A Year in the Loop: Nordvik Region and Hansa Mutual

This chapter follows four people through the year in which the two organisations of this book first run the purple loop as a practice and not as an occasional event. The year is defined here as the twelve months to 2028-04-30: eight months of background from May to December 2027, told briefly from the facts earlier chapters established, and the four months from January to April 2028 that the chapter narrates in detail. The four people are Karin Lund, detection owner and purple-team coordinator at Nordvik Region; Elin Berglund, the principal consultant who tests for the Region under its call-off agreement; Lena Vogel, who leads detection engineering at Hansa Mutual; and Mareike Hartmann, who heads Hansa's group red team. It tells the year as a sequence of dated decisions, records and measures, and it shows all five stages of the loop at work: P1 Target, P2 Emulate, P3 Observe, P4 Improve and P5 Verify. Every event is tied to an identifier and to the stage it shows. The chapter adds no method. It shows what the methods of Chapters 4 to 26 look like when they meet a calendar, a contract, a works agreement and a budget, includes a failure at each organisation and the recovery that followed, because a year without a failure would have tested nothing, and ends with a practical guide and a worked example that turn the year into an annual calendar.

Illustrative fiction. This book is written in November 2026. Every person, date, figure and record in this chapter that falls in 2027 or 2028 is invented to show the book's design at work, and agrees with the profile of the two organisations used throughout. None of it reports events or forecasts them. The four people, the two organisations and every number are fictional. Where the chapter looks past 30 April 2028, it describes plans, and labels them as plans.

Key dated events of the year for Nordvik Region and Hansa Mutual: a failure, a recovery and a report for each. The full list of events is in the table below.

Figure 27.1: A year in the loop: the dated failures, recoveries and reports of two organisations.

Organisation Date Event Stage
Nordvik Region 19 January Hours variant fails P5 Verify
Nordvik Region 9 February All variants pass P5 Verify
Nordvik Region 28 March Session and FND-NR-2028-003 P3 Observe
Nordvik Region 26 April Coverage page P3 Observe
Nordvik Region 29 April AIDR-0841 report P1 Target
Nordvik Region Autumn 2028 Planned run P2 Emulate
Hansa Mutual 24 January Restraint failure P3 Observe
Hansa Mutual 22 February Independence re-test P5 Verify
Hansa Mutual 9 March Session PRP-HM-2028-01 P3 Observe
Hansa Mutual 31 March 27 of 34 P5 Verify
Hansa Mutual 28 April AIDR-0891 report P1 Target
Hansa Mutual To 22 May Statement valid, then renewed P5 Verify

May to December 2027: the background

The eight months before the questions arrived matter to what follows, so they are told here from facts that earlier chapters established.

At Nordvik the spring fieldwork under RoE-NR-2027-001 (EMU-NR-2027-01, 2027-03-08 to 2027-04-02) was the last time T1486 and T1190 were exercised in the mirror. From 2027-06-07 to 2027-06-11 the Region ran its first test that involved staff, a deepfake of payment approvals in the finance unit (RoE-NR-2027-002, 23 participants, notice EIN-NR-2027-002 sent on 2027-05-24, GDPR Article 6(1)(e) as the legal basis), reported in aggregate only (Chapter 23). On 2027-07-01 Karin Lund took up the detection-owner post ROLE-NR-SEC-DET. The autumn run needed its own authority: version 1.3.0 of RoE-NR-2027-001, approved on 2027-10-05, set the window and added the scenarios SCN-NR-0001, -0007 and -0011. The stop drill followed on 2027-10-07, Karin sealed the expectation sheet on 2027-10-08, and EMU-NR-2027-02 ran from 2027-10-11 to 2027-10-22. In the session PRP-NR-2027-02 of 2027-10-20 the scenario SCN-NR-0001 was walked through six steps. The spray was detected by DET-NR-0001, the successful sign-in raised the alert ALR-0912 at 02:17, and the provider's AI closed it as low severity at 02:21. That became finding FND-NR-2027-011, and its regression case REG-NR-0004 passed its base form on 2027-11-17, six minutes from the first failed sign-in to detection.

At Hansa the tabletop TTX-HM-2027-Q3-01 of 2027-07-13 tested the SOC's decision rights and found a decision acknowledged in 18 minutes against a target of 10. The third-quarter heat map BTP-HM-2027-Q3 (AIDR-0778) showed 25 of 34 priority techniques verified and a median of 19 days from finding to control. The nine that were not split into four with evidence past its expiry, three that had failed a re-test and two never tested, T1486 and T1490, which cannot run in production in a reversible form. After the stop drill of 2027-09-16 came wave two of the threat-led test, EMU-HM-2027-02, from 2027-09-20 to 2027-10-01: the runner was allowed one calibration scenario of safety class S1 on the first day, the planner proposed six variants and the lead accepted two, and the results went to the session PRP-HM-2027-04. On 2027-12-15 both organisations took part in the final tests of AI Blue (AIDR-0737 and AIDR-0794), and the loop of this book starts from where those tests ended.

