\cleardoublepage \part{The Loop Meets AI Systems} \setbookpart{The Loop Meets AI Systems}

Part III: The Loop Meets AI Systems

Until now the loop has been described for an estate in general. Part III applies it to the estate's AI. An organisation that deploys AI systems and agents has new things to test, and a new kind of evidence to read: telemetry from the AI gateway and the agent runtime, and the behaviour of models and tools that read text an adversary can write. An organisation that has put AI into its security operations has something further to test: the investigation, triage and drafting agents of the blue team, the playbooks they run and the provider's AI that closes alerts on its own.

The part has two chapters because the two problems differ. Testing an organisation's AI systems asks whether the defenders can see and stop attacks on them. Testing the defenders' AI asks whether the defence still works when its own agents are in the path. Both use the loop, and both depend on the independence principle that Part IV develops.

Chapters in this part:

  • Chapter 12, Purple for AI Systems and Agents, treats P1 Target to P5 Verify for the organisation's own AI: telemetry from the platform, detections for tool misuse and permission-ceiling breaches, and the path from an AI red-teaming finding to a detection and a regression case.
  • Chapter 13, Testing the Defenders' AI, treats P2 Emulate to P5 Verify for SOC agents, playbooks, stop paths and providers' AI, including injected tests written into managed-service contracts.

Stages in this part. Chapter 12 concerns all five stages; Chapter 13 concerns P2 to P5, because the choice of what to test follows from the earlier chapters.

The thread from the series. Testing and securing AI systems are treated in AI Red Team, Chapter 13, and AI Platform and Security, Chapters 16, 17 and 20. The blue team's agent team, its verification and its protection are treated in AI Blue, Chapters 13 to 15. This part adds the loop that joins them and does not repeat the technical designs.

What you will learn in this part:

  • What the AI platform emits that a detection can read, and what to detect
  • How an AI red-teaming finding becomes a detection and a regression case
  • How to seed incidents from emulation and test an agent, its stop path and its mandate
  • How to test a provider's AI through the contract

Part IV turns to the loop's own AI and to the rule that governs it.