The Future of the Loop: Will Red and Blue Be Separate Teams in 2036?

This chapter looks ahead at the loop, with the series' discipline, and asks the question that the book has so far kept at arm's length: will the red team and the blue team still be separate in 2036, or will emulation, detection engineering and the rest of the loop become one engineering practice? It concerns all five stages of the purple loop, P1 Target, P2 Emulate, P3 Observe, P4 Improve and P5 Verify, because each is a candidate for automation, for merger with a neighbouring stage or for a new kind of separation, and because the answer decides who holds the check at P5 Verify. The chapter treats the outlook as a horizon register, stages the debate between concern and calm, and then states the author's own projection, labelled as such, with the evidence that would change it.

Two earlier volumes asked the same kind of question about one side of the table. AI Blue, Chapter 24, asked whether there will be a security operations centre in 2036 and answered that an accountable function able to verify and stop its AI is expected, while its name and shape are speculation (94, Nordqvist, 2026). The Transformed Security Architect, Chapter 23, asked whether there will be a security architect and kept the role wherever accountability for a boundary must be human (92, Nordqvist, 2026). This chapter does not repeat either answer. It asks about the junction between the sides: what happens to the loop when the team that tests and the team that is tested are filled, in part, by systems that resemble one another. It builds on an outlook governed as a horizon register, in which observable trends justify commitment, expected ones preparation and speculative ones reversibility, with the author's judgement kept apart from the findings (AI Governance, Chapters 22 and 24) (88, Nordqvist, 2026), on the finding that small delegations erode skill and memory until the fallback no longer exists (AI Threat, Chapter 26) (91, Nordqvist, 2026) (100, Bainbridge, 1983), and on the independence principle of Chapters 4 and 15.

Three futures for the loop in 2036 (two teams with one loop, one engineering practice, a pipeline with a human verifier), each tagged expected or speculation, all requiring independence to be placed and shown with a date, and a yearly register review.

Figure 25.1: Three futures for the loop in 2036, each tagged observable, expected or speculation, all requiring independence to be placed and shown with a date.

A horizon register for the loop

Ten years is a long horizon, and those best placed to speak about the loop have a stake in the answer. Tetlock's long study of expert forecasts found that experts predicting political and economic outcomes did little better than chance, and that those who combined many small ideas and revised often did better than those who held one big idea (86, Tetlock, 2005). A red-team lead has a reason to believe that human emulation is irreplaceable, a vendor that the pipeline replaces the session, and a chief executive that two teams are one too many. The register makes such interests reviewable. Each trend carries one label, names its stage, points to evidence, states the trigger that would change the posture, and names an owner and a review date. A trend is observable if it is happening now and documented, expected if it is supported by a stated trend or a decided instrument, and speculation if it is plausible but unsupported by present evidence. The posture follows the label: commit to what is observable, prepare for what is expected, and keep reversible what is speculation.

Two features distinguish a register for the loop from the registers of the earlier volumes. First, its triggers can be computed from the loop's own records. The loop already produces dated evidence per technique, seeded-gap results, held-out catch rates and stop-drill times (Chapters 11, 15 and 17), and a trigger such as "the seeded-gap catch rate falls below 0.80" is a measurement and not an opinion. Second, the register is kept by the people who run the loop and approved by someone who does not. A register that only its keepers maintain drifts towards the answer that keeps their post, which is the same reason the loop separates the author of a finding from the owner of its closure (Chapter 4).

What is observable

Observable trends are happening now and are documented. They justify commitment: a decision can be taken on them today.

Machines find and fix software flaws at a pace that people did not. In the final of the DARPA AI Cyber Challenge in August 2025, the competing systems found 54 of the synthetic vulnerabilities in the challenge set, patched 43, needed about 45 minutes on average for a submitted patch, and found 18 real vulnerabilities that the organisers had not injected (70, DARPA, 2025). The result was achieved in competition conditions on prepared code and says nothing about a production estate. It shows that the two halves of P3 Observe and P4 Improve for software, finding and fixing, can be automated further than the first generation of the loop assumed.

Adversaries are moving from prompting to agentic work. Google's threat-intelligence group describes the evolution of adversarial AI use from prompting to autonomy (64, Google GTIG, 2026) and, with Mandiant, the arrival of agentic offensive frameworks (66, Blum et al., 2026). The scarcity that set the rhythm of the annual test is loosening on both sides (AI Red Team, Chapter 12) (90, Nordqvist, 2026) (64, Google GTIG, 2026) (70, DARPA, 2025).

