References and Sources

This section lists the sources cited throughout the book. The numbered source index, ordered by source number, is the canonical bibliography: every inline citation of the form (N, author or organisation, year) links to the entry with that number. The index is grouped by category so that readers can locate European legislation, frameworks, threat assessments and practitioner literature quickly.

Entries 1 to 81 were carried over, without their back-links, from the bibliography of AI Blue (Book 8); the access dates recorded there are kept and every entry is re-verified with scripts/verify_sources.py before release. Sources that no chapter of this book cites are removed by scripts/renumber_sources.py --apply before merge, and the new sources of this book are added in the reserved ranges recorded in HANDOVER.md.

Numbered source index

AI-enabled threats and exploitation timelines

Source [61]: Charrier, C. & Weiner, R. (2024). How Low Can You Go? An Analysis of 2023 Time-to-Exploit Trends. Mandiant, Google Cloud Blog, 15 October 2024. Available at: https://cloud.google.com/blog/topics/threat-intelligence/time-to-exploit-trends-2023 (accessed 2026-11-01). Referenced in: Chapter 1: Introduction: The Purple Loop with AI, Chapter 3: The Pressure on the Loop: Machine-Speed Adversaries, Detection Decay and the Annual Test.
Source [62]: Mandiant (2026). M-Trends 2026: Data, Insights, and Strategies From the Frontlines. Google Cloud Blog, 23 March 2026. Available at: https://cloud.google.com/blog/topics/threat-intelligence/m-trends-2026 (accessed 2026-11-01). Referenced in: Chapter 3: The Pressure on the Loop: Machine-Speed Adversaries, Detection Decay and the Annual Test, Chapter 5: Target: Threat-Informed Scenarios, Risk and Priority Techniques.
Source [63]: Google Threat Intelligence Group (2026). GTIG AI Threat Tracker: Adversaries Leverage AI for Vulnerability Exploitation, Augmented Operations, and Initial Access. Google Cloud Blog, 11 May 2026. Available at: https://cloud.google.com/blog/topics/threat-intelligence/ai-vulnerability-exploitation-initial-access (accessed 2026-11-01). Referenced in: Chapter 1: Introduction: The Purple Loop with AI.
Source [64]: Google Threat Intelligence Group (2026). GTIG AI Threat Tracker: From Prompting to Autonomy – The Evolution of Adversarial AI. Google Cloud Blog, 8 September 2026. Available at: https://cloud.google.com/blog/topics/threat-intelligence/from-prompting-to-autonomy-the-evolution-of-adversarial-ai (accessed 2026-11-01). Referenced in: Chapter 25: The Future of the Loop: Will Red and Blue Be Separate Teams in 2036?.
Source [65]: Grunewald, R., Mazumdar, S. & Vanderlee, K. (2026). Vulnerability Discovery and Exploitation Trends in the AI Era. Google Threat Intelligence Group, Google Cloud Blog, 30 September 2026. Available at: https://cloud.google.com/blog/topics/threat-intelligence/vulnerability-discovery-and-exploitation-trends-in-the-ai-era (accessed 2026-11-01). Referenced in: Chapter 3: The Pressure on the Loop: Machine-Speed Adversaries, Detection Decay and the Annual Test, Chapter 8: Emulate Continuously: Breach-and-Attack Simulation, Atomic Tests and Automated Red Teaming, Chapter 25: The Future of the Loop: Will Red and Blue Be Separate Teams in 2036?.
Source [66]: Blum, Mainor, Nambiar et al. (2026). ARTEX and Friends: Enter Agentic Offensive Frameworks. Google Threat Intelligence Group and Mandiant, Google Cloud Blog, 30 October 2026. Available at: https://cloud.google.com/blog/topics/threat-intelligence/artex-and-friends-enter-agentic-offensive-frameworks (accessed 2026-11-01). Referenced in: Chapter 3: The Pressure on the Loop: Machine-Speed Adversaries, Detection Decay and the Annual Test, Chapter 7: Emulate: Adversary Emulation Plans, Human-Led and AI-Assisted, Chapter 14: An AI Agent Team for the Loop: Skills, Mandates and Containment, Chapter 25: The Future of the Loop: Will Red and Blue Be Separate Teams in 2036?.
Source [67]: Anthropic (2025). Disrupting the first reported AI-orchestrated cyber espionage campaign. 13 November 2025. Available at: https://www.anthropic.com/news/disrupting-AI-espionage (accessed 2026-11-01). Referenced in: Chapter 1: Introduction: The Purple Loop with AI, Chapter 7: Emulate: Adversary Emulation Plans, Human-Led and AI-Assisted.
Source [68]: Fang, R., Bindu, R., Gupta, A. & Kang, D. (2024). LLM Agents can Autonomously Exploit One-day Vulnerabilities. arXiv:2404.08144. Available at: https://arxiv.org/abs/2404.08144 (accessed 2026-11-01). Referenced in: Chapter 1: Introduction: The Purple Loop with AI, Chapter 7: Emulate: Adversary Emulation Plans, Human-Led and AI-Assisted.
Source [69]: Deng, G., Liu, Y., Mayoral-Vilches, V., Liu, P., Li, Y., Xu, Y., Zhang, T., Liu, Y., Pinzger, M. & Rass, S. (2024). PentestGPT: An LLM-empowered Automatic Penetration Testing Tool. arXiv:2308.06782 (first submitted August 2023, revised June 2024). Available at: https://arxiv.org/abs/2308.06782 (accessed 2026-11-10). Referenced in: Chapter 14: An AI Agent Team for the Loop: Skills, Mandates and Containment.

AI-assisted defence and vulnerability discovery

Source [70]: Defense Advanced Research Projects Agency (2025). AI Cyber Challenge marks pivotal inflection point for cyber defense. DARPA news release, 8 August 2025. Available at: https://www.darpa.mil/news/2025/aixcc-results (accessed 2026-11-10). Referenced in: Chapter 25: The Future of the Loop: Will Red and Blue Be Separate Teams in 2036?.

