly 1,000 high school mathematics students, access to a standard GPT-4 interface raised practice grades by 48 per cent, and when access was removed those students scored 17 per cent below students who had never had it; a tutor built with learning safeguards largely avoided the drop (116, Bastani et al., 2025). In a randomised study of 52 programmers learning an unfamiliar library, the group with an AI assistant scored about 17 per cent lower on a quiz of conceptual understanding, code reading and debugging, with no significant difference in completion time, and three of six interaction patterns, those in which the participant asked for explanation or checked understanding, preserved learning; it is a preprint (117, Shen & Tamkin, 2026). In a study of customer-support agents, an AI assistant raised productivity, and the gain was largest for novice and low-skilled workers: the working-paper version reports 5,179 agents, about 14 per cent on average and about 34 per cent for novices, with minimal effect for experienced workers and suggestive evidence that novices gained experience faster, and the journal version reports 5,172 agents and about 15 per cent on average (118, Brynjolfsson et al., 2025).

Read together, these results do not say that AI makes people worse. They say that the effect depends on use: unrestricted use that replaces the attempt is associated with weaker unaided performance, use that keeps the attempt or asks for explanation is not, and novices can gain from the assistant. That reading is the book's interpretation. No source in the bibliography measures red-team operators, scenario authors or detection engineers with a comparison group, and the ISC2 workforce study reports skills needs, not entry-level hiring in offensive security (99, ISC2, 2025). The labels follow.

  • Observable. Unaided performance can fall after sustained use of an assistant in some tasks (colonoscopy, school mathematics, learning a programming library), and the effect depends on the pattern of use. Novices gain more than experts from an assistant in at least one large workplace study.
  • Expected. That the same mechanism applies to emulation engineering, scenario writing and detection engineering as planners, curators and drafters take the routine. The mechanism is the same and the trend is the book's own reading of the delegation it recommends, but it has not been measured in these roles.
  • Speculation. That the supply of new red operators stops, or that human adversary emulation ends.

The red apprenticeship

The bibliography does not document how most red operators entered the craft. The table gives the book's own analysis of what junior work in the loop taught, so that a team can ask for each element where it is now learned.

What junior work taught Where AI now does the work Where it can be learned instead
What an estate's ordinary days look like, by running known techniques and watching the logs The runner and the pipeline run S1 scenarios daily Reading the tagged run logs against the telemetry, as OA-01 practice, before reading the correlator's summary
How a technique fails in practice, by running it by hand and meeting the lockout, the proxy and the unexpected The runner executes a catalogued form Manual-form runs on the range and in the pre-production mirror (EE-02), unassisted
How to write a scenario and a variant The curator proposes drafts and the planner proposes variants Writing and reviewing scenarios and variants, with the curator's draft opened only after the attempt (SD-01 to SD-03)
How a detection is built, and why it fires The drafter proposes rules Writing the test for a detection and reviewing a draft against a held-out scenario (DE-01, DE-03)
How to explain a result to the defenders Reports are drafted Co-writing the purple session record and the closure note (XC-01, EV-01)

Two conclusions follow, both the book's own. The routine did teach, and the new work teaches only if it is designed to: reviewing a curator's drafts teaches little to a junior who has never written one. And the loop creates new first rungs. Because scenarios, detections and regression cases are code (Chapter 11), a junior can write the tests that accompany a detection, review a variant or reproduce a result from an evidence manifest, with consequences small enough to learn from. These rungs sit between the red and blue sides, which is where a loop is made.

Rotation and the way back

The learning path of Figure 24.1 runs from a SOC analyst or junior detection engineer through detection engineering and scenario authorship into a seat in the red team, and then back. The way back matters as much as the way in. A red operator who spends a quarter in detection engineering learns why a rule fires and what a detection engineer needs from a finding; an engineer who spends a quarter on the red range learns what a technique looks like from the other side of the telemetry. The book's conclusion is that rotation in both directions is the cheapest instrument for the independence that Chapter 15 asks of authors. It also carries the cooling-off rule of AI Governance, Chapter 14, for the move between building and verifying: a person who built a detection does not verify it for a stated period (88, Nordqvist, 2026).

