Nordvik Region and Hansa Mutual: Conclusions for Two Organisations

In January 2028 two governing bodies asked a question about the same practice. Nordvik Region's audit committee asked its chief information security officer (CISO) what the first threat-led exercise had proved, beyond a list of closed findings (AIDR-0800). Hansa Mutual's executive board asked its group CISO whether continuous automated red teaming made the quarterly purple session redundant (AIDR-0850). Chapter 27 followed four people through the twelve months to 2028-04-30, in which the loop answered. This chapter draws the year into a conclusion for each organisation and a comparison, and turns each conclusion into a plan for the next two years, recorded as AIDR-0849 for Nordvik and AIDR-0899 for Hansa. It concerns all five stages of the purple loop: P1 Target, P2 Emulate, P3 Observe, P4 Improve and P5 Verify.

Both organisations are fictional and the year is illustrative. The plans run from 2028-05-01 to 2030-04-30 and are adopted on 2028-04-29, the day before the first reports are due. The recommendations are the book's own conclusions from Chapters 4 to 26: they say what a good choice looks like given what the records showed, and they are not forecasts. The author's projections belong to Chapters 25 and 29. Wherever this chapter looks ahead it says whether the statement is observable, expected or speculation, in the sense of AI Governance, Chapter 22 (88, Nordqvist, 2026).

Figure 28.1: The five stages of the loop, a gate for any higher level and a half-yearly review, common to both two-year plans.

What the year established

The series makes one argument: keep decisions as records that can be corrected, keep the ability to stop outside the system being stopped, keep people able to do the work and judge the output, keep dependence reversible and match autonomy to reversibility (91, Nordqvist, 2026). AI Blue applied it to the team that defends and added a closing rule for the loop: a finding is closed only when its re-test passes (94, Nordqvist, 2026). AI Red Team supplied the five record states and the autonomy levels on which the delegation profiles of this book rest (90, Nordqvist, 2026). European law adds that accountability stays with named people: NIS 2 Article 20 places the approval and oversight of cybersecurity risk-management measures on the management body, and DORA Article 5 does the same for the management body of a financial entity (3, European Union, 2022) (2, European Union, 2022). The Transformed Security Architect drew the architectural consequence, that someone must turn each article into a control and that accountability cannot be delegated to a system (92, Nordqvist, 2026).

This book adds the loop between the red and the blue side. Its working thesis has five parts, and the year tested each of them in a small way: purple is a loop and not a team; AI moves the loop from the event to the pipeline and keeps the event; a loop closed by machines alone verifies nothing new; coverage is a claim that needs evidence; and safe emulation is a design question settled in a signed manifest enforced outside the agent (Chapter 1). Every measure in the plans below is one of those claims made testable. The judgement on the thesis as a whole is the author's and is given in Chapter 29; this chapter reports only what the two organisations' records show.

Nordvik Region: a bought loop

Nordvik has a security unit of fourteen, six analysts who work office hours, a detection owner who is also the purple-team coordinator, a contracted tester under call-off agreement NR-2026-071 and a managed provider for out-of-hours monitoring under framework agreement NR-2025-044. It has no red team, no pipeline and no emulation agent. Its leverage is the contract, and its constraints are a team with no slack, procurement lead times, public-access rules that make some records requestable and a preference for EU-hosted or self-hosted models, because alert and finding data contain personal and health data.

What the year verified, and what it left open

The table gives the findings per stage as the records stood on 2028-04-26, the date of the coverage page. A finding is a result of a test with a date; a statement that something is open names the record that holds it.

Stage	Verified	Open
P1 Target	A priority list PRI-NR-2028-01 of nine techniques, accepted by the CISO, with a scenario library of 13 (SCN-NR-0001 to -0013) and a six-monthly review; a held-out scenario, SCN-NR-0011, written by the tester	Review due 2028-07-31; no curator, so the list depends on one person's judgement; T1190 and T1486 have no result younger than the 180-day expiry
P2 Emulate	A signed rules-of-engagement chain (RoE-NR-2027-001 and RoE-NR-2028-001); the autumn 2027 run and the spring 2028 atomic tests (EMU-NR-2028-01, five tests, 2028-03-20 to 2028-03-24); the tester's call-off carries test rights	No emulation between visits; night revocation of the test identity took 7 minutes against a target of 2; the call-off ends on 2028-11-30
P3 Observe	Two sessions (PRP-NR-2027-02, PRP-NR-2028-01) with sealed expectation sheets; the provider's closure of ALR-0912 found; 14 of 15 seeded cases handled correctly in the MS-2 round of 2028-Q1	The escape in class MS2-C1 (a bulk-mail seed); the provider's stop took 21 minutes against 15; two techniques that rest on the provider's assertion under MS-1 and have not been tested by the Region
P4 Improve	DET-NR-0001 as the detection for the spray-then-success pattern; FND-NR-2027-019 closed with DET-NR-0011 and REG-NR-0005 (AIDR-0812)	FND-NR-2028-003 (T1053.005): rule DET-NR-0012, provider request due 2028-04-18, injected test due 2028-05-02; cycle times of 112 and 21 days on the two findings measured
P5 Verify	REG-NR-0004 and EVD-NR-2028-0003: the hours variant failed on 2028-01-19 (41 minutes), the finding was reopened as FND-NR-2028-002 and all variants passed on 2028-02-09	2 of 9 techniques verified within expiry (the rest: three tested and failed, two asserted by the provider, two not tested); the oldest passing result was 77 days old with 103 days left of 180