Agents, containment and AI incidents

Source [71]: Lynch, A., Wright, B., Larson, C., Troy, K. K., Ritchie, S. J., Mindermann, S., Perez, E. & Hubinger, E. (2025). Agentic Misalignment: How LLMs could be insider threats. Anthropic, 20 June 2025; arXiv:2510.05179. Available at: https://www.anthropic.com/research/agentic-misalignment (accessed 2026-11-01). Referenced in: Chapter 14: An AI Agent Team for the Loop: Skills, Mandates and Containment, Chapter 16: Defending the Loop's AI: Scenario Libraries, Findings and Emulation Agents as Tier 0.
Source [72]: OpenAI (2026). OpenAI – Hugging Face Incident Technical Report. 26 August 2026. Available at: https://cdn.openai.com/pdf/67869394-cb91-4c12-888c-5cbd85c7814c/OpenAI-Hugging-Face%20Incident-Technical-Report.pdf (accessed 2026-11-01). Referenced in: Chapter 6: Rules of Engagement and Safe Emulation: Scope, Blast Radius and the Stop Path, Chapter 7: Emulate: Adversary Emulation Plans, Human-Led and AI-Assisted, Chapter 12: Purple for AI Systems and Agents: Attacks on Models and Detections That Catch Them, Chapter 14: An AI Agent Team for the Loop: Skills, Mandates and Containment, Chapter 15: Independence: Verifying the Loop When AI Is on Both Sides, Chapter 16: Defending the Loop's AI: Scenario Libraries, Findings and Emulation Agents as Tier 0, Chapter 26: Case Studies and Anti-Patterns.
Source [73]: Larcher, H., Carreira, A. et al. (2026). Anatomy of a Frontier Lab Agent Intrusion: A Technical Timeline of the July 2026 Incident. Hugging Face blog, 27 July 2026. Available at: https://huggingface.co/blog/agent-intrusion-technical-timeline (accessed 2026-11-01). Referenced in: Chapter 1: Introduction: The Purple Loop with AI, Chapter 7: Emulate: Adversary Emulation Plans, Human-Led and AI-Assisted, Chapter 12: Purple for AI Systems and Agents: Attacks on Models and Detections That Catch Them, Chapter 13: Testing the Defenders' AI: SOC Agents, Playbooks and Providers' AI under Emulation, Chapter 14: An AI Agent Team for the Loop: Skills, Mandates and Containment, Chapter 15: Independence: Verifying the Loop When AI Is on Both Sides, Chapter 16: Defending the Loop's AI: Scenario Libraries, Findings and Emulation Agents as Tier 0, Chapter 22: Across Boundaries: Suppliers, Managed Providers, Sector Exercises and Authorities, Chapter 26: Case Studies and Anti-Patterns.
Source [74]: Wijk, H., Cotra, A. & Greenblatt, R. (2026). Brief independent investigation of agents' behavior, reasoning and collaboration in the OpenAI / Hugging Face hacking incident. METR, 26 August 2026; Greenblatt of Redwood Research contracted with METR. Available at: https://metr.org/blog/2026-08-26-openai-hugging-face-incident-investigation/; PDF https://metr.org/hugging-face-incident-report-aug-2026.pdf (accessed 2026-11-01). Referenced in: Chapter 7: Emulate: Adversary Emulation Plans, Human-Led and AI-Assisted, Chapter 12: Purple for AI Systems and Agents: Attacks on Models and Detections That Catch Them, Chapter 16: Defending the Loop's AI: Scenario Libraries, Findings and Emulation Agents as Tier 0, Chapter 26: Case Studies and Anti-Patterns.
Source [75]: Greshake, K., Abdelnabi, S., Mishra, S., Endres, C., Holz, T. & Fritz, M. (2023). Not what you've signed up for: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injection. arXiv:2302.12173, 23 February 2023. Available at: https://arxiv.org/abs/2302.12173 (accessed 2026-11-10). Referenced in: Chapter 9: Observe: Telemetry, Detection and Response Compared with Expectation, Chapter 13: Testing the Defenders' AI: SOC Agents, Playbooks and Providers' AI under Emulation.