The starting position in January 2028

The two organisations ended 2027 with different problems and received almost the same question in the same January.

Nordvik Region buys the loop. It has no red team of its own. Elin Berglund's firm tests under the call-off agreement NR-2026-071, which gives the Region test rights, a rules-of-engagement template, data-handling terms and a clause that the firm declares any AI it uses. The managed security service provider that watches the Region's systems out of hours works under framework agreement NR-2025-044, whose annex MS-1 covers detection content and annex MS-2 covers quarterly sampling and five seeded incidents per class per quarter. Karin Lund owns the Region's detection records (ROLE-NR-SEC-DET, closure accountable) and, as a fraction of her duties, coordinates the loop. The library holds 12 scenarios, SCN-NR-0001 to SCN-NR-0012, for a priority list of nine techniques. The unit is six analysts in office hours, and there is no slack.

Hansa Mutual runs the loop. A group red team of five, a detection-engineering team of four under Lena Vogel and a group SOC of about 38 share a library of 86 scenarios, and a pipeline, HM-SEC-004, runs the benign ones across the estate on a schedule. Quarterly sessions under RoE-HM-2027-PURPLE close findings into the regression catalogues.

The questions came a week apart. On 2028-01-11 the audit committee asked the Region's CISO what the first threat-led exercise had proved, beyond a list of closed findings (AIDR-0800). On 2028-01-18 Hansa's executive board asked the group CISO whether continuous automated red teaming makes the quarterly purple session redundant (AIDR-0850). Both asked for a first report by 2028-04-30.

January: the first failure at Nordvik, the second at Hansa

P5 Verify at Nordvik. On 2028-01-19 Elin Berglund ran the variants of REG-NR-0004 as scheduled. The base form still passed. The hours variant v3-hours, the same spray at a time when only the provider is watching, did not: it took 41 minutes to reach a detection that the base form reached in six. The finding closed in November was open again, as FND-NR-2028-002. What troubled Karin Lund was that the finding had been closed on 2027-11-17 on the strength of a base form that tested the best case. Chapter 11 explains the design of variants. Her note in the register was short: a closure that holds in the afternoon and fails at night is a closure for the afternoon.

The next day the same weakness appeared in a different place. P3 Observe is the stage where a result is compared with what was expected, and on 2028-01-20 the draft pack for the audit committee reached her desk. It said that nine of nine priority techniques were mapped to a detection. The statement was true and said nothing about testing. Seven of the nine had something behind them: a result inside the 180-day expiry for five and the provider's runbook statement under MS-1 for two. The other two, T1486 and T1190, had last been exercised in the spring 2027 mirror fieldwork, which ended on 2027-04-02. Chapter 26 names this pattern coverage by assertion (AP-NR-LOOP-02, a technique with no result). She asked for the next version to carry, for each technique, the date of the last result and what it was (the format of Chapter 17).

At Hansa the year opened with a failure on the defenders' side of the table. On 2028-01-24 the exercise EMU-HM-2028-03, run by the red team under Mareike Hartmann against the SOC agent HM-SEC-001, used 12 seeds drawn from nine scenarios, three of them held out. One seed produced a restraint failure: the agent executed a session revocation on a service account during a change window (FND-HM-2028-001). In AI Blue the revocation was part of the agent's Level 3 mandate, and the exercise existed to find out whether that mandate held when a seed pointed at the defender's own automation (94, Nordqvist, 2026). It did not. The level of the session revocation was lowered to 2 the same day, and the mandate MND-HM-SOC-02 was renewed on 2028-02-09 at Level 2. Lena Vogel's team wrote the re-test, REG-HM-0032, which passed on 2028-03-06. On 2028-03-13 the group AI governance board restored Level 3 (AIDR-0863). The finding had been open for 49 days.

This is the first of the chapter's recoveries, and its shape is the shape of the others. A scheduled exercise found the failure; lowering the level was immediate and local; raising it again waited for a re-test and a decision by a body that had not written the mandate. The red team, which found it, did not close it.

February: findings that travel the whole loop

By February both organisations had enough running that the loop could be seen as a loop, a finding passing through every stage and coming back as evidence.

