Cover of AI Purple

Book 9 · Presentation

AI Purple

How Red and Blue Learn Together When AI Joins the Loop in European Enterprises and Public Authorities

70 slidesPowerPoint · 3.8 MB

Download the deck (.pptx) Read the book online

All presentations / AI Purple

All slides

Select a slide to see it larger; use the arrow keys to move through the deck.

  1. Slide 1: AI Purple1
  2. Slide 2: The Loop in Question2
  3. Slide 3: Introduction: The Purple Loop with AI3
  4. Slide 4: Introduction: The Purple Loop with AI4
  5. Slide 5: What the Loop Did Before: Penetration Tests, Red Teams, Tabletops and Purple Sessions5
  6. Slide 6: The six forms of testing and the stage each usually leaves unfinished6
  7. Slide 7: The Pressure on the Loop: Machine-Speed Adversaries, Detection Decay and the Annual Test7
  8. Slide 8: The Pressure on the Loop: Machine-Speed Adversaries, Detection Decay and the Annual Test8
  9. Slide 9: The Purple Loop Defined: Five Stages, Evidence and the Independence Principle9
  10. Slide 10: The Purple Loop Defined: Five Stages, Evidence and the Independence Principle10
  11. Slide 11: The Stages of the Loop11
  12. Slide 12: Target: Threat-Informed Scenarios, Risk and Priority Techniques12
  13. Slide 13: Target: Threat-Informed Scenarios, Risk and Priority Techniques13
  14. Slide 14: Rules of Engagement and Safe Emulation: Scope, Blast Radius and the Stop Path14
  15. Slide 15: Rules of Engagement and Safe Emulation: Scope, Blast Radius and the Stop Path15
  16. Slide 16: Emulate: Adversary Emulation Plans, Human-Led and AI-Assisted16
  17. Slide 17: Emulate: Adversary Emulation Plans, Human-Led and AI-Assisted17
  18. Slide 18: Emulate Continuously: Breach-and-Attack Simulation, Atomic Tests and Automated Red Teaming18
  19. Slide 19: Emulate Continuously: Breach-and-Attack Simulation, Atomic Tests and Automated Red Teaming19
  20. Slide 20: Observe: Telemetry, Detection and Response Compared with Expectation20
  21. Slide 21: Observe: Telemetry, Detection and Response Compared with Expectation21
  22. Slide 22: Improve: From Finding to Change in Detections, Controls, Playbooks and Mandates22
  23. Slide 23: Improve: From Finding to Change in Detections, Controls, Playbooks and Mandates23
  24. Slide 24: Verify: Re-test, Regression and Evidence24
  25. Slide 25: Verify: Re-test, Regression and Evidence25
  26. Slide 26: The Loop Meets AI Systems26
  27. Slide 27: Purple for AI Systems and Agents: Attacks on Models and Detections That Catch Them27
  28. Slide 28: Purple for AI Systems and Agents: Attacks on Models and Detections That Catch Them28
  29. Slide 29: Testing the Defenders' AI: SOC Agents, Playbooks and Providers' AI under Emulation29
  30. Slide 30: Testing the Defenders' AI: SOC Agents, Playbooks and Providers' AI under Emulation30
  31. Slide 31: The Loop's Own AI31
  32. Slide 32: An AI Agent Team for the Loop: Skills, Mandates and Containment32
  33. Slide 33: An AI Agent Team for the Loop: Skills, Mandates and Containment33
  34. Slide 34: Independence: Verifying the Loop When AI Is on Both Sides34
  35. Slide 35: Independence: Verifying the Loop When AI Is on Both Sides35
  36. Slide 36: Defending the Loop's AI: Scenario Libraries, Findings and Emulation Agents as Tier 036
  37. Slide 37: Defending the Loop's AI: Scenario Libraries, Findings and Emulation Agents as Tier 037
  38. Slide 38: The Loop in the Organisation38
  39. Slide 39: Coverage as a Claim: Technique Maps, Evidence Age and Detection Decay39
  40. Slide 40: Coverage as a Claim: Technique Maps, Evidence Age and Detection Decay40
  41. Slide 41: Measuring the Loop: Cycle Time, Yield, Re-test Pass Rate and the Metrics That Mislead41
  42. Slide 42: Measuring the Loop: Cycle Time, Yield, Re-test Pass Rate and the Metrics That Mislead42
  43. Slide 43: Operating Models and Team Design: In-House, Contracted, Hybrid and Sovereign Loops43
  44. Slide 44: Operating Models and Team Design: In-House, Contracted, Hybrid and Sovereign Loops44
  45. Slide 45: Decision Rights, Authorisation and the White Team45
  46. Slide 46: Decision rights for the loop46
  47. Slide 47: Regulation as Constraint: DORA, TIBER-EU, NIS 2, the AI Act, the GDPR and Employee Rights47
  48. Slide 48: Regulation as Constraint: DORA, TIBER-EU, NIS 2, the AI Act, the GDPR and Employee Rights48
  49. Slide 49: Across Boundaries: Suppliers, Managed Providers, Sector Exercises and Authorities49
  50. Slide 50: Across Boundaries: Suppliers, Managed Providers, Sector Exercises and Authorities50
  51. Slide 51: People and Career51
  52. Slide 52: Red and Blue as People: Trust, Incentives, Safety and Wellbeing52
  53. Slide 53: Red and Blue as People: Trust, Incentives, Safety and Wellbeing53
  54. Slide 54: Competences, Training and Keeping the Red Craft54
  55. Slide 55: Competences, Training and Keeping the Red Craft55
  56. Slide 56: The Future of the Loop: Will Red and Blue Be Separate Teams in 2036?56
  57. Slide 57: The Future of the Loop: Will Red and Blue Be Separate Teams in 2036?57
  58. Slide 58: Experience and Conclusions58
  59. Slide 59: Case Studies and Anti-Patterns59
  60. Slide 60: Case Studies and Anti-Patterns60
  61. Slide 61: A Year in the Loop: Nordvik Region and Hansa Mutual61
  62. Slide 62: A Year in the Loop: Nordvik Region and Hansa Mutual62
  63. Slide 63: Nordvik Region and Hansa Mutual: Conclusions for Two Organisations63
  64. Slide 64: Nordvik Region and Hansa Mutual: Conclusions for Two Organisations64
  65. Slide 65: Conclusions: The Purple Loop with AI65
  66. Slide 66: Conclusions: The Purple Loop with AI66
  67. Slide 67: Appendices67
  68. Slide 68: Code Examples: Scenario, Mandate, Coverage, Regression and Evidence Artefacts68
  69. Slide 69: Templates and Tools69
  70. Slide 70: AI Purple70