Books and practitioner literature

Source [76]: Rinehart, A. & Shortridge, K. Security Chaos Engineering: Developing Resilience and Safety at Speed and Scale. O'Reilly Media, 2023. ISBN 978-1-098-11382-7. Referenced in: Chapter 8: Emulate Continuously: Breach-and-Attack Simulation, Atomic Tests and Automated Red Teaming, Chapter 15: Independence: Verifying the Loop When AI Is on Both Sides.
Source [77]: Basiri, A., Behnam, N., de Rooij, R., Hochstein, L., Kosewski, L., Reynolds, J. & Rosenthal, C. (2016). Chaos Engineering. IEEE Software 33(3), 35–41. Available at: https://doi.org/10.1109/MS.2016.60 (accessed 2026-11-02). Referenced in: Chapter 8: Emulate Continuously: Breach-and-Attack Simulation, Atomic Tests and Automated Red Teaming, Chapter 11: Verify: Re-test, Regression and Evidence, Chapter 15: Independence: Verifying the Loop When AI Is on Both Sides.
Source [78]: Principles of Chaos Engineering community. Principles of Chaos Engineering. Available at: https://principlesofchaos.org/ (accessed 2026-11-02). Referenced in: Chapter 11: Verify: Re-test, Regression and Evidence.
Source [79]: Microsoft. Penetration testing (Azure security fundamentals) and the Microsoft Cloud Unified Penetration Testing Rules of Engagement. Microsoft Learn, page last updated 24 July 2026. Available at: https://learn.microsoft.com/en-us/azure/security/fundamentals/pen-testing (accessed 2026-11-10). Referenced in: Chapter 1: Introduction: The Purple Loop with AI, Chapter 6: Rules of Engagement and Safe Emulation: Scope, Blast Radius and the Stop Path, Chapter 22: Across Boundaries: Suppliers, Managed Providers, Sector Exercises and Authorities, Chapter 26: Case Studies and Anti-Patterns.
Source [80]: Strathern, M. (1997). 'Improving ratings': audit in the British University system. European Review 5(3), 305-321. Cited for the formulation of Goodhart's law as "when a measure becomes a target, it ceases to be a good measure", which secondary accounts locate at p. 308; the full text was not accessible when checked and the abstract does not contain the sentence. Available at: https://econpapers.repec.org/RePEc:cup:eurrev:v:5:y:1997:i:03:p:305-321_00 (accessed 2026-11-10). Referenced in: Chapter 8: Emulate Continuously: Breach-and-Attack Simulation, Atomic Tests and Automated Red Teaming, Chapter 18: Measuring the Loop: Cycle Time, Yield, Re-test Pass Rate and the Metrics That Mislead, Chapter 25: The Future of the Loop: Will Red and Blue Be Separate Teams in 2036?, Chapter 26: Case Studies and Anti-Patterns.
Source [81]: Schneider, J. What are breach and attack simulations? IBM Think, vendor explainer by Josh Schneider, published 29 August 2024. Available at: https://www.ibm.com/think/topics/breach-attack-simulation (accessed 2026-11-10). Referenced in: Chapter 2: What the Loop Did Before: Penetration Tests, Red Teams, Tabletops and Purple Sessions.
Source [82]: Manheim, D. & Garrabrant, S. (2018, revised 2019). Categorizing Variants of Goodhart's Law. arXiv:1803.04585 (preprint). Distinguishes regressional, extremal, causal and adversarial variants of the effect that optimising a measure undermines it. Available at: https://arxiv.org/abs/1803.04585 (accessed 2026-11-10). Referenced in: Chapter 18: Measuring the Loop: Cycle Time, Yield, Re-test Pass Rate and the Metrics That Mislead.
Source [83]: Amazon Web Services. Penetration Testing. AWS Security, policy page (no publication date shown; footer 2026). Available at: https://aws.amazon.com/security/penetration-testing/ (accessed 2026-11-10). Referenced in: Chapter 22: Across Boundaries: Suppliers, Managed Providers, Sector Exercises and Authorities.
Source [84]: Google Cloud. Cloud Security FAQ (penetration testing of customers' own Google Cloud projects). Google Cloud Help, support.google.com. Available at: https://support.google.com/cloud/answer/6262505 (accessed 2026-11-10). Referenced in: Chapter 22: Across Boundaries: Suppliers, Managed Providers, Sector Exercises and Authorities.
Source [85]: Lunney, J. & Lueder, S. (2017). Postmortem Culture: Learning from Failure. Chapter 15 in Beyer, B., Jones, C., Petoff, J. & Murphy, N. R. (eds), Site Reliability Engineering: How Google Runs Production Systems. O'Reilly Media. Available at: https://sre.google/sre-book/postmortem-culture/ (accessed 2026-11-10). Referenced in: Chapter 23: Red and Blue as People: Trust, Incentives, Safety and Wellbeing.
Source [86]: Tetlock, P. E. (2005). Expert Political Judgment: How Good Is It? How Can We Know? Princeton University Press. ISBN 978-0-691-12302-8. Referenced in: Chapter 25: The Future of the Loop: Will Red and Blue Be Separate Teams in 2036?.