Emulation is already partly continuous. Open libraries of atomic tests and platforms for automated adversary emulation are in use (32, Red Canary, n.d.) (33, MITRE, n.d.). The ECB's purple teaming guidance of January 2025 describes purple teaming as a collaborative activity involving both the red team testers and the blue team within a TIBER-EU test, limited in the testing phase and a standard element of the closure phase (34, ECB, 2025).

Regulation demands testing, and a regulator-led test is separate by design. DORA Article 24(6) requires financial entities other than microenterprises to test, at least yearly, all ICT systems and applications that support critical or important functions, and Article 24(5) requires procedures to prioritise, classify and remedy the issues the tests reveal (2, European Union, 2022). Article 26(1) requires entities identified under the Regulation to carry out threat-led penetration testing at least every three years, Article 26(2) requires the test to be performed on live production systems supporting critical or important functions, and Article 26(8) requires testers that meet Article 27, with external testers contracted at least every third test where internal testers are used. The detailed requirements are in Commission Delegated Regulation (EU) 2025/1190 (8, European Commission, 2025). NIS 2 Article 21(2), point (f), requires policies and procedures to assess the effectiveness of cybersecurity risk-management measures, and Article 20(1) places approval and oversight with the management body (3, European Union, 2022). The architectural implication is that, for a financial entity in scope, a degree of separation between tester and tested is a decided feature of the instrument today.

Correlated errors between models are measured. Kim and colleagues, studying more than 350 models, report that models agree about 60 per cent of the time on one leaderboard when both are wrong, and that larger, more accurate models have highly correlated errors even across architectures and providers (104, Kim et al., 2025). Evaluators have been found to recognise and favour their own generations (106, Panickssery et al., 2024), and models often distinguish an evaluation from a deployment (105, Needham et al., 2025). These studies measured models on benchmarks and in evaluation settings. Their meaning for a detection pipeline is the inference of Chapter 15, and it is an inference.

Automation complacency is documented, across domains and for reviewers of automated output (101, Parasuraman & Manzey, 2010) (100, Bainbridge, 1983), and the shortage of staff is reported by ISC2's 2025 workforce study, an online survey of 16,029 practitioners and decision-makers (99, ISC2, 2025). Chapter 24 takes up what both mean for the craft.

What is expected

Expected trends rest on a stated trend or a decided instrument, but their timing is uncertain. They justify preparation: decisions that cost little now and save a great deal if the trend arrives.

Continuous verification becomes the normal case for priority techniques. Where emulation costs little and exploitation windows are measured in days, the quarterly rhythm cannot remain the only evidence that a priority technique is still detected (Chapters 8 and 11). The Delegated Regulation's attention to closure and remediation points the same way for the entities it covers (8, European Commission, 2025). Expected.

Adversary AI tests defences continuously. The NCSC's assessment to 2027 expects AI to make elements of intrusion more effective and efficient and to increase the frequency and intensity of cyber threats (52, NCSC, 2025), and the trend reports cited above describe the direction (65, Grunewald et al., 2026). Boards will compare the loop's evidence with an adversary who tests every day. Expected, as the assessment's forecast, with timing uncertain.

Regulation tightens the evidence, not the tool. DORA and NIS 2 are written in terms of testing, effectiveness and closure, and their supervisors can be expected to ask for dated evidence of what was tested and with what result. Expected; the instruments are decided, the supervisory practice is not yet visible.

Loop work shifts to review. If the pipeline keeps producing findings and drafts at the rate of Chapters 8, 10 and 14, the bottleneck moves from authoring to verification, as it did for the architect (The Transformed Security Architect, Chapter 14) (92, Nordqvist, 2026). Expected.

Smaller organisations buy the loop. Nordvik Region's position, no red team, a contracted tester and a provider whose AI acts out of hours, is common among authorities and mid-sized enterprises. Expected, on the resource position that ISC2 reports (99, ISC2, 2025).

What is speculation

Speculation is plausible but unsupported by present evidence. It justifies keeping a decision reversible, and the loop's most consequential speculations are the ones that would remove a safeguard.

A self-improving defence with no review. A pipeline in which an emulation agent finds a gap, a drafting agent writes the detection, a re-test agent confirms it and the change is merged without a person is describable. Chapter 4 caps merging at Level 2 and leaves closure to a person's signature, and Chapter 15 gives the reason. No outcome evidence shows that such a loop does better than one with a reviewer, and the correlated-error research is a reason to doubt it. Speculation.