Practical guide: Designing an apprenticeship route that survives automation of routine emulation

Purpose. Give a junior a route to the red craft after the routine runs in a pipeline, and keep the present operators able to do what the pipeline does. Roles. The red-team lead (or, at an organisation that buys testing, the purple-team coordinator with the contracted tester); the head of detection engineering; the white-team lead; the employee representatives; the apprentice and a named mentor.

  1. List the capabilities, not the posts. From LOOP-CF choose the competences the route must produce (for example EE-02, SD-01, SD-03, DE-01, XC-02) and write, for each, where a junior practises it and where an expert keeps it. A capability with no answer is the gap.
  2. Start with the attempt. For the first six months, the apprentice drafts every scenario, variant and detection test before opening any assistant's proposal, and notes the sequence in the record (attempt, then ask). This applies the pattern that preserved learning in the study of programmers (117, Shen & Tamkin, 2026) and the safeguards of the tutor that avoided the drop in the mathematics experiment (116, Bastani et al., 2025).
  3. Give manual-form practice on the range. Each apprentice runs at least two S1 scenarios by hand, in their manual form, on the range or in the pre-production mirror, under a mentor, before any pipeline role. S2 and above are shadowed, never run by an apprentice (Chapter 6).
  4. Rotate. One quarter in detection engineering and one in the red team within the first 24 months, with the return trip for operators on the same cycle.
  5. Graduate responsibility. Shadow, then co-author, then author a held-out scenario that goes to the held-out store (Chapter 15), then lead a stop drill (XC-02). Each stage names what the apprentice may and may not do.
  6. Record and review. The mentor and the red-team lead decide whether a stage is complete; no tool decides. An incomplete stage leads to extension and extra mentoring, never to removal. Records hold levels and references only and are agreed with the representatives in advance.
  7. Count the route. Report each quarter, at team level, how many people are on the route, how many competences have a second holder and how many apprentices became operators; review a route with no completions after two years.

Definition of done. Every competence the route must produce has at least two evidenced holders (one may be the mentor), a named place where a junior practises it, and a date on which the route is next reviewed. Adapt the six-month and 24-month defaults to the size of the team and to the works agreement.

Worked example: A learning path at Hansa Mutual

Illustrative example. Hansa Mutual recorded the route as AIDR-0884 on 2028-04-04. The first holder of the rotation seat is a detection engineer from Lena Vogel's team, from 2028-07-01. The record is kept in version control beside the red team's role charters; it is a development record owned by the apprentice and mentor.

# competence/paths/LP-HM-RED-2028-01.yaml (illustrative)
learning_path:
  id: LP-HM-RED-2028-01
  decision: AIDR-0884            # 2028-04-04; review 2028-10-04
  framework: {id: LOOP-CF, version: "2028.1"}
  owner: red_team_lead           # Mareike Hartmann
  consulted: [head_of_detection_engineering, white_team_lead, konzernbetriebsrat]
  seats: {rotation_seat_red: 1, rotation_seat_detection: 1, per: half_year}
  stages:
    - {n: 1, name: detection_engineering_quarter, produces: [DE-01, DE-03, SD-01]}
    - {n: 2, name: scenario_author,               produces: [SD-02, SD-03], gate: "one held-out scenario accepted"}
    - {n: 3, name: red_rotation_quarter,          produces: [EE-02, XC-02], gate: "two S1 scenarios run by hand, one stop drill led"}
    - {n: 4, name: return_to_detection,           produces: [OA-03, EV-02]}
  attempt_first: {assistant_use_after_attempt_only: true, first_months: 6}
  unassisted_checkpoints:
    - {id: C1, at: stage_1, what: "write a detection test unassisted"}
    - {id: C2, at: stage_2, what: "draft a scenario from an objective unassisted"}
    - {id: C3, at: stage_3, what: "manual-form run on the range"}
    - {id: C4, at: quarterly, what: "unassisted block, ten working days per operator"}
  on_checkpoint_failure: "return to supervised use for one quarter; no effect on pay or appraisal"
  records: {levels_and_references_only: true, not_used_for: [ranking, pay_setting, disciplinary_process]}

Exercises as training

An exercise is where the six areas are shown and also where they are taught. The ECB's purple teaming guidance for TIBER-EU describes purple teaming as a collaborative activity in which the offensive and defensive teams work on particular attack phases, detections and test reports, and states that it is intended to increase the learning experience of the test (34, ECB, 2025). The chapter uses that as the case for protecting sessions from being replaced by dashboards. Four kinds of exercise carry most of the training.