The Transformed Architecture and the author

Source [87]: Nordqvist, G. (2025). Architecture as Code. The Transformed Architecture, Book 1, published at aac.geon.se. Available at: https://aac.geon.se/ (accessed 2026-10-31). Referenced in: Chapter 1: Introduction: The Purple Loop with AI, Chapter 4: The Purple Loop Defined: Five Stages, Evidence and the Independence Principle, Chapter 5: Target: Threat-Informed Scenarios, Risk and Priority Techniques, Chapter 6: Rules of Engagement and Safe Emulation: Scope, Blast Radius and the Stop Path, Chapter 9: Observe: Telemetry, Detection and Response Compared with Expectation, Chapter 10: Improve: From Finding to Change in Detections, Controls, Playbooks and Mandates, Chapter 11: Verify: Re-test, Regression and Evidence, Chapter 16: Defending the Loop's AI: Scenario Libraries, Findings and Emulation Agents as Tier 0, Chapter 17: Coverage as a Claim: Technique Maps, Evidence Age and Detection Decay, Chapter 18: Measuring the Loop: Cycle Time, Yield, Re-test Pass Rate and the Metrics That Mislead, Chapter 19: Operating Models and Team Design: In-House, Contracted, Hybrid and Sovereign Loops, Chapter 24: Competences, Training and Keeping the Red Craft, Chapter 26: Case Studies and Anti-Patterns, Chapter 29: Conclusions: The Purple Loop with AI, About the Author.
Source [88]: Nordqvist, G. (2026). AI Governance: Governing Artificial Intelligence in European Enterprises and Public Authorities. The Transformed Architecture, Book 2, published at aig.geon.se. Available at: https://aig.geon.se/ (accessed 2026-11-01). Conceived and directed by Nordqvist; text written by AI agents. Referenced in: Chapter 2: What the Loop Did Before: Penetration Tests, Red Teams, Tabletops and Purple Sessions, Chapter 3: The Pressure on the Loop: Machine-Speed Adversaries, Detection Decay and the Annual Test, Chapter 6: Rules of Engagement and Safe Emulation: Scope, Blast Radius and the Stop Path, Chapter 7: Emulate: Adversary Emulation Plans, Human-Led and AI-Assisted, Chapter 11: Verify: Re-test, Regression and Evidence, Chapter 12: Purple for AI Systems and Agents: Attacks on Models and Detections That Catch Them, Chapter 14: An AI Agent Team for the Loop: Skills, Mandates and Containment, Chapter 15: Independence: Verifying the Loop When AI Is on Both Sides, Chapter 17: Coverage as a Claim: Technique Maps, Evidence Age and Detection Decay, Chapter 19: Operating Models and Team Design: In-House, Contracted, Hybrid and Sovereign Loops, Chapter 20: Decision Rights, Authorisation and the White Team, Chapter 21: Regulation as Constraint: DORA, TIBER-EU, NIS 2, the AI Act, the GDPR and Employee Rights, Chapter 22: Across Boundaries: Suppliers, Managed Providers, Sector Exercises and Authorities, Chapter 24: Competences, Training and Keeping the Red Craft, Chapter 25: The Future of the Loop: Will Red and Blue Be Separate Teams in 2036?, Chapter 26: Case Studies and Anti-Patterns, Chapter 28: Nordvik Region and Hansa Mutual: Conclusions for Two Organisations, About the Author.
Source [89]: Nordqvist, G. (2026). AI Platform and Security: Building and Securing AI Platforms in European Enterprises and Public Authorities. The Transformed Architecture, Book 3. Available at: https://aips.geon.se (accessed 2026-11-01). Conceived and directed by Nordqvist; text written by AI agents. Referenced in: Chapter 3: The Pressure on the Loop: Machine-Speed Adversaries, Detection Decay and the Annual Test, Chapter 6: Rules of Engagement and Safe Emulation: Scope, Blast Radius and the Stop Path, Chapter 7: Emulate: Adversary Emulation Plans, Human-Led and AI-Assisted, Chapter 8: Emulate Continuously: Breach-and-Attack Simulation, Atomic Tests and Automated Red Teaming, Chapter 11: Verify: Re-test, Regression and Evidence, Chapter 12: Purple for AI Systems and Agents: Attacks on Models and Detections That Catch Them, Chapter 14: An AI Agent Team for the Loop: Skills, Mandates and Containment, Chapter 16: Defending the Loop's AI: Scenario Libraries, Findings and Emulation Agents as Tier 0, Chapter 19: Operating Models and Team Design: In-House, Contracted, Hybrid and Sovereign Loops, Chapter 21: Regulation as Constraint: DORA, TIBER-EU, NIS 2, the AI Act, the GDPR and Employee Rights, Chapter 22: Across Boundaries: Suppliers, Managed Providers, Sector Exercises and Authorities, About the Author.
Source [90]: Nordqvist, G. (2026). AI Red Team: AI as an Active Part of Cyber Defence in European Enterprises and Public Authorities. The Transformed Architecture, Book 4, published at aired.geon.se. Available at: https://aired.geon.se/ (accessed 2026-11-10). Conceived and directed by Nordqvist; text written by AI agents. Referenced in: Chapter 1: Introduction: The Purple Loop with AI, Chapter 2: What the Loop Did Before: Penetration Tests, Red Teams, Tabletops and Purple Sessions, Chapter 4: The Purple Loop Defined: Five Stages, Evidence and the Independence Principle, Chapter 5: Target: Threat-Informed Scenarios, Risk and Priority Techniques, Chapter 6: Rules of Engagement and Safe Emulation: Scope, Blast Radius and the Stop Path, Chapter 7: Emulate: Adversary Emulation Plans, Human-Led and AI-Assisted, Chapter 8: Emulate Continuously: Breach-and-Attack Simulation, Atomic Tests and Automated Red Teaming, Chapter 9: Observe: Telemetry, Detection and Response Compared with Expectation, Chapter 10: Improve: From Finding to Change in Detections, Controls, Playbooks and Mandates, Chapter 11: Verify: Re-test, Regression and Evidence, Chapter 12: Purple for AI Systems and Agents: Attacks on Models and Detections That Catch Them, Chapter 13: Testing the Defenders' AI: SOC Agents, Playbooks and Providers' AI under Emulation, Chapter 14: An AI Agent Team for the Loop: Skills, Mandates and Containment, Chapter 15: Independence: Verifying the Loop When AI Is on Both Sides, Chapter 16: Defending the Loop's AI: Scenario Libraries, Findings and Emulation Agents as Tier 0, Chapter 17: Coverage as a Claim: Technique Maps, Evidence Age and Detection Decay, Chapter 18: Measuring the Loop: Cycle Time, Yield, Re-test Pass Rate and the Metrics That Mislead, Chapter 20: Decision Rights, Authorisation and the White Team, Chapter 22: Across Boundaries: Suppliers, Managed Providers, Sector Exercises and Authorities, Chapter 23: Red and Blue as People: Trust, Incentives, Safety and Wellbeing, Chapter 25: The Future of the Loop: Will Red and Blue Be Separate Teams in 2036?, Chapter 28: Nordvik Region and Hansa Mutual: Conclusions for Two Organisations, Chapter 29: Conclusions: The Purple Loop with AI, About the Author.