The independence assumption collapses. If the major model families converge in what they know, a second family as critic buys less independence, and machine-written held-out scenarios stop being held out in any useful sense. The research measures a correlation that rises with capability, which is a reason to take the possibility seriously, but not evidence that it reaches the level at which separation is useless. Speculation, with a design consequence taken up in the verdict.

A vendor-run loop with no named human decider for a regulated entity would still have to satisfy DORA Article 5 and NIS 2 Article 20 (2, European Union, 2022) (3, European Union, 2022). Speculation, and one the series advises against.

The end of human adversary emulation. That a pipeline can replace the person who invents a technique the library lacks is not shown; Chapter 8 concluded that a protected share of human-led, novel emulation remains. Speculation.

Three futures for 2036

The futures say how the trends could combine. They are devices for thinking and not forecasts, and none carries a probability. Each label names the trend or instrument it rests on.

Future A: two teams, one loop. The red team, or the contracted tester, and the blue team remain separate in reporting line and in budget, and share one pipeline, one scenario repository with access rules, one register and one closure rule. Their separation is a deliberate control and not a legacy. This is Hansa Mutual's shape today, and the regulated testing regime supports it. Its strength is that independence is by position and can be shown in one sentence. Its weakness is cost, and the tendency of two teams to become two audiences for a quarterly session, which Chapter 26 names purple theatre. Label: expected for large regulated groups, on the instruments cited above.

Future B: one engineering practice. Scenario authors, emulation engineers and detection engineers sit in one team that owns the scenario library, the detections and the regression catalogue as code. The strength is speed and the end of the hand-over in which findings age. The weakness is that the author of the test and the author of the detection may be one person or one agent, so the test passes by construction unless independence is rebuilt elsewhere. Label: expected for small teams, where the number of people does not allow two, and speculation for large groups as the default.

Future C: the pipeline with a human verifier. Most of P2 to P5 runs as a pipeline of agents under mandates at Levels 1 to 3, and a small human function does three things: it authors the held-out and novel scenarios, it reproduces a sample of results from the evidence, and it holds the stop and the closure. The function is neither red nor blue by name. It must not become a third team with its own queue and budget, which Chapter 4 warned against: it is the white team, the closure owner and the coordinator of Chapter 4 under one reporting line, outside both the pipeline and the security operations centre. If it grows a queue of its own, Future C has turned into the purple theatre of Chapter 26. Its strength is that it places the scarce human skill where the independence principle needs it. Its weakness is that it depends on an organisation that pays for verification. Label: speculation as the default shape; its parts are observable or expected in the sections above.

Question Future A Future B Future C
Who authors scenarios Red team or tester, with detection engineering reading One practice; human-authored share set by policy A small human function, plus agents' drafts under review
Who writes detections Detection engineering The same practice Agents under mandate, human merge
Where independence lives Between teams Between people and across model families inside the team, and an outside tester Between agents, model families and a human verifier
What the supervisor asks Who is the tester and who reports to whom Who reviews the author, and how is it shown What was reproduced by a person, when
Main risk Two audiences, a late hand-over A test that passes by construction Verification unpaid and eroded

The futures do not differ on whether independence is needed. They differ on where it lives.

The debate

Whether red and blue will be separate teams in 2036 is a question on which serious practitioners disagree. The debate is staged in four steps, as the authoring rule requires.

The case for concern

The case for concern says that convergence removes the thing that makes a test worth believing. A red team is valuable because it is not the author of the defence. Once emulation, detection engineering and the pipeline are one practice, the same people, or the same agents from the same model family, write the attack scenario and the detection that catches it, and a green result then says that the practice agrees with itself. The evidence for taking this seriously is not speculative. Errors of models correlate, more so between more capable models (104, Kim et al., 2025); evaluators favour their own family's output (106, Panickssery et al., 2024); and models can often tell a test from the real thing (105, Needham et al., 2025). Incentives add to this: a team measured on closing findings will close findings, and a measure that becomes a target ceases to be a good measure (Chapter 18 explains the mechanism) (80, Strathern, 1997). The regulated testing regime reflects an older version of the worry, which is why DORA requires external testers at intervals even where internal testers are used (2, European Union, 2022). Those who hold this position conclude that the separation is not an accident that abundance can undo. It is the cheapest independence organisations have, and dissolving it to save a second team is how a loop that reports success is built.