Three things in the table matter more than the others. The first is that the coverage page answers the audit committee's question in the only form the thesis allows: two of nine priority techniques are verified within their expiry, three were tested and failed, two rest on the provider's assertion and two have no result younger than the expiry, and each carries its age. That is a smaller number than the draft pack of 2028-01-20 claimed when it said that nine of nine techniques were mapped to a detection, and it is the first number the committee can check. The second is that the reopening of REG-NR-0004 showed the method working: a variant caught a detection that had passed the base case, and the finding was reopened and closed on evidence, which is what P5 exists to do. The third is that the three soft failures of the year, the provider's closure under no stated rule, the stop that took 21 minutes and the revocation that took 7, were all failures of the arrangements around the technology and none needed an adversary.

The conclusion

The conclusion recorded in AIDR-0846 is that a bought loop is worth as much as the terms on which its evidence can be inspected. The Region owns the priority list, the findings register, the held-out scenario's commissioning, the closure of its findings and the stop. It buys the offensive work, the monitoring and the seeded incidents. What it cannot do is run the loop between visits, and the plan does not pretend that it can. It asks the contract to carry what the team cannot: testing rights in every agreement that touches the estate (the lesson of AP-NR-LOOP-01, the identity provider's agreement NR-2024-018, which is silent on testing), notice of a model change in the provider's annex (MS-2, 20 working days) and a named tester who declares AI use (AIDR-0834). The plan is AIDR-0849.

The six measures

The measures aim at what the year left open. Findings that closed on a passed re-test are not targeted again.

Id	Stage	Measure	Owner	Date	Verification
N1	P1 Target	Review PRI-NR-2028-01 every six months and on trigger, and give T1190 and T1486 a result	Detection owner	2028-07-31, then every six months; results by 2028-12-31	No priority technique without a result younger than 180 days at any quarterly review (trigger NR-T1); any technique dropped has a recorded reason (AIDR-0801)
N2	P2 Emulate	Renew or re-tender the call-off with the testing-right annex, run two catalogue runs a year and drill the stop	CISO with the white-team lead	Contract by 2028-09-30; autumn run in October 2028 (planned); spring run 2029	Night revocation within 120 seconds in two consecutive drills by 2028-12-31; human-led halt within 5 minutes (RoE-NR-2027-001)
N3	P3 Observe	Run the quarterly MS-2 rounds under MS-2-TST-1 and bring the provider's stop within budget	CISO	Next round 2028-05-08 to 2028-05-19; stop within budget by 2028-09-30	At most one escape per round and no class with two escapes in a year; provider's AI stopped within 15 minutes
N4	P4 Improve	Route every finding within its urgency class and close FND-NR-2028-003 on its injected test	Detection owner; deputy CISO countersigns changes the owner authored (AIDR-0822)	Injected test by 2028-05-02; standing	Urgent within 14 days, standard within 30, deferred within 90; none past twice its target without escalation
N5	P5 Verify	Raise the share of priority techniques verified within expiry and publish the page every quarter with its list and ages	Detection owner	7 of 9 by 2028-12-31; 9 of 9, or a declared reason for each exception, by 2029-10-31	COV-NR-* page with the status computed by rule; nothing counted on the provider's assertion alone
N6	People	Remove the single point of resilience: qualify a second source, and have the second analyst run one session a year as coordinator	CISO with the union	Second source by 2028-09-30 (AIDR-0820); first session by 2029-03-31	Competence record shows the session run unaided; results reported in aggregate and never by name

The order follows reversibility. N1 and N5 are cheap and reversible and begin in the first quarter. N3 and N4 mend what the contract already contains. N2 and N6 are commitments that are hard to undo, and each has a date that the contract itself forces: the call-off ends on 2028-11-30, and a second source is a procurement decision that cannot be made in a week. Three things are left out on purpose. The plan adds no emulation agent and no curator; the correlator MND-NR-EMU-01 stays at Level 1 Assisted and the critic MND-NR-EMU-02 at Level 0 Advisory on a different model family from the tester's declared family. It sets no target for the number of scenarios run, because a count of runs says nothing about what was verified (Chapter 18). And it does not ask the provider to be better; it asks the provider to be visible.

Hansa Mutual: a run loop

Hansa runs the loop. It has a group red team of five led by Mareike Hartmann, a detection-engineering team of four led by Lena Vogel, a group security operations centre (SOC) of about 38, a purple-team coordinator, Sofia Keller, from 2028-03-01, and a pipeline: HM-SEC-004 runs 41 safe scenarios on a rolling schedule under the mandate MND-HM-EMU-01, with six further agents of the loop under DLG-HM-EMU-01. Its leverage is the platform and the repository, and its constraints are seven legal regimes, works-council consultation in Germany, the Netherlands and Sweden (KBV-IT-2024-SOC-05), DORA third-party risk for every testing and simulation service and a findings register that is itself a map of the estate.