  • The purple session. The session of Chapter 9 trains OA-01, OA-02 and XC-01 for everyone present, and it is where a junior hears the red lead explain why a step was chosen. Three of the five findings of Hansa Mutual's session PRP-HM-2028-01 were ones the pipeline alone had not produced (Chapter 9), which, in the book's illustration and not as independent evidence, shows how a session can teach something the pipeline does not.
  • Unassisted practice. A block of work done without the planner, the curator and the assistants, set per usage mode below, graded for learning by a second person and not reported by name (AI Blue, Chapter 23).
  • The seeded drill. A seeded gap or error (Chapter 15) measures the system and drills the person who has to find it; results are a team catch rate, never a score.
  • The stop and degraded-mode drill. A stop drill (Chapter 6) trains XC-02; a drill in which the pipeline is stopped and the loop continues by hand trains the degraded mode after a stop. A stop in good faith is never a failure of the person.

Across the usage modes

Unassisted practice is set per mode, because each mode removes different practice.

Mode What practice it removes Unassisted practice
Mode 0 Ambient AI Noticing: a vendor's embedded AI shapes what the operator sees without being asked Ask which services embed AI and keep one exercise a year on a copy without it
Mode 1 Conversational assistants The attempt: drafting, planning and explaining Attempt first on a sample of scenario drafts and detection tests; ten per cent of campaigns planned without the assistant
Mode 2 Embedded workplace assistants Reading: the summary replaces the log Read the tagged log before the summary on a sample of runs
Mode 3 Agentic work tools Assembling: the tool drafts and edits files A quarterly task done in a clean workspace without the tool
Mode 4 Built AI applications Choosing and varying: the curator and planner propose A scenario and a variant written without the curator or planner each quarter
Mode 5 Autonomous production agents Running and stopping: the runner executes, the pipeline continues A manual-form run on the range, a stop drill and a day in the degraded mode, once a quarter

Modes 1 to 3 need practice without the assistant. Modes 4 and 5 need practice in the degraded mode after a stop, because the question in those modes is whether people can carry the loop when the system is stopped. The rule that links competence to autonomy is the book's own conclusion, following The Transformed Security Architect, Chapter 15 (92, Nordqvist, 2026) and AI Blue, Chapter 23 (94, Nordqvist, 2026): a class stays at Level 3 Bounded only while the register shows the minimum number of people able to do it by hand. In the loop that means the runner may run S1 scenarios at Level 3 only while at least two operators have shown EE-02 in its unassisted form within the last twelve months. When the count falls below two, the class returns to Level 2 Supervised until it is restored. Hansa Mutual recorded the rule for MND-HM-EMU-01 as AIDR-0885 on 2028-04-11.

Hiring and contracted testers

A team that buys red capability buys the craft along with it, and the competence it needs is the competence to choose and challenge. The ECB's guidance for TIBER-EU gives the most developed public list of what to ask. For the red team provider it asks for at least five references from previous penetration testing and red team assignments, certifications that are appropriate to recognised market standards, professional indemnity insurance that covers misconduct and negligence, capacity to form a red team of at least three people with replacements available, and no previous or current service for the entity that would present a conflict of interest. It asks that the red team test manager have at least five years of experience in penetration testing and red team testing and that other members have at least two (50, ECB, 2025). The guidance also says that the entity should not rely on qualifications and certifications alone and should engage with the red team during procurement to gain insight into the actual knowledge and experience of its staff; it lists questions about a certification, among them whether the exam is proctored, whether it is multiple choice or practical, and whether it lapses (50, ECB, 2025). The guidance concerns threat-led tests of financial entities; other organisations can use it as a baseline.

An organisation like Nordvik Region, which has no red team and a small library, adds to that baseline what the loop needs.