The case for calm

The case for calm answers that the separation was an accident of scarcity. Red teams and detection teams were separate because adversary emulation took rare skills and rare hours, and the annual test and the quarterly session were the forms that scarcity took. Where AI makes emulation cheap and continuous, the hand-over between the teams becomes the slowest part of the loop: a part of the median of 19 days from finding to control at Hansa Mutual (BTP-HM-2027-Q3) may be hand-over; the book has no measurement of how much, and the first measure to take is the time a finding waits between owners. One engineering practice that owns scenarios, detections and regression tests as code, with strong reviews and independent verification, can be better than two teams that share a quarterly meeting, and those who hold this position argue that small, fast, reviewed changes are the better route to a defence that works. Independence does not need a separate reporting line. It can be built from properties the loop can measure: a second model family as critic, held-out scenarios, seeded gaps and reproduction by a person (Chapter 15). A separate team does not by itself guarantee any of them, because two teams that use the same assistant and the same library are correlated in exactly the way the concerned fear. And the regulated tests that need an external tester can keep one.

Where the positions meet

Both positions accept the following. Independence must exist somewhere, whether between teams, between models or between a person and a pipeline, and it must be shown, with a date, for each claim that matters. Mechanical regression, such as the replay of a catalogued scenario and the observation of whether an alert fires, is independent of model judgement and is properly automated. Human-authored novelty has to stay in the loop, since variation within what a model family knows does not test what it does not know. Handing a finding from one function to another is where findings age, so the hand-over is the first thing to engineer away. And the regulated external test is a fixed point: for entities in scope of Article 26 of DORA, a tester that is not the tested entity's own team will be part of the loop in 2036 if the instrument stands (2, European Union, 2022).

The disagreement that remains is one of proportion and of evidence. The concerned ask how much separation is the minimum, and the calm ask what the separation costs and whether it buys independence that the loop could measure instead. Neither side has multi-year outcome evidence from independent tests comparing a converged practice with a separated one, and that evidence will not arrive unless loops are measured to produce it.

What can be done

Decide where independence lives and write it down, in the independence statement of Chapter 15 and in the delegation profile of Chapter 4, so that a change in the organisation chart cannot silently remove it. For CISOs: do not merge red and detection engineering without moving independence somewhere else, and do not keep them separate without checking that the separation yields independence; the seeded gap is the test. For red-team leads and testers: author the held-out set by hand and keep it out of reach of the detection side, whatever the reporting line. For SOC leads and detection engineers: draft from the technique and the telemetry, not from the scenario. For boards and audit committees: ask what a person reproduced and when, before accepting a coverage figure. For employee representatives: agree early how roles change, because a merger of functions is a change in work (Chapter 21). Keep the choice reversible: do not remove the capacity to run a human-led exercise or to bring in an external tester until the register shows that the replacement works.

Verdict

The verdict separates three questions that the title runs together. Whether independence between the side that tests and the side that is tested is needed in 2036 is expected, resting on the testing regime in force, the duties of management bodies and the observable correlation research. Whether that independence is provided by two teams, one practice with controls or a pipeline with a human verifier is speculation for most organisations, and a question about names and reporting lines. For a financial entity within Article 26 of DORA an external tester is expected to remain, because the instrument says so. Whether an organisation still has people who can author a held-out scenario and reproduce a result is decided now, and it is the part leaders can influence.

By stage: at P1 Target the priority list remains a human decision (expected), with agents drafting candidates. At P2 Emulate continuous emulation of catalogued scenarios is observable, its extension to variation expected, and the stop path outside the system holds in every future. At P3 Observe correlation by an agent is observable, and classification remains a reviewed step. At P4 Improve drafting is observable and merging without review speculation. At P5 Verify regression by machine is observable, closure on a passing re-test is the rule in every future, and human reproduction of a sample is the safeguard no future here removes.

The author's projection

This section is the author's judgement. It goes beyond the evidence of the preceding chapters, it is the part of the book most likely to be wrong, and it is written to be falsified. Each item carries one of the three labels, marked as the author's judgement. Chapter 29 collects the other projections.

My judgement is that by 2036 the red team will survive as a name and a role in large groups and in regulated finance, and that its content will differ from today's in five ways.

  1. Expected (author's judgement; the trend is the move to detection and scenario content as code in Chapters 5 and 11, which is the book's own design and not yet observed outside it): scenarios and detections will live in one repository and be released through one pipeline in most large European organisations that run a loop of their own, and the hand-over as a meeting will give way to the hand-over as a pull request. I hold this with more confidence than the rest.
  2. Expected (author's judgement): the separation of tester from tested will remain where an instrument requires it and as a contractual or positional control elsewhere, because it is the cheapest independence. The argument about names will matter less than the argument about who may close a finding.
  3. Expected (author's judgement): smaller organisations will buy the loop as a service, and providers will differ most in their independence terms: a second model family, held-out scenarios and notice of change.
  4. Speculation (author's judgement): the binding constraint will shift from emulation capacity to verification capacity, and the organisations that do well will have treated the making of verifiers as an architectural problem, with a budget, a route and a test, before the routine work went. If I am wrong, it is more likely in the direction of too little concern, because the erosion Bainbridge described is slow and invisible until it is needed (100, Bainbridge, 1983).
  5. Speculation (author's judgement): a loop that closes findings without a person at any step will be sold as a product and adopted by some. I would advise against it for any claim on which a board or supervisor relies, for the reasons of Chapter 15.