What the year verified, and what it left open

Stage	Verified	Open
P1 Target	34 priority techniques re-ranked on THR-HM-02 (AIDR-0851), five changing tier and T1486 and T1490 moving to tier 1; a library of 87 scenarios after SCN-HM-0087; a held-out set of 13 (13 of 87, SCN-HM-0074 to -0086)	T1486 and T1490 cannot run in production in a reversible form and still have to be run on the red-team range; the curator's library is growing and the human-authored share must not fall
P2 Emulate	The runner's stop at 38 seconds in its first drill against 60; 31 of 34 priority techniques exercised within 30 days; DRF-HM-LOOP-01 v1.1.0 after the tabletop froze the runner in 41 seconds	Three techniques have only scenarios above S1 and depend on the human-led session; the human-led share measured 26 per cent against a default of 30
P3 Observe	PRP-HM-2028-01: 12 priority techniques in 96 tagged steps, five findings of which three the pipeline alone had not produced; four wrong joins seeded by the white team were all caught	T1098.001 Swiss audit log not forwarded (risk accepted to 2028-06-14, FND-HM-2028-011); T1213 log kept seven days; T1550.001 emits no token-use events
P4 Improve	DET-HM-0612 merged 2028-02-20 for FND-HM-2028-007, with a retirement of DET-HM-0201; DET-HM-0561 for the claims-triage agent; restraint failure of HM-SEC-001 closed on a passing re-test after 49 days	Detections fire on 37 of 41 known-form scenarios (90 per cent) and on 10 of 14 held-out variants (71 per cent), a gap of 19 points against a trigger of 10 (AIDR-0889)
P5 Verify	Verified within expiry: 27 of 34 on 2028-03-31, with the oldest passing result 81 days old; REG-HM-0031 and REG-HM-0032	IND-HM-2028-Q1 (valid to 2028-05-22): planner and drafter share a model family, and the held-out re-test failed two cells (FND-HM-2028-003, -004); of 20 findings closed in 2027-Q3, 6 had been closed at merge without a re-test (AP-HM-LOOP-01); COV-HM-0112 expires on 2028-05-09

The year's answer to the executive board is in the table. The pipeline does not make the session redundant. The session raised five findings, three of which the pipeline alone had not produced, and the pipeline's strength is the schedule: 31 of 34 priority techniques exercised within 30 days. The gap between 90 and 71 per cent shows what the schedule cannot buy, which is generalisation; and the mapping of the five finding states onto the stages exposed P5 as the weakest stage, because a loop in which three in ten closures lack a re-test is closing on belief. The rates rest on small counts, 37 of 41 and 10 of 14, and the plan reads each rate beside its count.

The conclusion

The conclusion recorded in AIDR-0896 is that a run loop is as good as its independence and its stop. Hansa can enforce a mandate on agents it runs, and the price is that it must keep a large number of people consistent across two sites and seven regimes while the pipeline produces more than they can review. The group's loop therefore keeps two things that the pipeline does not supply: the red team's authorship of the held-out set and of the novel scenarios, and a person's reproduction of a sample of what the correlator and the re-test runner report. The independence remedy recorded in AIDR-0892 (Chapter 27) moves the planner and curator (MND-HM-EMU-02) to a second model family by 2028-07-31, so that planner and drafter no longer share a chain, and renews the independence statement only on a held-out re-test. The plan is AIDR-0899, the target delegation levels are in AIDR-0898, and the answer to the board's question as reported on 2028-04-30 belongs to Chapter 27.

The six measures

Id	Stage	Measure	Owner	Date	Verification
H1	P5 Verify	Close a finding only with a re-test log and an evidence manifest; the white team samples 20 closed findings every quarter	Purple-team coordinator; closure owner by class (AIDR-0871, AIDR-0872)	First sample 2028-09-30	20 of 20 with both records (14 of 20 in 2027-Q3); the author of a change never closes it
H2	P1 Target and P2 Emulate	Keep every priority technique on a schedule, run T1486 and T1490 on the range and decide the T1098.001 gap	Head of the group red team	Range runs by 2028-09-30; decision before the acceptance expires on 2028-06-14	34 of 34 exercised within 30 days (S1) or at the quarterly session (above S1); no cell green on expired evidence
H3	P3 Observe and P4 Improve	Bring the held-out gap from 19 to 10 points and close FND-HM-2028-003 and -004	Head of detection engineering	2028-12-31	Gap at or below 10 points over at least 14 held-out variants; held-out set kept at no less than 15 per cent of the library (13 of 87 today is 14.9 per cent, one short; the extension from 13 to 20 requested on the page of AIDR-0868 restores it)
H4	P1 Target to P5 Verify	Move the planner and curator to a second model family, renew IND-HM-2028-Q1 and lift the verified share	Group CISO	Renewal by 2028-05-22; move by 2028-07-31; verified share 31 of 34 by 2029-03-31	Seeded-gap catch at or above 0.8 (freeze rule of DLG-HM-LOOP-01); seven techniques that rested on the shared chain re-tested with held-out scenarios
H5	P2 Emulate	Keep the runner's stop at 60 seconds and the loop alive by hand, and keep Level 3 for S1 tied to people who can do the work	White-team lead with the red-team lead	Drill each quarter; first review of AIDR-0885 on 2028-07-10	Two consecutive drills at or under 60 seconds; the loop's degraded mode worked by hand for a defined week; at least two operators showing EE-02 unaided in the last twelve months (four of five at the date of the decision)
H6	People and regimes	Protect unassisted work and the route to the craft, and contract an external provider for the next threat-led test	Red-team lead with group HR	Rotation seat from 2028-07-01; provider contracted before the next TLPT notice	Ten working days of unassisted block per operator per quarter (AIDR-0884); human-led share at 30 per cent; nothing reported by person (KBV-IT-2024-SOC-05)

H1 is the measure that matters most, and H3 is the one most likely to disappoint. A closure sample is a cheap control with a clear result. A gap of 19 points that must fall to 10 depends on detection engineers writing rules from the technique and the telemetry and not from the scenario (DE-02, Chapter 24), and on the red team continuing to write the held-out variants. If the gap does not fall, the plan says what happens: the generation of drafts by the drafter slows, and the review of rules for held-out behaviour (DE-03) takes the engineers' time first.