Source [91]: Nordqvist, G. (2026). AI Threat: Are the Dystopias Coming True? Evidence, Risk and Response for European Enterprises and Public Authorities. The Transformed Architecture, Book 5, published at aithreat.geon.se. Available at: https://aithreat.geon.se/ (accessed 2026-11-10). Conceived and directed by Nordqvist; text written by AI agents. Referenced in: Chapter 1: Introduction: The Purple Loop with AI, Chapter 3: The Pressure on the Loop: Machine-Speed Adversaries, Detection Decay and the Annual Test, Chapter 4: The Purple Loop Defined: Five Stages, Evidence and the Independence Principle, Chapter 5: Target: Threat-Informed Scenarios, Risk and Priority Techniques, Chapter 6: Rules of Engagement and Safe Emulation: Scope, Blast Radius and the Stop Path, Chapter 7: Emulate: Adversary Emulation Plans, Human-Led and AI-Assisted, Chapter 8: Emulate Continuously: Breach-and-Attack Simulation, Atomic Tests and Automated Red Teaming, Chapter 11: Verify: Re-test, Regression and Evidence, Chapter 12: Purple for AI Systems and Agents: Attacks on Models and Detections That Catch Them, Chapter 13: Testing the Defenders' AI: SOC Agents, Playbooks and Providers' AI under Emulation, Chapter 14: An AI Agent Team for the Loop: Skills, Mandates and Containment, Chapter 15: Independence: Verifying the Loop When AI Is on Both Sides, Chapter 17: Coverage as a Claim: Technique Maps, Evidence Age and Detection Decay, Chapter 18: Measuring the Loop: Cycle Time, Yield, Re-test Pass Rate and the Metrics That Mislead, Chapter 20: Decision Rights, Authorisation and the White Team, Chapter 21: Regulation as Constraint: DORA, TIBER-EU, NIS 2, the AI Act, the GDPR and Employee Rights, Chapter 23: Red and Blue as People: Trust, Incentives, Safety and Wellbeing, Chapter 24: Competences, Training and Keeping the Red Craft, Chapter 25: The Future of the Loop: Will Red and Blue Be Separate Teams in 2036?, Chapter 26: Case Studies and Anti-Patterns, Chapter 27: A Year in the Loop: Nordvik Region and Hansa Mutual, Chapter 28: Nordvik Region and Hansa Mutual: Conclusions for Two Organisations, Chapter 29: Conclusions: The Purple Loop with AI, About the Author.
Source [92]: Nordqvist, G. (2026). The Transformed Security Architect: Role, Craft and Career in the Age of AI in European Enterprises and Public Authorities. The Transformed Architecture, Book 6, published at tsa.geon.se. Available at: https://tsa.geon.se/ (accessed 2026-11-10). Conceived and directed by Nordqvist; text written by AI agents. Referenced in: Chapter 1: Introduction: The Purple Loop with AI, Chapter 4: The Purple Loop Defined: Five Stages, Evidence and the Independence Principle, Chapter 10: Improve: From Finding to Change in Detections, Controls, Playbooks and Mandates, Chapter 14: An AI Agent Team for the Loop: Skills, Mandates and Containment, Chapter 15: Independence: Verifying the Loop When AI Is on Both Sides, Chapter 19: Operating Models and Team Design: In-House, Contracted, Hybrid and Sovereign Loops, Chapter 20: Decision Rights, Authorisation and the White Team, Chapter 21: Regulation as Constraint: DORA, TIBER-EU, NIS 2, the AI Act, the GDPR and Employee Rights, Chapter 23: Red and Blue as People: Trust, Incentives, Safety and Wellbeing, Chapter 24: Competences, Training and Keeping the Red Craft, Chapter 25: The Future of the Loop: Will Red and Blue Be Separate Teams in 2036?, Chapter 28: Nordvik Region and Hansa Mutual: Conclusions for Two Organisations, About the Author.
Source [93]: Nordqvist, G. (2026). AI Boss: When Artificial Intelligence Manages People in European Enterprises and Public Authorities. The Transformed Architecture, Book 7, published at aiboss.geon.se. Available at: https://aiboss.geon.se/ (accessed 2026-11-10). Conceived and directed by Nordqvist; text written by AI agents. Referenced in: Chapter 6: Rules of Engagement and Safe Emulation: Scope, Blast Radius and the Stop Path, Chapter 12: Purple for AI Systems and Agents: Attacks on Models and Detections That Catch Them, Chapter 15: Independence: Verifying the Loop When AI Is on Both Sides, Chapter 18: Measuring the Loop: Cycle Time, Yield, Re-test Pass Rate and the Metrics That Mislead, Chapter 20: Decision Rights, Authorisation and the White Team, Chapter 21: Regulation as Constraint: DORA, TIBER-EU, NIS 2, the AI Act, the GDPR and Employee Rights, Chapter 23: Red and Blue as People: Trust, Incentives, Safety and Wellbeing, Chapter 24: Competences, Training and Keeping the Red Craft, Chapter 29: Conclusions: The Purple Loop with AI, About the Author.
Source [94]: Nordqvist, G. (2026). AI Blue: How Artificial Intelligence Transforms the Blue Team in European Enterprises and Public Authorities. The Transformed Architecture, Book 8, published at aiblue.geon.se. Available at: https://aiblue.geon.se/ (accessed 2026-11-10). Conceived and directed by Nordqvist; text written by AI agents. Referenced in: Chapter 1: Introduction: The Purple Loop with AI, Chapter 2: What the Loop Did Before: Penetration Tests, Red Teams, Tabletops and Purple Sessions, Chapter 3: The Pressure on the Loop: Machine-Speed Adversaries, Detection Decay and the Annual Test, Chapter 4: The Purple Loop Defined: Five Stages, Evidence and the Independence Principle, Chapter 5: Target: Threat-Informed Scenarios, Risk and Priority Techniques, Chapter 6: Rules of Engagement and Safe Emulation: Scope, Blast Radius and the Stop Path, Chapter 8: Emulate Continuously: Breach-and-Attack Simulation, Atomic Tests and Automated Red Teaming, Chapter 9: Observe: Telemetry, Detection and Response Compared with Expectation, Chapter 10: Improve: From Finding to Change in Detections, Controls, Playbooks and Mandates, Chapter 11: Verify: Re-test, Regression and Evidence, Chapter 12: Purple for AI Systems and Agents: Attacks on Models and Detections That Catch Them, Chapter 13: Testing the Defenders' AI: SOC Agents, Playbooks and Providers' AI under Emulation, Chapter 14: An AI Agent Team for the Loop: Skills, Mandates and Containment, Chapter 15: Independence: Verifying the Loop When AI Is on Both Sides, Chapter 16: Defending the Loop's AI: Scenario Libraries, Findings and Emulation Agents as Tier 0, Chapter 17: Coverage as a Claim: Technique Maps, Evidence Age and Detection Decay, Chapter 18: Measuring the Loop: Cycle Time, Yield, Re-test Pass Rate and the Metrics That Mislead, Chapter 19: Operating Models and Team Design: In-House, Contracted, Hybrid and Sovereign Loops, Chapter 20: Decision Rights, Authorisation and the White Team, Chapter 21: Regulation as Constraint: DORA, TIBER-EU, NIS 2, the AI Act, the GDPR and Employee Rights, Chapter 22: Across Boundaries: Suppliers, Managed Providers, Sector Exercises and Authorities, Chapter 23: Red and Blue as People: Trust, Incentives, Safety and Wellbeing, Chapter 24: Competences, Training and Keeping the Red Craft, Chapter 25: The Future of the Loop: Will Red and Blue Be Separate Teams in 2036?, Chapter 26: Case Studies and Anti-Patterns, Chapter 27: A Year in the Loop: Nordvik Region and Hansa Mutual, Chapter 28: Nordvik Region and Hansa Mutual: Conclusions for Two Organisations, Chapter 29: Conclusions: The Purple Loop with AI, About the Author.
Source [95]: Kvadrat AB. Kvadrat – Sweden's largest network of self-employed consultants. Available at: https://www.kvadrat.se/ (accessed 2026-10-31). Referenced in: About the Author.