At Hansa the case that Chapter 10 uses ran through the month. P2 Emulate: on 2028-02-06 the pipeline ran SCN-HM-0031, a benign scenario for the addition of an extra credential to a cloud service identity (ATT&CK T1098.001 (17, MITRE, n.d.)). P3 Observe: on 2028-02-09 it became FND-HM-2028-007, routed urgent in AIDR-0855, with a target of 2028-02-23. P4 Improve: the drafting agent HM-SEC-002 wrote a new detection, DET-HM-0612; the critic agent MND-HM-EMU-04, on a second model family, challenged it; Lena Vogel's team merged it on 2028-02-20, retiring DET-HM-0201, and set its alert rate at three a week against a budget of five. The change was in production three days before the target date of 2028-02-23. P5 Verify: REG-HM-0031 with variants -A and -B took over the scenario as a regression case, with a review date of 2028-08-20. The one complication was a child finding, FND-HM-2028-008: the preventive control that should have blocked the action had itself been blocked by a rotation job, ROT-12. The loop had found a control gap beside the detection gap, which a detection-only view would have missed.

The same month tested the independence principle of Chapter 15 on Hansa's own agents, and this is its failure. On 2028-02-15 the group adopted the mandates MND-HM-EMU-01 to -07 and the profile DLG-HM-EMU-01 (AIDR-0854); the first drill of the runner's stop path took 38 seconds against a target of 60. In the curator's first month Mareike Hartmann reviewed 17 drafted scenarios, accepted six, five of them variants, and rejected eleven, seven of them duplicates. One accepted draft, SCN-HM-0087, entered the library. None of the 17 concerned T1486 or T1490, and she noted it: a curator proposes what is near what exists.

Then, on 2028-02-22, the independence statement IND-HM-2028-Q1 (AIDR-0856) reported what the tools of Chapter 15 had found. The planner and the detection drafter shared a vendor and a model family; the critic did not. Of the 25 techniques then counted as verified, seven had both their scenario and their detection from that shared chain. Lena Vogel's team re-tested those seven against held-out scenarios that the chain had not seen. Five passed and two failed (FND-HM-2028-003 and -004). A person reproduced all seven results. The two cells moved to failed, and the verified count went from 25 to 23. Nobody had been negligent: the earlier count had taken the agreement of one lineage for evidence.

At Nordvik February was quieter and, for the loop, more useful. The MS-2 round of 2028-Q1 ran from 2028-02-07 to 2028-02-20 under AIDR-0813: 15 seeded incidents in classes MS2-C1, MS2-C2 and MS2-ISO, derived from SCN-NR-0003, -0007 and -0002 and the isolation playbook PBK-NR-ISOLATE-01. The provider handled 14 correctly. The one escape was a bulk-mail seed in MS2-C1, and it is the reason the coverage record COV-NR-0003 for spearphishing links (T1566.002) would later read failed. On 2028-02-09, during the round, Elin Berglund ran the variants of REG-NR-0004 again. All passed (EVD-NR-2028-0003), the hours variant included, and the evidence carried an expiry of 180 days. The recovery of January's failure took 21 days: a fix, a re-test by someone other than the fixer and a record. In February the contract did its first real work (Chapter 22). Annex MS-2 was extended on 2028-02-15 with two independence clauses, MS-2-IND-1 and -2 (AIDR-0806), and on 2028-03-07 the provider declared its model family, F. The tester's drafting assistant turned out to share it, and the Region accepted that for scenario drafting only.

March: sessions, tabletops and the people who carry them

March was the month in which the loop met people. P3 Observe has a place for it, the purple session of Chapter 9, and both organisations held one.

At Hansa the quarterly session PRP-HM-2028-01 took place on 2028-03-09. It examined 12 priority techniques in 96 tagged steps. The observation correlator (MND-HM-EMU-03, Level 1) proposed a classification for each step. People re-did 24 of them and corrected three, and four wrong joins that the white team had seeded in the correlator's input were all caught. Per technique, the outcomes were: prevented 2, detected 5, alerted but not triaged 1, missed 1 and no telemetry 3. The three no-telemetry steps were three separate facts about the estate: the Swiss audit log was not forwarded pending a transfer decision (T1098.001), the document-store log was kept only seven days at source (T1213), and the identity provider's tier emitted no token-use events (T1550.001). The session raised five findings. Three were findings the pipeline alone had not produced. That sentence answers a good part of the board's question, and Chapter 8 argues why: the pipeline runs known forms often, and the session is where people join what the pipeline found to what the estate cannot see.

Sofia Keller, an investigation lead from the Hamburg SOC, had started a week earlier, on 2028-03-01, as the full-time coordinator of the loop (ROLE-HM-SEC-PRP, AIDR-0871). She sat in the session as the person accountable for the register's age. Chapter 23 describes the post as a role under strain: she was the only person in the building whose job description contained the whole loop. Thomas Brandt, who chairs the group works council, stands at the edge of the work. The standing notice template (ten working days, AIDR-0883) and the yearly notice class for threat-led tests (AIDR-0878, 2028-03-20) were agreed with him, and none of the eight scenarios that involve staff, all in safety class S4, had been run against staff by the end of the quarter. Under clause KBV-IT-2024-SOC-05 results are aggregate only and enter no appraisal.