  1. Name the people. The call-off lists the testers who will do the work, with the experience requirement, and a change of tester needs notice.
  2. Declare the AI. The tester declares the AI used in Modes 1 to 3 and the model family, uses no Mode 5 emulation agent against the Region's systems without a signed mandate, and does not draft the Region's detections. Declaration lets the Region know what independence it has (Chapter 15).
  3. Buy novelty. A stated part of each visit is open-ended, with no pre-published scenarios (Chapter 8), and the yield of novel findings per 100 hours is reported.
  4. Buy the school. Pairing days: the Region's staff shadow the tester during fieldwork for a stated number of days, and the tester explains choices. Knowledge transfer is a deliverable with a date.
  5. Keep the evidence. The tester delivers the evidence manifest in a form a person at the Region can reproduce (EV-02), and the scenarios the tester wrote stay with the Region, the held-out ones in its store.
  6. Keep independence of role. The tester does not tune the Region's rules, and the detection owner does not choose the tester's scenarios.
  7. Plan the exit. At the end of the agreement the library, the records and a debrief remain, so that a successor starts from the Region's knowledge.

Nordvik recorded these terms as an annex to NR-2026-071 in AIDR-0834 on 2028-04-04. The test is whether the Region could place the next contract with another firm and lose nothing but a person's habits.

The same questions apply to hiring: ask for demonstrated work and the two-form evidence of the framework, use an exercise in which the candidate writes a scenario from an objective unassisted, and treat a certificate as evidence at Foundation only. The ISC2 study reports skills and budget shortages (99, ISC2, 2025), which is the case for a route that grows its own.

The debate

Whether automated emulation erodes the craft of the adversary's mind is a question on which practitioners disagree and both sides have evidence. The debate is staged in four steps.

The case for concern

The case for concern is that the loop will one day have no one who can think like an adversary. It rests on a mechanism, a set of measurements and an observation about incentives.

The mechanism is the ironies of automation: a system that takes the routine leaves people the hardest residue and removes the practice that would have prepared them for it (100, Bainbridge, 1983). People who rely on automation check less and become complacent (101, Parasuraman & Manzey, 2010). The measurements show the pattern in several fields: detection by endoscopists fell when they worked without an assistant that they had used for a period (115, Budzyń et al., 2025), students who had worked with an unrestricted assistant did worse without it (116, Bastani et al., 2025), and programmers who learned with an assistant understood and debugged less well (117, Shen & Tamkin, 2026).

The incentive observation is specific to the loop. A runner and a curator deliver more scenarios per hour than any operator, so a team measured on scenarios run has every reason to let them, and the junior who would have run known techniques by hand now reads a dashboard. The craft of the adversary's mind is the capacity to find the path nobody listed, and ATT&CK is a catalogue of what has been observed (17, MITRE, n.d.). A loop that practises only the catalogue produces operators fluent in the catalogue. A field that stops making apprentices finds out years later, when the experts retire; AI Threat, Chapter 14, made the same argument for expertise in general (91, Nordqvist, 2026).

The case for calm

The case for calm answers that routine was never the craft. The runs that a pipeline now does were repetitions of known techniques, and the best operators, on the calm reading, learned the adversary's mind from exercises, from mentoring, from reading intelligence and from the stubborn problems of the estate in front of them, not from the thousandth password spray. AI frees the hours for what only people can do: write a novel chain, read the business and judge the consequence. The workplace evidence shows the largest gains for novices (118, Brynjolfsson et al., 2025), so an assistant can bring a junior to competence faster, and the programmers who used it to ask for explanation kept their learning (117, Shen & Tamkin, 2026). The harm in the mathematics experiment was reduced by a tutor designed to preserve the attempt (116, Bastani et al., 2025); it is a design problem with a design answer.

The calm reading adds three points. The measurements concern perceptual detection, school mathematics and a coding task, not the design of an attack path, and the transfer is an assumption. The alternative is not a golden age of apprenticeship: red teams were already small, costly and scarce, and many organisations had no red craft at all. And threat-led testing of financial entities presumes teams of experienced testers (50, ECB, 2025), a demand that keeps the craft alive.

Where the positions meet

Both positions accept that skills erode without practice and that the evidence says so in several fields, even where it has not been measured in red teaming. They agree that routes into the craft must be built on purpose, that novelty is human work and that some work must stay human. They agree that the effect depends on how the assistant is used: attempt first, explanation on request and practice without the assistant protect learning in the studies where they were tried. And they agree that a record of what the team can still do unaided is better than an assumption either way.

What remains in dispute is empirical and local. Whether a loop that automates the routine and keeps a human-led share, a rotation and an unassisted block sustains the capacity for novelty over several years has not been shown in either direction, and the concerned and the calm weigh the missing evidence differently. The concerned ask what is lost if the answer is no, and the calm ask what it costs to protect against a loss that may not occur.