On the question of the title: in 2036 a person should author what is novel, a pipeline should run what is catalogued and reversible, a person other than the author should reproduce a sample of what matters, and a named person should close each finding and hold the stop. Whether they sit in one team or two is the least important of the choices, and the one most likely to be decided by cost.

What would change the view

A projection that cannot be falsified is not worth holding. Each trigger has a threshold and belongs in your own register.

  • Independent outcome evidence for a converged practice. If at least two independent threat-led tests, at different organisations over at least two years, showed a converged practice with independence controls closing as many real gaps as a separated one, I would regard separation as a cost that can be dropped more often than I have judged.
  • A measured end to the correlation. If your seeded-gap results showed a second model family catching at least 0.90 of the gaps the first family's critic missed, across four quarters, I would take the collapse of independence to be less likely than I have judged; if its catch rate fell towards the first's, more likely.
  • A legal change. If an amendment or supervisory statement under DORA or NIS 2 allowed the testing duty to be met by an automated process with no external tester, my view of the separation that stays would need rewriting. I see no sign of it.
  • A route to the craft without routine work. If two organisations showed emulation engineers reaching the standard of Chapter 24 within five years without routine emulation work, I would worry less about the entry route.
  • Adversary speed no human step can fit. If your median time from a technique's appearance in intelligence to a passing re-test were shorter than your human approval time for two consecutive quarters, I would expect more of P1 to P5 to move to Level 3 Bounded for catalogued classes, and not to Level 4 for any excluded class.

Keeping a register in practice

Practical guide: Keeping a horizon register for the loop

Purpose. Hold the organisation's view of the future of its loop in a form that can be wrong in a reviewable way, and tie each trend to a decision.

Roles. The purple-team coordinator keeps the register. The CISO approves it. The red-team lead or the contracted tester, the detection owner, the white-team lead, internal audit and the employee representatives are consulted, because the register touches roles.

Steps.

  1. List the trends that bear on the loop: at most eight for a small team and fifteen for a large one, including at least one that would be bad news for the plan.
  2. Label each trend and write evidence a reader can look up. A trend without evidence is speculation. Name its stages by the exact names.
  3. Write a trigger for each trend, drawn from the loop's own records where possible, with a threshold and a direction: seeded-gap catch rate, held-out catch rate, age of evidence for priority techniques, stop-drill time, median days from finding to verified control.
  4. Set a posture by label (commit, prepare, keep reversible) and write down what keeping reversible means, such as the retained ability to run a human-led exercise or bring in an external tester.
  5. Record the register in an AI Decision Record with an owner and a review date: every six months in the first year, then yearly, and at once when a trigger fires.
  6. Consult the employee representatives before adoption if a trend or posture touches roles, as a merger of red and detection work would. Results about people are reported in aggregate only.
  7. At each review, record which trends were right and which wrong, and change a label only with evidence.

Definition of done. Every trend has a label, a stage, evidence, a trigger, a posture and an owner; the register has a review date in the diary; the CISO has approved it and the employee representatives have seen it; and the last review recorded at least one trend whose label changed or was confirmed by evidence.

Adapt the length to the team: a register nobody can act on is a document about the future and not a tool.

Worked example: Horizon register HZN-NR-PL-01 (illustrative)

Nordvik Region's register is adopted under AIDR-0837 and is short, because a team of six, one purple-team coordinator among them and a contracted tester, cannot act on more. Its subject is the one decision that the Region's position makes real: whether the detection owner's role, now one person's several duties, becomes a single detection-and-emulation engineering role while the red function stays with the tester.