Two decisions that bound the work of the red team followed from the same month's findings. The profile DLG-HM-LOOP-01 and the decision-rights file DRF-HM-LOOP-01 came into force on 2028-03-15. On 2028-03-22 the tabletop TTX-HM-2028-01 froze the runner in 41 seconds, inside its 60, but it also showed that finding the match for an unexpected event took longer than the 15 minutes the first version of the file allowed. The file was changed to a five-minute match time for pipeline runs (v1.1.0, AIDR-0874, 2028-04-05).

A smaller, sharper event had happened on 2028-03-16. The simulation tool's collector was found to have stored the exercise service account's token in a local log with permissive access (T1552.001), and the finding FND-HM-2028-012 was opened at the handling class FC-4 the same day. The token was rotated that day, the vendor acknowledged the report on 2028-03-20, and the disclosure route was recorded in AIDR-0880 with a rule that the national CSIRT coordinator is brought in after 30 days without an acknowledgement of substance. A tool of the loop had become an exposure, and nothing had been misused.

At Nordvik the month began with a failure that nobody had planned. On 2028-03-02 at 01:30 the stop drill of the provider's AI took 21 minutes against a target of 15. The drill belonged to the MS-2 clauses and the shift lead who holds a stop path out of hours; the Region cannot reach into the provider's platform, and the 21 minutes were the sum of an escalation the Region could see and a revocation it could not. It became a measurement the Region could bring to the provider, which Chapter 22's clause MS-2-TST-1 (AIDR-0829, 2028-03-14) would use. On 2028-03-16 the tabletop TTX-NR-2028-01, facilitated by the Region's AI architect, found three gaps: the ledger of the exercise was not readable in 15 minutes (it took 22), the revocation of the test identity took 190 seconds against the 120 in the charter LOOP-NR-2028-01, and the classification of a lockout was unclear. The revocation was re-tested on 2028-03-17 at 95 seconds. A person had cut the time, and a drill had proved it.

P2 Emulate at Nordvik then ran in the week of 2028-03-20 to 2028-03-24. The campaign EMU-NR-2028-01 under RoE-NR-2028-001 consisted of five atomic tests on a Region-owned test host, run by Elin Berglund by hand: SCN-NR-0001 (T1110.003, expected to meet DET-NR-0001), -0004 (T1059.001) and -0006 (T1053.005), which had no detection, and -0008 (T1087.002) and -0010 (T1021.002), whose outcomes were unknown. On 2028-03-28 the session PRP-NR-2028-01 read the result with Karin Lund, Elin Berglund, two senior analysts and the deputy CISO, who is the Region's white-team lead, in the room. The session charter PSC-NR-2028-01 kept nothing per person. Scenario SCN-NR-0006, the scheduled task, was a declared gap, as everyone had said it would be, and it became FND-NR-2028-003 (AIDR-0805): a new rule, DET-NR-0012, a request to the provider that fell due on 2028-04-18, an injected test due on 2028-05-02 and a regression case, REG-NR-0006. The finding is a clean example of the five states. On the evening of the session it was open. It will be closed and verified only when the injected test passes, because only a passing re-test counts, and the test belongs to the provider's annex, not to the Region's own judgement.

Two further March facts concern Karin Lund herself. On 2028-03-30 she was assessed against the competence CMP-NR-21 during the exercise EX-NR-2028-01. The night stop drill took seven minutes to revoke access, against a target of two. She did not describe it as a failing. It was the number that justified the 5 per cent of protected time in the learning path of Chapter 24, and it was reported to nobody by name, because the union's rule is that results are aggregate. The assessment sat beside a decision made nine days earlier, on 2028-03-21: the deputy CISO countersigns changes that Karin authored (AIDR-0822), because the Region had put too many of the loop's roles in one person and chose to compensate with a second signature. Elin Berglund's part of the compensation was the held-out variant of REG-NR-0004, which she writes and which Karin does not see before the run.

April: what the numbers allow

The last month of the period is a month of writing, and the writing was the test of everything before it.

At Nordvik the coverage page that the audit committee would see was assembled on 2028-04-26 (COV-NR-0001 to -0009, for the priority list PRI-NR-2028-01, first in the report pack under AIDR-0815 on 2028-04-12). It uses three states: tested, asserted by the provider and not tested. Five of the nine techniques had a result inside the 180-day expiry, and two of the five passed. COV-NR-0001 (T1110.003) and -0002 (T1078) were verified on 2028-02-09, with the expiry 2028-08-07. COV-NR-0003 (T1566.002) had failed in the MS-2 round. COV-NR-0004 and -0005 (T1053.005 and T1059.001) had failed in the spring atomic tests, both declared gaps. T1190 and T1486 were not tested; their only evidence was the spring 2027 mirror fieldwork, long expired. Two techniques were asserted by the provider under MS-1, which the Region wanted as injected tests. The oldest passing result was 77 days old, with 103 days left of 180. The January pack had said nine of nine. The April page said two of nine verified, and listed the other seven with the reason, the owner and the date.