A comparison

What the organisations share

Both organisations were asked in the same month whether their loop had shown anything, and both answered with a record in place of a count. Each has a charter and a delegation profile that says, per stage and action class, who decides (LOOP-NR-2028-01 with DLG-NR-LOOP-01, and DLG-HM-LOOP-01 with DLG-HM-EMU-01). Each keeps the findings register under a handling policy (POL-NR-FND-01, POL-HM-FND-01), because the register is a map of the estate and its leak is a failure mode (Chapter 16). Each keeps Level 4 Autonomous out of every emulation action that is irreversible, leaves the signed scope, touches personal data beyond what the exercise is authorised to touch or targets a named person. Each has agreed with its employee representatives that results are reported in aggregate and never by name. And each found that the failures of the year were soft: a provider closing an alert under no stated rule, a stop slower than its budget, a closure at merge, a green dashboard. None needed an adversary to appear.

Where they differ, and why the plans differ

Dimension	Nordvik Region	Hansa Mutual
Source of leverage	The contract: testing rights, notice, a named tester	The pipeline and the repository: mandates, schedules, regression cases
What the loop is	A small catalogue run by a contractor twice a year, with injected tests between	Rolling S1 emulation, weekly atomic tests, quarterly sessions, an annual human-led exercise
The risk	A loop that never starts, or stops after the first report	A loop that runs without anyone questioning it
Cost	Tester days, a coordinator's allowance, procurement time	Runner budget, a second model family, protected time for unassisted work
Independence	By role and contract: a tester who is not the detection owner, a provider who is not the Region	By design between agents, model families and teams that share a repository
The limit	One person with several hats and a second analyst as the single point of resilience	Review capacity and consistency across two sites and seven regimes
Quality shown by	Counts from small samples and seeds, with ages	Rates from protocols and held-out sets, read beside their counts
Law	One jurisdiction and public law; no TLPT authority or attestation	DORA as primary regime for its financial entities; TIBER-DE, the German national implementation of TIBER-EU, for the German entity (illustrative) (39, ECB, 2018); UK and Swiss regimes outside it

The differences explain the order of each plan. Nordvik starts with the evidence it lacks, because a team of six cannot supervise what it has not tested, and it makes the contract carry the rest. Hansa starts with the stage that is weakest, P5, and with independence, because a team that runs a fast pipeline risks supervising less as volume grows. The two plans meet at the same point from opposite sides: both end in a closure rule that no volume of runs can satisfy and no tool can sign.

What each learns from the other

Nordvik can take from Hansa the habit of tying every trigger to a number that already exists. The register HZN-HM-PL-01 names a threshold for each trend (fewer than 28 of 34 within 30 days, a gap above 10 points, a seeded-gap catch below 0.8), and a register of that kind is possible at Nordvik's size, because the coverage page already carries the figures. Its first trigger, a priority technique with no result younger than 180 days, is in fact already true for two techniques, and the plan answers it.

Hansa can take from Nordvik the discipline of putting independence in a clause and not in a hope. Nordvik's annex MS-2 has terms for independence (MS-2-IND-1 and -2), a notice period for a model change and a consent protocol for injected incidents (CNP-NR-2028-01), and the tester's held-out scenario is written by someone who does not use the detection side's assistant. Hansa's independence statement expires in 90 days, and the plan treats its renewal as a contract with itself: the group CISO signs it only on a re-test. Both can learn the same lesson about concentration. Karin Lund holds several hats and Sofia Keller's post is under strain, and in both cases the remedy is to write down the hats, name a deputy and countersign what the owner authored.

The five-part thesis, as each organisation answers it

The table states what the records of each organisation show for each part of the thesis. It is a report of evidence from two illustrative cases and not a judgement on the thesis, which the author gives in Chapter 29.

Part of the thesis	Nordvik Region	Hansa Mutual
Purple is a loop, not a team	Five people, none full time, two counterparties and a contract close the loop; the coordinator is a fraction of one person's duties (AIDR-0820)	A full-time coordinator reports to the head of detection engineering; red team and detection engineering share a scorecard (SCR-HM-2028-Q1) and stay two teams
AI moves the loop to the pipeline and keeps the event	No pipeline; the event is the loop, and injected tests run between visits	41 scenarios on a schedule; the session found three findings the pipeline had not
A loop closed by machines alone verifies nothing new	The provider's AI closed ALR-0912 under no rule; sampling and seeds found it	Planner and drafter share a family and the held-out re-test failed two cells
Coverage is a claim that needs evidence	2 of 9 verified, with age; the nine-of-nine draft pack withdrawn	27 of 34 with age; 31 green cells on the old dashboard were replaced by cells that turn amber at expiry (AIDR-0888)
Safe emulation is a design question	Stops held by the MSSP shift lead and the exercise controller; S4 test on a separate manifest	Mandates, a stop outside the runner at 60 seconds, a hold list and an exercise clause

The next two years

Decisions for the management body

The management body should receive one page and at most three decisions, the discipline that AI Threat set for the threat register (91, Nordqvist, 2026). Neither instrument above lets the management body hand its duty to a tool or a supplier: NIS 2 Article 20(1) has the management bodies approve and oversee the measures and be liable for infringements (3, European Union, 2022), and DORA Article 28(1)(a) keeps the financial entity fully responsible when it uses ICT third-party services (2, European Union, 2022). The decisions below are the ones still open. The charters, the profiles and the posts were decided in the records of Chapters 4 to 24 and are not asked for again.