register: HZN-NR-PL-01
decision: AIDR-0837
owner: ROLE-NR-SEC-DET
approved_by: CISO
scope: Nordvik's own loop records; shows the mechanism, not the industry (labels refer to the Region's records, not to industry evidence)
written: 2028-04-24
next_review: 2028-10-23
trends:
  - id: NR-T1
    label: observable
    stages: [P2, P5]
    statement: The tester runs 13 catalogued scenarios twice a year; no emulation between visits
    evidence: SCN-NR-0001..0013; call-off NR-2026-071
    trigger: any priority technique with no result younger than 180 days
    posture: commit
  - id: NR-T2
    label: expected
    stages: [P1, P4]
    statement: One role combines detection ownership and scenario curation
    evidence: ROLE-NR-SEC-DET; DLG-NR-LOOP-01
    trigger: held-out scenario SCN-NR-0011 no longer written by the tester
    posture: prepare
  - id: NR-T3
    label: expected
    stages: [P3, P5]
    statement: The provider offers closure as a service; independence terms decide its value
    evidence: annex MS-2, MS-2-IND-1 and -2 (AIDR-0806)
    trigger: a model change without 20 working days' notice
    posture: prepare
  - id: NR-T4
    label: speculation
    stages: [P2, P5]
    statement: A shared sector emulation service replaces the Region's two catalogue runs
    evidence: none for the Region; no offer received
    trigger: a service offering held-out scenarios and a stop path outside the provider
    posture: keep reversible
reversibility:
  - keep call-off NR-2026-071 test rights through 2028-11-30
  - keep the tester external while NR-T2 is prepared

A small organisation can accept convergence inside the Region and keep independence outside it: the one role may curate scenarios and own detections because the held-out scenario and the human-led run stay with the tester. The trigger on SCN-NR-0011 would change the posture, and the reversibility block names what is not given up.

Worked example: Horizon register HZN-HM-PL-01 (illustrative)

Hansa Mutual's register is adopted under AIDR-0887 and is wider, because Hansa is closer to Future C in its tooling and closer to Future A in its organisation. Each trigger ties to a number that already exists in the loop's records. The values below are those of the first quarter of 2028.

register: HZN-HM-PL-01
decision: AIDR-0887
owner: purple-team coordinator (role fixed in Chapter 19)
approved_by: group CISO
consulted: [Konzernbetriebsrat, internal audit, white-team lead]
written: 2028-04-24
next_review: 2028-10-23
trends:
  - id: HM-T1
    label: observable
    stages: [P2, P5]
    statement: HM-SEC-004 exercises priority techniques on a rolling schedule
    evidence: 31 of 34 priority techniques within 30 days, 2028-Q1
    trigger: fewer than 28 of 34 within 30 days for a quarter
    posture: commit
  - id: HM-T2
    label: observable
    stages: [P3, P4]
    statement: Detections generalise less well to held-out variants than to known forms
    evidence: 37 of 41 known-form (90 per cent); 10 of 14 held-out (71 per cent)
    trigger: generalisation gap above 10 points (AIDR-0889)
    posture: commit
  - id: HM-T3
    label: expected
    stages: [P1, P3, P4, P5]
    statement: Planner and drafter share a model family; a second family is needed on critics
    evidence: IND-HM-2028-Q1 (AIDR-0856); SGP-HM-2028-003 found in 4 days
    trigger: seeded-gap catch below 0.8 (DLG-HM-LOOP-01 freeze rule)
    posture: prepare
  - id: HM-T4
    label: expected
    stages: [P5]
    statement: Red team and detection engineering share one repository; the two teams stay separate
    evidence: scenario library SCN-HM-0001..0087; quarterly sessions
    trigger: fewer than 25 of 34 priority techniques verified (BTP-HM-2027-Q3 baseline)
    posture: prepare
  - id: HM-T5
    label: speculation
    stages: [P1, P2, P3, P4, P5]
    statement: One engineering practice replaces red team and detection engineering
    evidence: none; no outcome evidence on either shape
    trigger: two independent threat-led tests showing equal gap closure
    posture: keep reversible
reversibility:
  - keep the human-led quarterly session (PRP-HM-2028-*) and the annual threat-led exercise
  - keep the red team's authorship of the held-out set

The trigger on HM-T2 has already fired: the gap is 19 points, and H3 of Chapter 28 is the response. Hansa's register will not decide the question of the title on opinion: it names the measurements that would change its mind and keeps the human-led session and the red team's authorship of the held-out set until they do. It was consulted on with the Konzernbetriebsrat before adoption, because it touches the work of the red team and of detection engineering.

Across the usage modes

The futures differ by mode, because the mode decides whose identity acts and whether anyone watched it act. The table states where the question moves.