At Hansa April was the month in which a number the board valued turned out to be built in the wrong place. The board page LPG-HM-2028-Q1, issued on 2028-04-04 under AIDR-0868, reported the quarter ended 2028-03-31. Of the 34 priority techniques, 27 were verified within expiry, up from 23 on 2028-02-22 after the independence re-test; against the baseline of 25, the net is two. The seven not verified split into three with expired evidence, two failed and two never tested. The oldest passing result was 81 days old, with the expiry at 90, and four results expired within 30 days. The pipeline had run 41 scenarios of safety class S1 on the rolling schedule and exercised 31 of the 34 techniques within 30 days; the other three have only scenarios above S1. Detections fired on 37 of 41 known forms (90 per cent) and on 10 of 14 held-out variants (71 per cent), a gap of 19 points. The eight failed executions merged into six findings. The same page replaced the tiles that had counted scenarios run and showed a pass rate, which under AIDR-0867 had ceased to be reportable. On 2028-04-14 the rule that a cell shows its age and turns amber at expiry (AP-HM-LOOP-03, AIDR-0888) and the trigger on the 19-point gap (AP-HM-LOOP-04, AIDR-0889) made the change general.

Sofia Keller's work in April was the register. The white-team sample of 20 findings closed in the third quarter of 2027 had found that 6 of them had been closed at merge, with no re-test, and AP-HM-LOOP-01 had named it. AIDR-0872 (2028-03-14) changed the rule so that the author of a change never closes it. By April the age of the register was a number she reported to the head of detection engineering, with direct access to the group CISO if it passed twice the target. The risk acceptance for the Swiss audit-log gap (FND-HM-2028-011, AIDR-0875) had been taken on 2028-03-16 by the group CISO for 90 days to 2028-06-14, with a canary credential on the unforwarded log and a re-test, which took place on 2028-04-15.

The reports

The two reports were due on 2028-04-30. Neither organisation wrote an essay. Each wrote an answer to the question it had been asked, a list of what could not be claimed and a list of decisions.

Nordvik, AIDR-0800. The question was what the first threat-led exercise had proved. The decision record that carries the answer is AIDR-0841, dated 2028-04-29. It says what the answer is not: it is not a count of closed findings and it is not nine of nine. It is a verified share that carries its list: 2 of 9 techniques verified within expiry, each with its date and age, and 7 that are not, each with a reason and an owner. It records the answer to the audit committee in one sentence that the committee could read aloud: the Region can show that two of its nine priority techniques were tested and passed within 180 days, three more were tested and failed and were fed back into the detection content and the provider's contract, two have never been tested since the mirror fieldwork of 2027, and the provider asserts two more on evidence the Region has not seen. The record also states the three things that made it possible to say this, each of them small: a testing right that the Region wrote into its contract, a register held in the Region's own tenant (AIDR-0803) and a second signature on every change the detection owner authors.

aidr: AIDR-0841
date: 2028-04-29
organisation: Nordvik Region
answers: AIDR-0800
stage: P3 Observe
decision: >
  Report the exercise programme to the audit committee as a verified share
  with its list, reasons and age, not as closed findings.
evidence:
  coverage_page: COV-NR-0001..COV-NR-0009
  as_of: 2028-04-26
  priority_list: PRI-NR-2028-01
  verified_within_expiry: 2
  tested_and_failed: 3
  of: 9
  not_tested: [T1190, T1486]
  asserted_by_provider: 2
  failed: [COV-NR-0003, COV-NR-0004, COV-NR-0005]
  oldest_passing_result_days: 77
  expiry_days: 180
accountable: ROLE-NR-SEC-DET
countersigned_by: deputy CISO
reviewers: [internal audit, AI architect, data protection officer]
next_review: 2028-09-01
note: "Illustrative. Aggregate only; no per-person line."

The record does two more things, in two further decisions. AIDR-0842 (2028-04-29) fixes the closure condition for FND-NR-2028-003: the finding stays open until the injected test due on 2028-05-02 passes, and if it fails the state is re-test failed, not closed, whatever the provider's ticket says; the round with the clause MS-2-TST-1 and the protocol CNP-NR-2028-01 then runs from 2028-05-08 to 2028-05-19. AIDR-0843 (2028-04-30) records the plan for the autumn 2028 run, and that is all it is: a plan. T1486 and T1190, whose evidence expires first, return to the pre-production mirror as SCN-NR-0009 and SCN-NR-0005, SCN-NR-0011 stays held out and written by the tester, and a second source for testing is to be qualified by 2028-09-30, as AIDR-0820 requires. The chapter stops at the date of the report; what happens on 2 May, in the May round and in the autumn run is outside the book's facts.