Nordvik Region, three decisions (AIDR-0847).

1. Make testing a condition of every agreement. Renew or re-tender the call-off NR-2026-071, which ends on 2028-11-30, with the testing-right annex of AIDR-0834, and apply the testing-right clause of AIDR-0838 to the identity provider's agreement and to later call-offs. Accept the consequence, a re-tender or a change of supplier, if a provider refuses. The committee should know that this is a procurement decision with a cost.
2. Fund the people who hold the loop. Fund the coordinator's allowance and the second analyst's session as a standing cost, and the qualification of a second source by 2028-09-30, so that one person's knowledge becomes the capacity of a team.
3. Accept the age of evidence. Accept that a technique with no result younger than 180 days is reported as untested, not as covered, and receive the page every quarter.

Hansa Mutual, three decisions (AIDR-0892 and AIDR-0898).

1. Accept the conditions for any higher level. No stage and action class moves above its level in DLG-HM-LOOP-01 unless the four-quarter seeded-gap catch is at or above 0.90, the held-out gap is at or below 10 points, a class owner is named, a stop rule is written as numbers and consultation is complete in the entities concerned. The group AI governance board grants; delegation is withdrawn below 0.8.
2. Fund independence and protected time. Fund a second model family for the planner and curator and the unassisted block of AIDR-0884.
3. Own the risk appetite for the loop. Accept the quarterly session, the annual human-led exercise, the quarterly stop drill and the external provider for the next threat-led test as a standing cost of running a pipeline, and receive the result once a year.

Budget and people

The plans have consequences for budget and people. The figures below are illustrative: they show the shape of the cost and the unit in which it is counted, and no organisation should adopt them without its own estimate.

Item	Nordvik Region (illustrative)	Hansa Mutual (illustrative)
Testing capacity	About 40 tester days a year across two catalogue runs and the pairing days of AIDR-0834	Runner budget capped at EUR 4,500 a month in MND-HM-EMU-01 (EUR 54,000 a year)
Coordinator	One day a week of the detection owner's time, stated in the charter, and the second analyst's one session a year	Full time (ROLE-HM-SEC-PRP), deputy from detection engineering
Independence	Provider rounds inside the framework; analyst time of about 3 working days per round	A second model family for planner and curator, about EUR 1,200 a month
Protected time	Karin Lund's 5 per cent for learning, kept	Ten working days per operator per quarter: 200 person-days a year across five operators, close to one post
Procurement	Re-tender or renewal of the call-off; qualification of a second source (about 10 working days)	External provider for the next threat-led test, priced by procurement

For people the plans decide three things. Nordvik adds no post and relies on allowances and contract, and its plan therefore carries a trigger on the departure of the detection owner. Hansa adds a rotation seat for a detection engineer in the red team from 2028-07-01 and protects the share of human-led hours. In both, a measure about people is agreed with the representatives before the first reading is taken and is reported in aggregate. Effects on people are described by what studies measured: unaided performance can fall after sustained use of an assistant in some tasks, and the effect depends on the pattern of use (Chapter 24).

Risks and triggers from the horizon registers

Chapter 25 wrote a horizon register for each organisation on 2028-04-24, with the next review on 2028-10-23. The plans take their triggers from those registers, and the table shows where each trigger stands today and what the plan does when it fires.

Register entry	Label	Trigger	State on the plan date	Response in the plan
HZN-NR-PL-01 NR-T1	Observable	Any priority technique with no result younger than 180 days	Already true for T1190 and T1486	N1 and N5 give each a result; N2 funds the run
HZN-NR-PL-01 NR-T2	Expected	SCN-NR-0011 no longer written by the tester	Not fired	Held-out scenario stays with the tester; call-off renewal keeps the clause
HZN-NR-PL-01 NR-T3	Expected	A model change without 20 working days' notice	Not fired	N3 keeps MS-2 rounds; a late notice reopens the plan
HZN-NR-PL-01 NR-T4	Speculation	A service offering held-out scenarios and a stop path outside the provider	No offer received	Keep the call-off reversible; nothing to commit
HZN-HM-PL-01 HM-T1	Observable	Fewer than 28 of 34 within 30 days for a quarter	31 of 34	H2 holds the schedule; T1486 and T1490 on the range
HZN-HM-PL-01 HM-T2	Observable	Generalisation gap above 10 points (AIDR-0889)	19 points; the trigger has fired	H3 is the response
HZN-HM-PL-01 HM-T3	Expected	Seeded-gap catch below 0.8	Above the freeze rule	H4 and the second family
HZN-HM-PL-01 HM-T4	Expected	Fewer than 25 of 34 priority techniques verified	27 of 34 (23 on 2028-02-22)	H1 and H4; the margin of two cells is thin
HZN-HM-PL-01 HM-T5	Speculation	Two independent threat-led tests showing equal gap closure	No evidence	Keep the human-led session and the held-out authorship

Beyond the registers, the plans carry five further risks, each with a trigger that revises them. At Nordvik, the departure of the detection owner or of the second analyst, a change of control at the tester or at the provider, and a model change announced late each reopen the plan. At Hansa, a new Mode 5 agent in the loop, a change to KBV-IT-2024-SOC-05, a change in the UK or Swiss regime, a stopped agent in a major incident and a seeded-gap catch below 0.8 each reopen it. A measure that fails its verification twice in a row is not extended; it is reconsidered.