Mode What changes in the loop by 2036 Where independence is needed Label
Mode 0 Ambient AI Provider AI in detection tooling changes behaviour with a model update the loop did not see A seeded test after every notified or unnotified change Observable
Mode 1 Conversational assistants Assistants draft scenarios and read findings Authorship: the person who authors the held-out set does not use the detection side's assistant Observable
Mode 2 Embedded workplace assistants Drafts appear in the ticket and pull-request tools of both teams Review that can fail, with seeded errors Observable
Mode 3 Agentic work tools A planner or drafter acts inside a person's session The person's reproduction of a sample Expected
Mode 4 Built AI applications Curator, correlator and critic are applications under mandate A second model family on the critic Expected
Mode 5 Autonomous production agents Runner and re-test runner act with identities of their own A stop path outside the runner, and drilled Expected for S1, speculation beyond

In Modes 4 and 5 the question moves from who runs the test to who verifies it, which is why Future C puts a human function at the verification step.

Across the degrees of delegation

The table states, per stage, the degree of delegation in the book's worked examples, the author's expectation for 2036 and the speculation. No entry reaches Level 4 for an emulation action that is irreversible, that leaves the signed scope, that touches personal data beyond what the exercise is authorised to touch or that targets a named person.

Stage Illustrative now (worked examples) Expected (author's judgement) Speculation
P1 Target Level 1 Assisted for candidates; Level 2 Supervised for the priority list Level 2 Supervised for routine re-ranking Level 3 Bounded for adding techniques without review
P2 Emulate Level 3 Bounded for catalogued S1 inside the signed scope Level 3 Bounded for variants of catalogued scenarios, S1 only Level 4 Autonomous for any action in the four excluded classes (ruled out by the series)
P3 Observe Level 1 Assisted for correlation; Level 2 Supervised for raising findings Level 2 Supervised for classification of routine outcomes Findings raised and closed without a person
P4 Improve Level 1 Assisted for drafts; Level 2 Supervised for merge Level 2 Supervised for low-risk rule changes Level 3 Bounded for merges without review
P5 Verify Level 3 Bounded for a passing codified re-test of a catalogued scenario Level 3 Bounded for more classes where the seeded catch holds Closure without a person's reproduction of any sample

The first column describes the two worked organisations and not what is observable in the industry; the others are the author's expectation, not recommendations. What people can influence is review capacity at P4, the human-authored share at P1, the drilled stop at P2 and the rule that a finding closes only when its re-test passes at P5.

Nordvik Region and Hansa Mutual

The two organisations face the question from different positions, and their registers differ. Nordvik Region buys the loop, and its leverage is the contract. Its plan is not two teams but a single detection-and-emulation engineering role inside the Region, with the human-led and held-out work kept with the contracted tester. HZN-NR-PL-01 (AIDR-0837) treats convergence as a decision for the inside of the Region and independence as a matter for the contract; its exposure is a loop that stops after the first report, and its triggers are the age of evidence for the priority techniques, the authorship of SCN-NR-0011 and the notice terms of annex MS-2.

Hansa Mutual runs the loop, and its leverage is the pipeline. Its plan keeps red and blue separate, on a shared pipeline and one repository, with a purple-team coordinator whose role Chapter 19 fixes. HZN-HM-PL-01 (AIDR-0887) ties each trend to a number that already exists: the generalisation gap of 19 points, the seeded-gap catch and the 25 of 34 priority techniques verified at the start. Its exposure is a loop that runs without anyone questioning it, and its reversibility block keeps the human-led session and the red team's authorship of the held-out set until the evidence says otherwise.

Nordvik has too few people for two functions and keeps independence in the contract; Hansa has the people for two and keeps it by position and by test. Both place the choice in a record, with a trigger and a date.

Summary

This chapter treated the future of the loop as a horizon register in which every trend carries a label, a stage, evidence, a trigger, a posture and an owner. It concerned all five stages, P1 Target, P2 Emulate, P3 Observe, P4 Improve and P5 Verify. Observable are automated finding and fixing of flaws in competition conditions, adversaries' move towards agentic work, partly continuous emulation, the testing duties of DORA and NIS 2 and measured correlation of model errors. Expected are continuous verification for priority techniques, pressure from adversary AI, regulatory attention to evidence, a shift of work to review and the purchase of the loop by smaller organisations. Speculation are a self-improving defence without review, the collapse of the independence assumption, a vendor-run loop with no named human decider and the end of human emulation.

Three futures for 2036 were set out: two teams with one loop, one engineering practice, and a pipeline with a human verifier. They differ on where independence lives and agree that it is needed. The debate gave concern the argument that separation is the cheapest independence, and calm the argument that separation was an accident of scarcity whose hand-over now slows the loop. The positions meet on independence somewhere and shown, automated mechanical regression, human-authored novelty and the external test in regulated finance. The verdict separated whether independence is needed (expected) from how it is provided (speculation), and the author's projection came with five thresholds that would change it.