Security operations, workforce and automation research

Source [96]: Alahmadi, B. A., Axon, L. & Martinovic, I. (2022). 99% False Positives: A Qualitative Study of SOC Analysts' Perspectives on Security Alarms. 31st USENIX Security Symposium, pp. 2783-2800. Available at: https://www.usenix.org/conference/usenixsecurity22/presentation/alahmadi (accessed 2026-11-10). Referenced in: Chapter 8: Emulate Continuously: Breach-and-Attack Simulation, Atomic Tests and Automated Red Teaming, Chapter 9: Observe: Telemetry, Detection and Response Compared with Expectation, Chapter 10: Improve: From Finding to Change in Detections, Controls, Playbooks and Mandates, Chapter 15: Independence: Verifying the Loop When AI Is on Both Sides, Chapter 23: Red and Blue as People: Trust, Incentives, Safety and Wellbeing.
Source [97]: Sundaramurthy, S. C., Bardas, A. G., Case, J., Ou, X., Wesch, M., McHugh, J. & Rajagopalan, S. R. (2015). A Human Capital Model for Mitigating Security Analyst Burnout. Eleventh Symposium On Usable Privacy and Security (SOUPS 2015), pp. 347-359. Available at: https://www.usenix.org/conference/soups2015/proceedings/presentation/sundaramurthy (accessed 2026-11-10). Referenced in: Chapter 23: Red and Blue as People: Trust, Incentives, Safety and Wellbeing.
Source [98]: Tariq, S., Baruwal Chhetri, M., Nepal, S. & Paris, C. (2025). Alert Fatigue in Security Operations Centres: Research Challenges and Opportunities. ACM Computing Surveys 57(9). DOI: 10.1145/3723158 (accessed 2026-11-10). Referenced in: Chapter 8: Emulate Continuously: Breach-and-Attack Simulation, Atomic Tests and Automated Red Teaming, Chapter 9: Observe: Telemetry, Detection and Response Compared with Expectation, Chapter 10: Improve: From Finding to Change in Detections, Controls, Playbooks and Mandates, Chapter 15: Independence: Verifying the Loop When AI Is on Both Sides.
Source [99]: ISC2 (2025). 2025 Cybersecurity Workforce Study. Announced 4 December 2025; online survey of 16,029 practitioners and decision-makers, May-June 2025. Available at: https://www.isc2.org/Insights/2025/12/ISC2-publishes-2025-cybersecurity-workforce-study (accessed 2026-11-10). Referenced in: Chapter 3: The Pressure on the Loop: Machine-Speed Adversaries, Detection Decay and the Annual Test, Chapter 23: Red and Blue as People: Trust, Incentives, Safety and Wellbeing, Chapter 24: Competences, Training and Keeping the Red Craft, Chapter 25: The Future of the Loop: Will Red and Blue Be Separate Teams in 2036?.
Source [100]: Bainbridge, L. (1983). Ironies of Automation. Automatica 19(6), 775-779. DOI: 10.1016/0005-1098(83)90046-8 (accessed 2026-11-10). Referenced in: Chapter 7: Emulate: Adversary Emulation Plans, Human-Led and AI-Assisted, Chapter 8: Emulate Continuously: Breach-and-Attack Simulation, Atomic Tests and Automated Red Teaming, Chapter 10: Improve: From Finding to Change in Detections, Controls, Playbooks and Mandates, Chapter 13: Testing the Defenders' AI: SOC Agents, Playbooks and Providers' AI under Emulation, Chapter 14: An AI Agent Team for the Loop: Skills, Mandates and Containment, Chapter 15: Independence: Verifying the Loop When AI Is on Both Sides, Chapter 23: Red and Blue as People: Trust, Incentives, Safety and Wellbeing, Chapter 24: Competences, Training and Keeping the Red Craft, Chapter 25: The Future of the Loop: Will Red and Blue Be Separate Teams in 2036?, Chapter 26: Case Studies and Anti-Patterns, Chapter 29: Conclusions: The Purple Loop with AI.
Source [101]: Parasuraman, R. & Manzey, D. H. (2010). Complacency and Bias in Human Use of Automation: An Attentional Integration. Human Factors 52(3), 381-410. DOI: 10.1177/0018720810376055 (accessed 2026-11-10). Referenced in: Chapter 4: The Purple Loop Defined: Five Stages, Evidence and the Independence Principle, Chapter 5: Target: Threat-Informed Scenarios, Risk and Priority Techniques, Chapter 7: Emulate: Adversary Emulation Plans, Human-Led and AI-Assisted, Chapter 8: Emulate Continuously: Breach-and-Attack Simulation, Atomic Tests and Automated Red Teaming, Chapter 9: Observe: Telemetry, Detection and Response Compared with Expectation, Chapter 10: Improve: From Finding to Change in Detections, Controls, Playbooks and Mandates, Chapter 11: Verify: Re-test, Regression and Evidence, Chapter 13: Testing the Defenders' AI: SOC Agents, Playbooks and Providers' AI under Emulation, Chapter 14: An AI Agent Team for the Loop: Skills, Mandates and Containment, Chapter 15: Independence: Verifying the Loop When AI Is on Both Sides, Chapter 23: Red and Blue as People: Trust, Incentives, Safety and Wellbeing, Chapter 24: Competences, Training and Keeping the Red Craft, Chapter 25: The Future of the Loop: Will Red and Blue Be Separate Teams in 2036?.