Practical guide: Writing a two-year loop plan as a decision record

Purpose. Turn a year of loop records into a plan that a CISO can fund, a management body can follow and an auditor can check.

Roles. The purple-team coordinator drafts; the CISO approves; the management body decides what needs funding or policy; the white-team lead reads the stop and delegation measures; internal audit receives the verification evidence; employee representatives are consulted on every measure about people.

1. List the year's decision records as done, in progress or reopened. Where two records disagree, the later governs. Never ask the management body to decide what a record has already decided.
2. For each of the five stages, name the constraint that limits it most, such as one person, review capacity, a provider's silence or a shared model family, and write the conclusion the chapters support. If no record supports a conclusion, the stage gets no measure.
3. Write at most six measures, normally one per stage and one for people. Each has a verb, an owner by role, a date and a verification that produces evidence. Target what is open, not what a passed re-test has closed.
4. Order the measures by reversibility: cheap and reversible first, commitments that are hard to undo last and conditional on a date the contract forces.
5. Write every increase in delegation as a gate: a threshold on the class's own evidence, a period, a named grantor, a stop rule and a first review 90 days after the increase. A default is two consecutive quarters; adapt it to the risk appetite and the size of the sample, and read each rate beside its count.
6. Take the triggers from the horizon register and tie each to a number that already exists in the loop's records. Say which triggers have already fired.
7. Agree every measure about people with the representatives before the first reading is taken, and report it in aggregate.
8. State the budget and people consequences as illustrative until procurement has priced them.
9. Keep the plan as code beside the charter and the delegation profile, set a review each half-year and list the triggers that reopen it.

Definition of done. Every measure has an owner, a date and a verification; at most three decisions go to the management body; every increase in delegation is a gate on recorded evidence; every trigger names a number; and the record names the signals on which the plan would be revised.

Worked example: AIDR-0849 and AIDR-0899

Illustrative example. Nordvik's plan is recorded in AIDR-0849 on the strength of the conclusion in AIDR-0846. It builds visibility and ownership before any commitment the Region cannot undo.

# plans/loop-2028-2030.yaml (Nordvik Region, illustrative)
plan: PLAN-NR-LOOP-2028
decision_record: AIDR-0849
conclusion_record: AIDR-0846
decisions_record: AIDR-0847
delegation_record: AIDR-0848
answers: AIDR-0800
owner: chief-information-security-officer
approved_by: audit-committee
period: {from: 2028-05-01, to: 2030-04-30}
adopted: 2028-04-29
constraint: six analysts, no slack; P2 and P3 bought; one coordinator with several hats
already_decided: [AIDR-0802, AIDR-0820, AIDR-0822, AIDR-0834, AIDR-0838]
measures:
  - {id: N1-P1, owner: detection-owner, due: "2028-07-31, then every six months",
     verify: no priority technique without a result younger than 180 days}
  - {id: N2-P2, owner: chief-information-security-officer, due: 2028-09-30,
     verify: call-off with testing-right annex; night revocation within 120 seconds twice running by 2028-12-31}
  - {id: N3-P3, owner: chief-information-security-officer, due: 2028-09-30,
     verify: at most one escape per MS-2 round; provider stop within 15 minutes}
  - {id: N4-P4, owner: detection-owner, due: 2028-05-02,
     verify: FND-NR-2028-003 closed on its injected test; none past twice its target}
  - {id: N5-P5, owner: detection-owner, due: 2029-10-31,
     verify: 7 of 9 verified within expiry by 2028-12-31, then 9 of 9 or a declared reason}
  - {id: N6-people, owner: chief-information-security-officer, due: 2028-09-30,
     verify: second source qualified; second analyst runs one session unaided by 2029-03-31}
decisions_for_audit_committee: [testing right in every agreement, fund the people who hold the loop, accept the age of evidence]
delegation_target: {P1: 1, P2: 0, P3: 1, P4: 1, P5: 2, level_4: never_for_excluded_classes}
horizon_register: HZN-NR-PL-01
review: {quarterly: CISO, half_yearly: audit-committee, first: 2028-10-23, final: 2030-04-30}
revise_on: [detection owner leaves, change of control at tester or provider, late model-change notice, NR-T1 fires on a new technique]

Hansa's plan is recorded in AIDR-0899 on the strength of AIDR-0896. It holds the gate on its own delegation, treats independence and P5 as the constraints, and records the stop as a number.