The practical outcome is a register. Nordvik Region's HZN-NR-PL-01 and Hansa Mutual's HZN-HM-PL-01 show how an organisation that buys the loop and one that runs it write theirs. The reader's next step is to write one, put its first review date in the diary and share the draft with the people it describes. Chapter 26 turns to the record, with composite case studies and anti-patterns from the first year of the loop, and Chapter 29 gives the author's concluding judgement on the whole book.

Sources

  1. European Parliament and Council of the European Union. Regulation (EU) 2022/2554 on digital operational resilience for the financial sector (DORA). Official Journal of the European Union, 27 December 2022. (2, European Union, 2022)
  2. European Parliament and Council of the European Union. Directive (EU) 2022/2555 on measures for a high common level of cybersecurity across the Union (NIS 2 Directive). (3, European Union, 2022)
  3. Google Threat Intelligence Group (2026). GTIG AI Threat Tracker: From Prompting to Autonomy, The Evolution of Adversarial AI. Google Cloud Blog, 8 September 2026. (64, Google GTIG, 2026)
  4. Grunewald, R., Mazumdar, S. & Vanderlee, K. (2026). Vulnerability Discovery and Exploitation Trends in the AI Era. (65, Grunewald et al., 2026)
  5. Blum, Mainor, Nambiar et al. (2026). ARTEX and Friends: Enter Agentic Offensive Frameworks. (66, Blum et al., 2026)
  6. National Cyber Security Centre (2025). Impact of AI on cyber threat from now to 2027. (52, NCSC, 2025)
  7. Nordqvist, G. (2026). AI Governance: Governing Artificial Intelligence in European Enterprises and Public Authorities. (88, Nordqvist, 2026)
  8. Nordqvist, G. (2026). AI Red Team: AI as an Active Part of Cyber Defence in European Enterprises and Public Authorities. (90, Nordqvist, 2026)
  9. Nordqvist, G. (2026). AI Threat: Are the Dystopias Coming True? Evidence, Risk and Response for European Enterprises and Public Authorities. (91, Nordqvist, 2026)
  10. Nordqvist, G. (2026). The Transformed Security Architect: Role, Craft and Career in the Age of AI in European Enterprises and Public Authorities. (92, Nordqvist, 2026)
  11. Nordqvist, G. (2026). AI Blue: How Artificial Intelligence Transforms the Blue Team in European Enterprises and Public Authorities. (94, Nordqvist, 2026)
  12. ISC2 (2025). 2025 Cybersecurity Workforce Study. (99, ISC2, 2025)
  13. Parasuraman, R. & Manzey, D. H. (2010). Complacency and Bias in Human Use of Automation: An Attentional Integration. Human Factors 52(3). (101, Parasuraman & Manzey, 2010)
  14. Bainbridge, L. (1983). Ironies of Automation. Automatica 19(6). (100, Bainbridge, 1983)
  15. Red Canary. Atomic Red Team: a library of tests mapped to the MITRE ATT&CK framework. (32, Red Canary, n.d.)
  16. MITRE Corporation. MITRE Caldera: a platform for automating adversary emulation. (33, MITRE, n.d.)
  17. European Central Bank (2025). TIBER-EU Purple Teaming Guidance. (34, ECB, 2025)
  18. European Commission (2025). Commission Delegated Regulation (EU) 2025/1190 supplementing Regulation (EU) 2022/2554 as regards regulatory technical standards on threat-led penetration testing. (8, European Commission, 2025)
  19. Strathern, M. (1997). 'Improving ratings': audit in the British University system. European Review 5(3). (80, Strathern, 1997)
  20. Kim, E., Garg, A., Peng, K. & Garg, N. (2025). Correlated Errors in Large Language Models. ICML 2025. (104, Kim et al., 2025)
  21. Needham, J. et al. (2025). Large Language Models Often Know When They Are Being Evaluated. (105, Needham et al., 2025)
  22. Panickssery, A., Bowman, S. R. & Feng, S. (2024). LLM Evaluators Recognize and Favor Their Own Generations. (106, Panickssery et al., 2024)
  23. Defense Advanced Research Projects Agency (2025). AI Cyber Challenge marks pivotal inflection point for cyber defense. (70, DARPA, 2025)
  24. Tetlock, P. E. (2005). Expert Political Judgment: How Good Is It? How Can We Know? Princeton University Press. (86, Tetlock, 2005)