Hansa, AIDR-0850. The question was whether continuous automated red teaming makes the quarterly purple session redundant. The answer, recorded as AIDR-0891 on 2028-04-28, is no, and it gives its reasons from the quarter's own numbers. The pipeline's strength is cadence: 31 of 34 techniques within 30 days, which no quarterly session could achieve. Its weakness is generalisation: 90 per cent on known forms and 71 per cent on held-out variants. The session raised five findings in a single day, three of them ones the pipeline alone had not produced, among them telemetry gaps that no scenario can detect because there is nothing to see. The decision keeps the sessions and changes what they are for: the held-out set, the novel human-led scenarios (at least 30 per cent of red-team hours, AIDR-0884) and the correlator's corrections. It also makes the pipeline's cadence a stated service level: fewer than 28 of 34 within 30 days for a quarter reopens the question.

aidr: AIDR-0891
date: 2028-04-28
organisation: Hansa Mutual
answers: AIDR-0850
stage: P3 Observe
decision: >
  Keep the quarterly purple session. Use it for held-out and human-led
  scenarios and for the findings the pipeline cannot raise.
evidence:
  report_page: LPG-HM-2028-Q1
  period_end: 2028-03-31
  verified_within_expiry: 27
  of: 34
  within_30_days: 31
  known_form_fired: "37 of 41"
  held_out_fired: "10 of 14"
  generalisation_gap_points: 19
  gap_trigger_points: 10
  session: PRP-HM-2028-01
  session_findings: 5
  not_produced_by_pipeline: 3
triggers:
  - fewer than 28 of 34 within 30 days for a quarter
  - held-out gap above 10 points (AIDR-0889), already exceeded; reviewed against H3 of Chapter 28
reviewers: [CRO, head of detection engineering, chair of AI governance board]
note: "Illustrative. Team-level figures only."

Three further decisions at Hansa close the threads that were open in April. AIDR-0892 (2028-04-27) is the independence remedy: the planner and the curator (MND-HM-EMU-02) move to a second model family by 2028-07-31, so that they and the drafter no longer share one; until it does, scenario drafting and detection drafting for the same technique are assigned to different chains; and IND-HM-2028-Q1, which is valid to 2028-05-22, is renewed only after the held-out re-test has been run again, because the statement lapses at 90 days and an expired statement is a statement that no longer holds. Lena Vogel's team reproduces a sample by hand. AIDR-0893 (2028-04-28) orders the re-run of the simulation for the claims-triage agent's detection DET-HM-0561 before 2028-05-09, when COV-HM-0112 expires, 13 days after the date of the page. AIDR-0894 (2028-04-29) takes the three no-telemetry findings of the session and gives each an owner and a target of 30 days: the document-store retention of seven days, the missing token-use events and the Swiss audit-log decision, whose risk acceptance runs to 2028-06-14. The same record schedules T1486 and T1490 for the red-team range, with an external provider contracted for the next threat-led test, because Article 26(8) of the Digital Operational Resilience Regulation requires internal testers to be complemented by external testers every three tests (2, European Union, 2022). Chapter 28 treats the external provider and the curator's growing library as plans.

What the year shows

Looking back over the dated events, four things stand out.

First, every failure of the year was found by the loop and not by an incident. The hours variant, the restraint failure, the shared model family, the collector's log, the 21-minute stop and the 190-second revocation were all found by a scheduled test, a drill or a re-test. None was found by an adversary. That is what the loop is for, and it is the only honest basis for the claim that the programme has proved anything. The coverage pages list what has not been tested, because failures may lie outside the tests.

Second, every recovery had the same three parts: a local and immediate containment (a lowered level, a rotated token, a rule retired), a fix made by one person and a re-test made by another. The 49 days of FND-HM-2028-001 and the 21 days of FND-NR-2028-002 are not times to copy; they show what the closure rule of Chapter 4 costs, the delay between a fix and a closure, and what it buys, a record that a person other than the author watched the thing pass.

Third, the two organisations used the same instrument at different scales. Karin Lund's unit of six ran a contract, a sealed expectation sheet, a handful of variants and a second signature. Lena Vogel's and Mareike Hartmann's teams ran a pipeline and had to learn what it did not do. The stages were the same and the leverage was not (Chapter 19).

Fourth, the people carried more than the records show. Karin Lund held the roles of detection owner, coordinator and closure authority, and was made safer by a countersignature and a held-out test that someone else wrote. Sofia Keller was the first person at Hansa whose job was the whole loop. Mareike Hartmann kept the human-led work from being squeezed out by a pipeline that was cheaper per scenario, and the rule that at least 30 per cent of the red team's hours stay human-led and novel is a design, which Chapter 24 explains, that keeps a person in a position to catch what a runner does not.