What can be done

  1. Protect a share of unassisted, novel emulation. Keep the human-led share of Chapter 8 (a default of at least 30 per cent of red-team hours) and add a block of unassisted work inside it: ten working days per operator per quarter, with no planner, curator or assistant. Measure the actual share, because a policy that is not measured erodes first. At Nordvik, the equivalent is the open-ended part of each tester visit.
  2. Build the apprenticeship on purpose. Use the practical guide above: attempt first, manual-form practice on the range, rotation in both directions, graduated responsibility and a count of completions.
  3. Record what the team can do. Keep a craft register at team level, with the number of people who have shown each loop competence unaided in the last twelve months, and tie Level 3 for the runner to a minimum count.
  4. Use contracted testers to bring in what the team lacks, and to teach. Write pairing days, declared AI use, named testers and a handover into the contract.
  5. Report for the board. Give the board the competence counts, the human-led share and the novel-finding yield with their dates, not the number of scenarios run.

Verdict

The verdict is the book's own conclusion, drawn from the evidence above.

The evidence does not show that automated emulation erodes the red craft, and it does not show that it does not. It shows that in other fields unaided performance can fall after sustained use of an assistant, that the effect depends on how the assistant is used, and that novices gain most from it. It contains no measurement of red-team operators, scenario authors or detection engineers. The organisation that treats the question as settled either way is acting on an assumption.

What is within the organisation's control is firm. The route to the craft is a design decision that can be made explicit, funded and counted. The conditions that protect learning in the studies can be written into a programme, and the craft can be kept visible by a register and tied to autonomy by the rule that the runner stays at Level 3 only while enough people can do its work by hand.

By stage the labels are these. At P1 Target, that scenario authorship erodes if the curator does the writing is expected; that learners who attempt first keep the skill is observable in the learning studies and not yet measured for scenarios. At P2 Emulate, that unassisted manual-form practice is needed for the degraded mode after a stop is expected; the loss of emulation skill after sustained use of a runner is not measured. At P3 Observe and P4 Improve, that reviewers who read an AI summary or draft before forming their own view check less is observable in studies of automation, and the transfer to correlators and detection drafts is expected. At P5 Verify, reproduction by a person needs a person who can reproduce, which is the point of the register. That organisations will ask for competence records for the loop as a condition of delegating to AI is expected, as a consequence of the competence conditions of AI Governance, Chapter 14 (88, Nordqvist, 2026). That organisations stop making red apprentices, or that human adversary emulation ends, is speculation, and a risk to design against.

Organisations can influence the following: the share of hours protected, the design of the route, the contract with the tester, the register and the rule that ties autonomy to it. They cannot, today, point to a measurement of what automated emulation does to the red craft, and they should say so when they report their competence figures.

Nordvik Region and Hansa Mutual

Nordvik Region has no red apprenticeship and relies on its contracted tester, Elin Berglund. Its decisions are AIDR-0834, the annex to NR-2026-071 with named testers, declared AI use, an open-ended part of each visit, two pairing days for the Region's staff and a handover clause, and AIDR-0835 (2028-04-11), which records LOOP-CF-NR and the competence records of the loop with the union's terms. Its first rung into the loop is detection engineering, the post that one analyst took from 2027-07-01 (AI Blue, AIDR-0719), and its learning path LP-NR-LOOP-2028-01 for the coordinator ends in shadowing the tester through the autumn 2028 run. Its risk is dependence: one tester, one coordinator with several roles, and a team of six that cannot spare an apprentice. The Region buys the red competences and keeps the ability to read them.

Hansa Mutual's red team of five, with Mareike Hartmann as lead, protects 30 per cent of its hours for human-led emulation and measured 26 per cent in the first quarter of 2028; the difference was pipeline maintenance after the mandates were adopted on 2028-02-15, and the red-team lead reported it as a finding, not a failing. AIDR-0884 adds the ten-day unassisted block per operator per quarter from the second quarter, the rotation seat and the learning path LP-HM-RED-2028-01. AIDR-0885 ties the runner's Level 3 for S1 scenarios to at least two operators who have shown EE-02 unaided in twelve months; at the date of the decision four of the five had. The Konzernbetriebsrat was consulted under KBV-IT-2024-SOC-05. Hansa's risk is the opposite: a fast pipeline that never asks anyone to do the work by hand.