# plans/loop-2028-2030.yaml (Hansa Mutual, illustrative)
plan: PLAN-HM-LOOP-2028
decision_record: AIDR-0899
conclusion_record: AIDR-0896
independence_record: AIDR-0892
delegation_record: AIDR-0898
answers: AIDR-0850
owner: purple-team-coordinator
approved_by: group-ciso
period: {from: 2028-05-01, to: 2030-04-30}
adopted: 2028-04-29
constraint: review capacity; shared model family; seven regimes; P5 weakest stage
already_decided: [AIDR-0852, AIDR-0854, AIDR-0872, AIDR-0884, AIDR-0885, AIDR-0889]
measures:
  - {id: H1-P5, owner: purple-team-coordinator, due: 2028-09-30,
     verify: white-team sample of 20 closed findings, 20 with re-test log and manifest}
  - {id: H2-P1P2, owner: head-of-red-team, due: 2028-09-30,
     verify: 34 of 34 exercised on schedule; T1486 and T1490 run on the range}
  - {id: H3-P3P4, owner: head-of-detection-engineering, due: 2028-12-31,
     verify: held-out gap at or below 10 points over 14 or more variants}
  - {id: H4-all, owner: group-ciso, due: 2028-05-22,
     verify: IND-HM-2028-Q1 renewed on held-out re-test; planner on second family by 2028-07-31; 31 of 34 verified by 2029-03-31}
  - {id: H5-P2, owner: white-team-lead, due: quarterly,
     verify: runner stop at or under 60 seconds twice running; two operators showing EE-02 unaided}
  - {id: H6-people, owner: head-of-red-team, due: 2028-07-01,
     verify: rotation seat filled; ten days unassisted per operator per quarter; nothing by person}
decisions_for_executive_board: [conditions for any higher level, fund independence and protected time, risk appetite for the loop]
raise_gate: {seeded_catch_4q: ">= 0.90", held_out_gap_points: "<= 10", grantor: group-ai-governance-board, first_review_days: 90}
horizon_register: HZN-HM-PL-01
review: {quarterly: group-ciso, half_yearly: group-ai-governance-board, yearly: executive-board, first: 2028-10-23}
revise_on: [seeded catch below 0.8, new Mode 5 agent in the loop, change in UK or Swiss regime, change to KBV-IT-2024-SOC-05, stopped agent in a major incident]

Neither plan raises autonomy unconditionally. Nordvik's measures create the visibility on which any later delegation would have to rest, and Hansa's gate waits on recorded evidence.

What each should stop doing

A plan that adds without retiring becomes the thing it was meant to prevent. Several of these practices are the anti-patterns of Chapter 26.

Organisation	Stop	Replace with	Evidence
Nordvik Region	Reporting a technique as mapped to a detection	A result with a date, and untested where there is none	COV-NR-* page, status computed by rule
Nordvik Region	Signing agreements that are silent on testing	A testing-right clause	AIDR-0838 applied
Hansa Mutual	Closing at merge	A re-test and a manifest, sampled by the white team	20 of 20 in the sample
Hansa Mutual	Reading a green cell without its age	Cells that turn amber at expiry	AIDR-0888
Both	Counting scenarios run or findings closed as progress	Verified share with age, held-out gap, cycle time, seeded catch	The board page of Chapter 18

What the plans assume

The plans rest on statements about the future, labelled as the series requires (88, Nordqvist, 2026).

• Observable. Both organisations already buy or run AI in the loop and in detection tooling (Mode 0 at Nordvik's provider; Modes 4 and 5 at Hansa), and Hansa's own figures show a gap between known-form and held-out detection. The plans rest on these records, not on a forecast.
• Expected. That the testing obligations of DORA and NIS 2 continue to ask for evidence of testing at the management body's level is expected, because both instruments are in force; DORA Article 26(8) already requires internal testers to be complemented by external testers at every third test for entities under threat-led testing (2, European Union, 2022). The plans therefore keep the external tester and contract an external provider for Hansa's next threat-led test.
• Speculation. That a loop could one day be run end to end by machines with no named human to reproduce a sample is speculation. The sources of this book do not support it, and neither plan depends on it. The plans keep it reversible: the human-led session, the held-out authorship and the closure rule stay until two independent threat-led tests show that something else does as well.

Review

The owner of each measure reports quarterly on one page with the verification evidence attached. The management body's delegate reviews the plan every half-year, starting on 2028-10-23 together with the horizon registers, and in full on 2030-04-30. Nordvik's first review checks N2 first, because the other measures depend on a contract that either exists or does not. Hansa's first review checks H4 and H1 first, because an unrenewed independence statement and a closure without a re-test turn every other green cell into a claim. Both reviews check the measures about people with the representatives.

Across the degrees of delegation

The table states the highest degree of delegation each organisation reaches by the end of its plan, per stage and action class, as recorded in AIDR-0848 and AIDR-0898. Level 4 Autonomous appears nowhere for the four excluded classes. These are the book's recommendations for the illustrative organisations, not the author's projections.

