\cleardoublepage \part{The Stages of the Loop} \setbookpart{The Stages of the Loop}

Part II: The Stages of the Loop

The five stages of the purple loop are one cycle: scenarios are chosen, emulated, observed, turned into changes and verified, and every verification feeds the next choice of scenarios. This part follows the cycle and shows, stage by stage, what AI changes in the daily work, what stays with people and which records carry the work.

It begins with P1 Target, the choice of threat-informed scenarios and priority techniques, and the rules of engagement that decide what may run at all. It continues with P2 Emulate, first as a human-led, AI-assisted campaign and then as a continuous pipeline, where the book stages its first debate. It then follows the result through P3 Observe, where what happened is compared with what was expected, P4 Improve, where a finding becomes a change, and P5 Verify, where the change is re-tested and the evidence is attached.

Chapters in this part:

  • Chapter 5, Target, treats P1 Target: scenarios from intelligence, the threat register and incidents, and the scenario record.
  • Chapter 6, Rules of Engagement and Safe Emulation, treats P1 Target and P2 Emulate: authority, scope, blast radius, third-party consent and the stop path outside the emulating system.
  • Chapter 7, Emulate, treats P2 Emulate as a campaign: plans, roles in a live exercise and where AI helps.
  • Chapter 8, Emulate Continuously, treats P2 Emulate as a pipeline and stages the debate on whether continuous automated emulation replaces the human red team.
  • Chapter 9, Observe, treats P3 Observe (touching P2 Emulate for its input): expectation first, ground truth, an outcome taxonomy, the purple session and the finding record.
  • Chapter 10, Improve, treats P4 Improve (touching P3 Observe and P5 Verify): the finding and change records, choosing the right kind of change and reviewing AI-drafted changes.
  • Chapter 11, Verify, treats P5 Verify (touching P2 Emulate, P3 Observe and P4 Improve): the closure rule, the re-test, regression cases, variants and evidence as code.

Stages in this part. Each chapter names the stages it concerns, by their exact names. Together they cover P1 to P5.

The thread from the series. The technical designs of emulation and of the five record states are those of AI Red Team, Chapters 12 and 26; detection engineering, playbooks and agent mandates are those of AI Blue, Chapters 6, 10 and 13. This part takes them as given and describes the work of the loop between them.

What you will learn in this part:

  • How a scenario is chosen, bounded and run safely
  • How results are compared with expectation and classified
  • How a finding becomes a detection, control, playbook or mandate
  • When a finding is closed, and how closure stays closed

Part III applies the loop to AI systems and to the defenders' own AI.