Source [102]: European Union Agency for Cybersecurity (2022). European Cybersecurity Skills Framework (ECSF) Role Profiles. ENISA, 19 September 2022. Available at: https://www.enisa.europa.eu/publications/european-cybersecurity-skills-framework-role-profiles (accessed 2026-11-10). Referenced in: Chapter 19: Operating Models and Team Design: In-House, Contracted, Hybrid and Sovereign Loops, Chapter 24: Competences, Training and Keeping the Red Craft.
Source [103]: SFIA Foundation (2024). SFIA 9: the global skills and competency framework for the digital world. Released October 2024. Available at: https://sfia-online.org/en/sfia-9 (accessed 2026-11-10). Referenced in: Chapter 19: Operating Models and Team Design: In-House, Contracted, Hybrid and Sovereign Loops, Chapter 24: Competences, Training and Keeping the Red Craft.
Source [104]: Kim, E., Garg, A., Peng, K. & Garg, N. (2025). Correlated Errors in Large Language Models. Proceedings of the 42nd International Conference on Machine Learning (ICML 2025); arXiv:2506.07962. Available at: https://arxiv.org/abs/2506.07962 (accessed 2026-11-10). Referenced in: Chapter 1: Introduction: The Purple Loop with AI, Chapter 15: Independence: Verifying the Loop When AI Is on Both Sides, Chapter 25: The Future of the Loop: Will Red and Blue Be Separate Teams in 2036?, Chapter 26: Case Studies and Anti-Patterns, Chapter 29: Conclusions: The Purple Loop with AI.
Source [105]: Needham, J., Edkins, G., Pimpale, G., Bartsch, H. & Hobbhahn, M. (2025). Large Language Models Often Know When They Are Being Evaluated. arXiv:2505.23836, revised 16 July 2025. Available at: https://arxiv.org/abs/2505.23836 (accessed 2026-11-10). Referenced in: Chapter 4: The Purple Loop Defined: Five Stages, Evidence and the Independence Principle, Chapter 15: Independence: Verifying the Loop When AI Is on Both Sides, Chapter 25: The Future of the Loop: Will Red and Blue Be Separate Teams in 2036?, Chapter 26: Case Studies and Anti-Patterns, Chapter 29: Conclusions: The Purple Loop with AI.
Source [106]: Panickssery, A., Bowman, S. R. & Feng, S. (2024). LLM Evaluators Recognize and Favor Their Own Generations. arXiv:2404.13076 (preprint). Available at: https://arxiv.org/abs/2404.13076 (accessed 2026-11-10). Referenced in: Chapter 1: Introduction: The Purple Loop with AI, Chapter 15: Independence: Verifying the Loop When AI Is on Both Sides, Chapter 25: The Future of the Loop: Will Red and Blue Be Separate Teams in 2036?, Chapter 26: Case Studies and Anti-Patterns, Chapter 29: Conclusions: The Purple Loop with AI.
Source [107]: AppSec Labs (2026). We checked 1,237 fixes. One in four was not fixed. AppSec Labs blog, 4 August 2026. Vendor analysis of its own engagement records, October 2021 to August 2026; retesting is client-initiated and the vendor includes retesting in its engagements, so the sample is not independent. Available at: https://appsec-labs.com/we-checked-1237-fixes/ (accessed 2026-11-10). Referenced in: Chapter 2: What the Loop Did Before: Penetration Tests, Red Teams, Tabletops and Purple Sessions.
Source [108]: Zorz, M. (2025). Weak alerting and slipping prevention raise risk levels for CISOs. Help Net Security, 18 August 2025, reporting the Picus Security Blue Report 2025 (vendor-published; over 160 million simulated attacks run January to June 2025; not peer reviewed). Available at: https://www.helpnetsecurity.com/2025/08/18/ciso-cybersecurity-prevention-effectiveness/ (accessed 2026-11-10). Referenced in: Chapter 3: The Pressure on the Loop: Machine-Speed Adversaries, Detection Decay and the Annual Test.
Source [109]: Edmondson, A. (1999). Psychological Safety and Learning Behavior in Work Teams. Administrative Science Quarterly 44(2), 350-383. DOI: 10.2307/2666999 (accessed 2026-11-10). Referenced in: Chapter 23: Red and Blue as People: Trust, Incentives, Safety and Wellbeing.
Source [110]: Bernstein, E. S. (2012). The Transparency Paradox: A Role for Privacy in Organizational Learning and Operational Control. Administrative Science Quarterly 57(2), 181-216. DOI: 10.1177/0001839212453028 (accessed 2026-11-10). Referenced in: Chapter 23: Red and Blue as People: Trust, Incentives, Safety and Wellbeing.
Source [111]: Lain, D., Kostiainen, K. & Capkun, S. (2022). Phishing in Organizations: Findings from a Large-Scale and Long-Term Study. IEEE Symposium on Security and Privacy 2022; arXiv:2112.07498. Available at: https://arxiv.org/abs/2112.07498 (accessed 2026-11-10). Referenced in: Chapter 23: Red and Blue as People: Trust, Incentives, Safety and Wellbeing.
Source [112]: Ho, G., Mirian, A., Luo, E., Tong, K., Lee, E., Liu, L., Longhurst, C. A., Dameff, C., Savage, S. & Voelker, G. M. (2025). Understanding the Efficacy of Phishing Training in Practice. Proceedings of the 2025 IEEE Symposium on Security and Privacy, pp. 37-54. DOI: 10.1109/SP61157.2025.00076 (accessed 2026-11-10). Referenced in: Chapter 23: Red and Blue as People: Trust, Incentives, Safety and Wellbeing.