Summary

This chapter defined the competences of the loop and treated the question of where new red operators and detection engineers come from when AI does the routine. Hansa Mutual's framework LOOP-CF has six areas and puts the adversary's mind at an address, SD-03 and EE-03, where it can be evidenced in the assisted and the unassisted form. Competence records CMP-* follow the terms of AI Blue. The craft concerns P1 Target through the writing of scenarios, P2 Emulate through manual-form practice and the stop path, P3 Observe and P4 Improve through reading and review, and P5 Verify through reproduction by a person.

The evidence on skill beside automation is old in theory and recent in measurement, and none of it concerns red teaming. Unaided performance fell after sustained use of an assistant in colonoscopy, school mathematics and a programming study, the effect depended on how the assistant was used, and novices gained most. The debate found common ground in attempt first, protected unassisted work and routes built on purpose. The verdict is that the question of erosion is open and the response is within the organisation's control: a protected human-led share, an apprenticeship route with rotation in both directions, a craft register tied to the runner's level, and contracts that buy teaching with testing.

Chapter 25 takes the outlook: whether red and blue will be separate teams in 2036, which turns on how much of the craft the loop needs people to hold.

Sources

  1. Budzyń, K. et al. (2025). Endoscopist deskilling risk after exposure to artificial intelligence in colonoscopy: a multicentre, observational study. The Lancet Gastroenterology & Hepatology 10(10). (115, Budzyń et al., 2025)
  2. Bastani, H. et al. (2025). Generative AI without guardrails can harm learning: Evidence from high school mathematics. Proceedings of the National Academy of Sciences 122(26). (116, Bastani et al., 2025)
  3. Shen, J. H. & Tamkin, A. (2026). How AI Impacts Skill Formation. arXiv:2601.20245. (117, Shen & Tamkin, 2026)
  4. Brynjolfsson, E., Li, D. & Raymond, L. R. (2025). Generative AI at Work. The Quarterly Journal of Economics 140(2). (118, Brynjolfsson et al., 2025)
  5. European Central Bank (2025). TIBER-EU: Guidance for Service Provider Procurement. (50, ECB, 2025)
  6. European Central Bank (2025). TIBER-EU Purple Teaming Guidance. (34, ECB, 2025)
  7. Bainbridge, L. (1983). Ironies of Automation. Automatica 19(6). (100, Bainbridge, 1983)
  8. Parasuraman, R. & Manzey, D. H. (2010). Complacency and Bias in Human Use of Automation: An Attentional Integration. Human Factors 52(3). (101, Parasuraman & Manzey, 2010)
  9. ISC2 (2025). 2025 Cybersecurity Workforce Study. (99, ISC2, 2025)
  10. European Union Agency for Cybersecurity (2022). European Cybersecurity Skills Framework (ECSF) Role Profiles. (102, ENISA, 2022)
  11. SFIA Foundation (2024). SFIA 9. (103, SFIA Foundation, 2024)
  12. MITRE Corporation. MITRE ATT&CK. (17, MITRE, n.d.)
  13. European Parliament and Council of the European Union. Regulation (EU) 2016/679 (General Data Protection Regulation). (7, European Union, 2016)
  14. Nordqvist, G. (2025). Architecture as Code. The Transformed Architecture, Book 1. (87, Nordqvist, 2025)
  15. Nordqvist, G. (2026). AI Governance. The Transformed Architecture, Book 2. (88, Nordqvist, 2026)
  16. Nordqvist, G. (2026). AI Threat. The Transformed Architecture, Book 5. (91, Nordqvist, 2026)
  17. Nordqvist, G. (2026). The Transformed Security Architect. The Transformed Architecture, Book 6. (92, Nordqvist, 2026)
  18. Nordqvist, G. (2026). AI Boss. The Transformed Architecture, Book 7. (93, Nordqvist, 2026)
  19. Nordqvist, G. (2026). AI Blue. The Transformed Architecture, Book 8. (94, Nordqvist, 2026)
  20. Bundesrepublik Deutschland. Betriebsverfassungsgesetz, § 87. (11, Bundesrepublik Deutschland, n.d.)