Stage and action class	Nordvik Region	Hansa Mutual
P1 Target: propose candidates; add to the priority list	Level 1 Assisted; priority list decided by a person	Level 1 Assisted for the curator; Level 2 Supervised for the list
P2 Emulate: run a catalogued S1 scenario in production	Level 0 Advisory; the tester runs it with the Region's approval	Level 3 Bounded for S1 inside the signed scope, tied to two operators who have shown EE-02 unaided
P2 Emulate: S2, S3, irreversible or involving staff	A named person; S4 only on a separate manifest	S2 and S3 at Level 2 Supervised with white-team approval; S4 at Level 0 Advisory
P3 Observe: correlate; classify an outcome	Level 1 Assisted (MND-NR-EMU-01); critic at Level 0 Advisory	Correlator at Level 1 Assisted; earliest candidate for Level 2 Supervised on routine outcome classes is 2029-01-01, through the gate
P4 Improve: draft; merge a reviewed change	Level 1 Assisted for drafts; a person merges	Level 1 Assisted for the drafter (pull requests only); Level 2 Supervised for merge
P5 Verify: run a codified re-test; declare closure	Level 2 Supervised for re-tests; closure by the detection owner, countersigned	Level 3 Bounded for a passing S1 regression case; closure by the class owner, never the author
Any action in the four excluded classes	Never Level 4 Autonomous	Never Level 4 Autonomous

Across the usage modes

Mode	Nordvik Region	Hansa Mutual
Mode 0 Ambient AI	The provider's AI closes low-severity alerts out of hours; made visible by MS-2	Provider AI in the managed detection service for the UK and Swiss entities, closing only SC-01 and SC-02
Mode 1 Conversational assistants	The tester's declared use; the drafting assistant for descriptions, not choices	Assistants in red-team and detection work, declared
Mode 2 Embedded workplace assistants	Drafts in the ticket tools, reviewed by a person	Drafts in the ticket and pull-request tools, with seeded errors
Mode 3 Agentic work tools	Not used in the loop	Planner and drafter acting in a person's session, sampled by reproduction
Mode 4 Built AI applications	Correlator and critic only	Curator, correlator, critic and triager under mandate
Mode 5 Autonomous production agents	None	Runner and re-test runner with identities of their own, stop outside the runner

Nordvik Region and Hansa Mutual

Nordvik's risk is a loop that never starts or stops after its first report, and its plan answers it with a contract, a calendar and two people who can each do the other's part. Hansa's risk is a loop that runs without anyone questioning it, and its plan answers it with a gate, a second model family and a sample that a person reproduces. Nordvik's strongest instrument is a sentence in an agreement that it can test. Hansa's is the discipline not to widen what it cannot yet show it can supervise. Both reach the same conclusion by different instruments: the agents and the providers act within a written scope, a person who does not depend on them can stop them, and a finding is closed only when its re-test passes.

Summary

Nordvik Region and Hansa Mutual were asked in January 2028 whether their loop had shown anything. Nordvik's conclusion, AIDR-0846, is that a bought loop is worth the terms on which its evidence can be inspected, and its plan, AIDR-0849, has six measures and three decisions for the audit committee. Hansa's conclusion, AIDR-0896, is that a run loop is as good as its independence and its stop, and its plan, AIDR-0899, has six measures and three decisions for the executive board. Both plans run from 2028-05-01 to 2030-04-30, are reviewed every half-year and are reopened by the triggers of the horizon registers of Chapter 25.

All five stages have a measure in both plans. P1 Target is held to a living priority list and to techniques with a result younger than their expiry. P2 Emulate is held to a renewed contract at Nordvik and to a timed stop and a human-led share at Hansa. P3 Observe is held to the provider's rounds at Nordvik and to the held-out gap at Hansa. P4 Improve is held to routing within urgency classes and to a second model family. P5 Verify is held to a coverage page with ages at Nordvik and to closure only with a re-test at Hansa. A measure about people completes each plan.

The two organisations share a method: delegate by stage and reversibility, record it, put the stop outside the system it stops, measure by what volume cannot buy and agree measures about people with their representatives first. They do not share an instrument; Nordvik has the contract and Hansa has the pipeline. Each learns something from the other: Nordvik, to tie every trigger to a number, and Hansa, to put independence in a clause. The budget and people consequences are illustrative, and the management bodies are asked for three decisions each. Chapter 29 gives the author's judgement on the five-part thesis, the independence principle and the questions the book leaves open, and sets out what a practitioner can do on Monday.

Sources

1. European Parliament and Council of the European Union. Directive (EU) 2022/2555 on measures for a high common level of cybersecurity across the Union (NIS 2 Directive). (3, European Union, 2022)
2. European Parliament and Council of the European Union. Regulation (EU) 2022/2554 on digital operational resilience for the financial sector (DORA). (2, European Union, 2022)
3. European Central Bank (2018). TIBER-EU Framework: How to implement the European framework for Threat Intelligence-based Ethical Red Teaming. (39, ECB, 2018)
4. Nordqvist, G. (2026). AI Governance: Governing Artificial Intelligence in European Enterprises and Public Authorities. (88, Nordqvist, 2026)
5. Nordqvist, G. (2026). AI Red Team: AI as an Active Part of Cyber Defence in European Enterprises and Public Authorities. (90, Nordqvist, 2026)
6. Nordqvist, G. (2026). AI Threat: Are the Dystopias Coming True? Evidence, Risk and Response for European Enterprises and Public Authorities. (91, Nordqvist, 2026)
7. Nordqvist, G. (2026). The Transformed Security Architect: Role, Craft and Career in the Age of AI in European Enterprises and Public Authorities. (92, Nordqvist, 2026)
8. Nordqvist, G. (2026). AI Blue: How Artificial Intelligence Transforms the Blue Team in European Enterprises and Public Authorities. (94, Nordqvist, 2026)