Source [113]: Happe, A. & Cito, J. (2023). Understanding Hackers' Work: An Empirical Study of Offensive Security Practitioners. arXiv:2308.07057 (preprint). Available at: https://arxiv.org/abs/2308.07057 (accessed 2026-11-10). Referenced in: Chapter 23: Red and Blue as People: Trust, Incentives, Safety and Wellbeing.
Source [114]: Karasek, R. A. (1979). Job Demands, Job Decision Latitude, and Mental Strain: Implications for Job Redesign. Administrative Science Quarterly 24(2), 285-308. DOI: 10.2307/2392498 (accessed 2026-11-10). Referenced in: Chapter 23: Red and Blue as People: Trust, Incentives, Safety and Wellbeing.
Source [115]: Budzyń, K., Romańczyk, M., Kitala, D., Kołodziej, P., Bugajski, M., Adami, H. O., Blom, J., Buszkiewicz, M., Halvorsen, N., Hassan, C. et al. (2025). Endoscopist deskilling risk after exposure to artificial intelligence in colonoscopy: a multicentre, observational study. The Lancet Gastroenterology & Hepatology 10(10), 896-903. DOI: 10.1016/S2468-1253(25)00133-5 (accessed 2026-11-10). Referenced in: Chapter 23: Red and Blue as People: Trust, Incentives, Safety and Wellbeing, Chapter 24: Competences, Training and Keeping the Red Craft, Chapter 29: Conclusions: The Purple Loop with AI.
Source [116]: Bastani, H., Bastani, O., Sungu, A., Ge, H., Kabakcı, Ö. & Mariman, R. (2025). Generative AI without guardrails can harm learning: Evidence from high school mathematics. Proceedings of the National Academy of Sciences 122(26), e2422633122. DOI: 10.1073/pnas.2422633122 (accessed 2026-11-10). Referenced in: Chapter 24: Competences, Training and Keeping the Red Craft, Chapter 29: Conclusions: The Purple Loop with AI.
Source [117]: Shen, J. H. & Tamkin, A. (2026). How AI Impacts Skill Formation. arXiv:2601.20245, submitted 28 January 2026, revised 1 February 2026. Preprint. Available at: https://arxiv.org/abs/2601.20245 (accessed 2026-11-10). Referenced in: Chapter 24: Competences, Training and Keeping the Red Craft, Chapter 29: Conclusions: The Purple Loop with AI.
Source [118]: Brynjolfsson, E., Li, D. & Raymond, L. R. (2025). Generative AI at Work. The Quarterly Journal of Economics 140(2), 889-942. DOI: 10.1093/qje/qjae044; working-paper version NBER Working Paper 31161 (accessed 2026-11-10). Referenced in: Chapter 24: Competences, Training and Keeping the Red Craft.
Source [119]: Kirk, J. (2020). Iowa Drops Trespassing Charges Against Penetration Testers. BankInfoSecurity, 3 February 2020. Available at: https://www.bankinfosecurity.com/iowa-drops-trespassing-charges-against-penetration-testers-a-13676 (accessed 2026-11-10). Referenced in: Chapter 26: Case Studies and Anti-Patterns.
Source [120]: VB Staff (2022). Report: 80% of cyberattack techniques evade detection by SIEMs. VentureBeat, 19 May 2022 (reporting the second annual State of SIEM Detection Risk report of CardinalOps). Available at: https://venturebeat.com/security/report-80-of-cyberattack-techniques-evade-detection-by-siems (accessed 2026-11-10). Referenced in: Chapter 26: Case Studies and Anti-Patterns.
Source [121]: Bundesarbeitsgericht (2024). Beschluss vom 16. Juli 2024, 1 ABR 16/23 (Technische Überwachungseinrichtung – Headset-System – betriebliche Mitbestimmung – Gesamtbetriebsrat). ECLI:DE:BAG:2024:160724.B.1ABR16.23.0. Bundesarbeitsgericht. Available at: https://www.bundesarbeitsgericht.de/entscheidung/1-abr-16-23/ (accessed 2026-11-14). Referenced in: Chapter 1: Introduction: The Purple Loop with AI, Chapter 6: Rules of Engagement and Safe Emulation: Scope, Blast Radius and the Stop Path, Chapter 18: Measuring the Loop: Cycle Time, Yield, Re-test Pass Rate and the Metrics That Mislead, Chapter 21: Regulation as Constraint: DORA, TIBER-EU, NIS 2, the AI Act, the GDPR and Employee Rights, Chapter 23: Red and Blue as People: Trust, Incentives, Safety and Wellbeing.
Source [122]: European Central Bank (2022). TIBER-EU Purple Teaming Best Practices. ECB, July 2022 (the publication carries the note that it has become outdated; the January 2025 guidance, source 34, supersedes it). Available at: https://www.ecb.europa.eu/pub/pdf/other/ecb.tiber_eu_purple_best_practices.20220809~0b677a75c7.en.pdf (accessed 2026-11-14). Referenced in: Chapter 20: Decision Rights, Authorisation and the White Team, Chapter 21: Regulation as Constraint: DORA, TIBER-EU, NIS 2, the AI Act, the GDPR and Employee Rights.

How to cite

Inline citations give the source number, the author or organisation, and the year, for example (9, MITRE, n.d.), and link to the entry here. Where an author is named in the sentence, the citation carries the year. Each chapter closes with a ## Sources section that lists the works it cites, using the same numbering as this bibliography. New sources are appended to the appropriate category with the next free number; existing numbers are never reused.