\cleardoublepage \part{The Loop in Question} \setbookpart{The Loop in Question}

Part I: The Loop in Question

The earlier volumes of the series treated the loop between the team that emulates the adversary and the team that defends from one side each. AI Red Team gave it as the last step of a book organised by the Functions of NIST CSF 2.0 and defined the purple team as the joint loop, not a third team. AI Blue gave it as the second half of B5 Learn, what the security operations centre does with an exercise result. This book takes the loop itself as its subject, at a moment when AI sits on both sides of the table.

Part I sets the question and the frame. It describes the loop as it was, explains why that rhythm no longer fits, and defines the five stages, the records and the independence principle on which the rest of the book depends. Nothing in this part assumes that AI is the answer; it asks what the loop was for and whether AI helps or harms that purpose.

Chapters in this part:

  • Chapter 1, Introduction: The Purple Loop with AI, states the question, the five-part thesis and what would refute it, and gives reading paths.
  • Chapter 2, What the Loop Did Before, maps the penetration test, the red team exercise, the threat-led test, the tabletop, the purple session and breach-and-attack simulation, with the roles each involves and the places where findings stalled.
  • Chapter 3, The Pressure on the Loop, explains why machine-speed adversaries, fast-changing estates, decaying detections and scarce red-team hours make an annual test insufficient, and what AI makes cheaper.
  • Chapter 4, The Purple Loop Defined, defines the five stages P1 Target, P2 Emulate, P3 Observe, P4 Improve and P5 Verify, the closure rule, the degrees of delegation per stage and the independence principle.

Stages in this part. Part I frames all five stages. From Part II on, every chapter names, in its opening and its Summary, which stages it concerns, by their exact names.

The thread from the series. The technical design of adversary emulation and the five record states of the loop are those of AI Red Team, Chapters 12 and 26; the blue team's side of learning is that of AI Blue, Chapter 11. This part summarises them enough that the reader is not left with a gap and does not repeat them.

What you will learn in this part:

  • What each form of adversarial testing can and cannot show
  • Why the traditional rhythm was set by scarcity and is now under strain
  • What the five stages are, which record each produces and when a finding counts as closed
  • Why verification needs independence between the side that tests and the side that is tested

Part II follows the loop stage by stage.