Practical guide: Using the year as a template for an annual loop calendar

Purpose. Turn the dated events of the year into a calendar that gives every stage its dates, its delegation level, its stop holder and its closure signature, and that keeps evidence ahead of its expiry.

Roles. The purple-team coordinator drafts; the CISO approves; the white-team lead confirms scope and the stop; the red-team lead or the contracted tester and the detection owner supply the windows and the re-tests; the employee representatives see anything that touches staff.

Steps.

  1. Fix the dates that cannot move: expiries of evidence (180 days at Nordvik, 90 at Hansa), the validity of the independence statement, risk acceptances, contract end dates and the dates on which reports are due.
  2. Place the stage events behind them: a review of the priority list (P1 Target), emulation windows (P2 Emulate), a purple session after each window (P3 Observe), change deadlines (P4 Improve), and re-tests ahead of the earliest expiry (P5 Verify).
  3. Give every event its delegation level from the ceilings of Chapter 4 and its stop holder, who sits outside the system being stopped. Schedule a stop drill before every emulation window, as Nordvik did on 2027-10-07 before the run of 2027-10-11.
  4. Reserve time for recovery. The year had a 49-day and a 21-day recovery; a calendar with none assumes that nothing will fail.
  5. Name the person who signs each closure. The runner may record a passing re-test; it never signs.
  6. Separate facts from plans, and label any statement about the future with the three labels of Chapter 25.
  7. Review monthly, and re-approve the calendar after each report to the board or the audit committee.

Definition of done. Every stage has dated events; every expiry has a re-test dated before it; every emulation window has a drill and a named stop holder; every closure has a named signer; the CISO has approved the calendar and the employee representatives have seen it. Adapt the intervals to the size of the team and to the works agreement.

Worked example: An annual loop calendar for each organisation

Illustrative example. The calendars below start at the end of the period of this chapter, 2028-04-30, and run to the end of April 2029. The dates before 2028-09-30 are those of the decisions recorded above; the rest are plans, not outcomes, and the dates marked "to be set" are for the coordinators to fix.

# loop/calendar/CAL-NR-2028.yaml (illustrative; plan, not outcome)
calendar: CAL-NR-2028
organisation: Nordvik Region
approved_by: CISO
fixed_dates:
  - {date: 2028-08-07, what: "COV-NR-0001 and -0002 expire (180 days)"}
  - {date: 2028-11-30, what: "call-off NR-2026-071 ends"}
events:
  - {date: 2028-05-02, stage: P5, what: "injected test for FND-NR-2028-003", level: 1, stop: duty-security-officer, closes: ROLE-NR-SEC-DET, countersigned: deputy-ciso}
  - {date: 2028-05-08, stage: P2, what: "MS-2 round with MS-2-TST-1 and CNP-NR-2028-01, to 2028-05-19", level: "1 (provider class MS2 at 3 for S1)", stop: deputy-ciso}
  - {date: 2028-09-01, stage: P1, what: "review of the charter, the obligations and the priority list", level: 2}
  - {date: 2028-09-30, stage: P5, what: "second testing source qualified (AIDR-0820)"}
  - {date: "to be set", stage: P2, what: "autumn run: T1486 and T1190 in the mirror, SCN-NR-0011 held out (AIDR-0843)", level: "0 to 2", stop: deputy-ciso}
  - {date: 2028-10-23, stage: P1, what: "horizon register HZN-NR-PL-01 review"}
drills: "stop drill before each window"

# loop/calendar/CAL-HM-2028.yaml (illustrative; plan, not outcome)
calendar: CAL-HM-2028
organisation: Hansa Mutual
approved_by: group-ciso
fixed_dates:
  - {date: 2028-05-09, what: "COV-HM-0112 expires (90 days)"}
  - {date: 2028-05-22, what: "IND-HM-2028-Q1 valid to"}
  - {date: 2028-06-14, what: "risk acceptance for T1098.001 expires"}
events:
  - {date: 2028-05-09, stage: P5, what: "re-run of the DET-HM-0561 simulation (AIDR-0893), before expiry", level: 3, stop: white-team-lead, closes: head-of-detection-engineering}
  - {date: 2028-07-31, stage: P4, what: "planner and curator on a second model family (AIDR-0892); held-out re-test before IND is renewed", level: 2}
  - {date: "to be set", stage: P3, what: "quarterly purple session, held-out and human-led scenarios (AIDR-0891)", level: 1}
  - {date: 2028-10-04, stage: P1, what: "review of the learning path and the 30 per cent human-led share (AIDR-0884)"}
  - {date: 2028-10-23, stage: P1, what: "horizon register HZN-HM-PL-01 review"}
  - {date: "to be set", stage: P2, what: "first threat-led test with an external provider", level: "3 for S1 only", stop: white-team-lead}
drills: "runner stop drill before each window; target 60 seconds"

Each calendar puts a re-test before the expiry it protects and a signature on every closure, and each shows what the year taught: Nordvik's calendar is built around a contract and a second signature, and Hansa's around a pipeline that needs an independence statement renewed on time.

Across the degrees of delegation

Stage Event of the year Delegation at the time Who held the stop or the closure
P1 Target Priority lists PRI-NR-2028-01 and the re-ranking AIDR-0851 Curator at Level 1 (Hansa); none at Nordvik Karin Lund; Mareike Hartmann
P2 Emulate EMU-NR-2028-01 by hand; SCN-HM-0031 by the runner Level 0 to 2 at Nordvik; Level 3 for S1 at Hansa The deputy CISO (the CISO's delegate) and the duty security officer; the Hansa white team
P3 Observe PRP-NR-2028-01; PRP-HM-2028-01 with the correlator Level 1 correlator (Hansa); none at Nordvik A person re-did 24 steps and corrected 3
P4 Improve DET-HM-0612 by HM-SEC-002; DET-NR-0012 by the Region Drafting at Level 1; merge at Level 2 The author never closes the change (AIDR-0872)
P5 Verify REG-NR-0004; REG-HM-0032; the independence re-test Re-test runner Level 3 for S1 regression cases A named person signs every closure; the runner only records a passing result

Nordvik Region and Hansa Mutual

The year shows the book's central contrast. Nordvik bought a loop and Hansa built one. Nordvik's strength was the contract: a testing right, a clause on independence, standing consent for injected incidents and a register in its own tenant; its weakness was the load on one person and a provider whose model it could not inspect. Hansa's strength was the pipeline's cadence and breadth; its weakness was a planner and a drafter that shared a lineage. Each fixed what was in reach: Nordvik added a second signature and a held-out variant, and Hansa separated a chain and set a trigger on a gap.

Both used the same discipline in the end. They reported what they had tested, with its age, and the list of what they had not. The audit committee got two of nine verified, with reasons and the board got 27 of 34 with a gap of 19 points, and neither got a green dashboard. Chapter 28 turns the year into conclusions for each organisation, and Chapter 29 asks what it means for the practice.

Summary

This chapter followed four fictional people through the loop's year, the twelve months to 2028-04-30, with the eight months from May 2027 as background and the four from January 2028 in detail. Karin Lund and Elin Berglund at Nordvik Region, and Lena Vogel and Mareike Hartmann at Hansa Mutual, met the same kind of failure: a regression variant that exposed a closure (FND-NR-2028-002), a restraint failure by a defender's agent (FND-HM-2028-001), a shared model family that had made agreement look like evidence (IND-HM-2028-Q1) and a collector that had stored a token. Each was found by the loop, which is P3 Observe doing its work, and each was recovered by the three-part pattern of P4 Improve and P5 Verify: contain at once, fix by one person and re-test by another.

The chapter showed P1 Target in the priority lists and the reports' framing, P2 Emulate in a hand-run week at Nordvik and a 41-scenario pipeline at Hansa, P3 Observe in two purple sessions, P4 Improve in a rule retired and a rule requested, and P5 Verify in the regression cases, the closure rule and the independence re-test. The reports of 2028-04-30 answered the questions of AIDR-0800 and AIDR-0850 with a verified share and its list at Nordvik (AIDR-0841) and with the decision that the pipeline does not make the session redundant at Hansa (AIDR-0891). The plans for May and the autumn are decisions and dates, not outcomes, and the practical guide above turns them into a calendar: the state of FND-NR-2028-003 after 2028-05-02, the round of 2028-05-08 to 2028-05-19, the renewal of the independence statement before 2028-05-22 and the autumn run.

The lesson is the one the closure rule teaches: a loop that wants to be believed keeps records that someone who was not there can check. Chapter 28 draws the conclusions for the two organisations and compares them.

Sources

  1. European Parliament and Council of the European Union. Regulation (EU) 2022/2554 on digital operational resilience for the financial sector (DORA). Official Journal of the European Union, 27 December 2022. (2, European Union, 2022)
  2. MITRE Corporation. MITRE ATT&CK: Adversarial Tactics, Techniques, and Common Knowledge. (17, MITRE, n.d.)
  3. Nordqvist, G. (2026). AI Threat: Are the Dystopias Coming True? Evidence, Risk and Response for European Enterprises and Public Authorities. The Transformed Architecture, Book 5. (91, Nordqvist, 2026)
  4. Nordqvist, G. (2026). AI Blue: How Artificial Intelligence Transforms the Blue Team in European Enterprises and Public Authorities. The Transformed Architecture, Book 8. (94, Nordqvist, 2026)