The blue seat

The defensive side works from a different assumption: that something will get through. The job is less a perfect perimeter than seeing the move that lands and answering it fast enough to keep the damage small. No single control holds a determined attacker, so depth counts, each overlapping layer another chance to notice. What cannot be seen cannot be defended, so visibility comes first, and the blind spots are where an attacker lives. And since not every asset carries the same weight, the attention goes where the loss would hurt most.

In a session the blue seat is not running a generic defence and hoping. It comes in having said, out loud and in advance, what it expects to detect and how fast, so the debrief rests on evidence rather than impressions. It watches live as the move unfolds, notes what fired and what stayed silent and when, and runs the actual response procedure, with the real handoffs and escalations, rather than a described one. Practising the procedure under something close to real conditions is what makes it hold when the real thing arrives.

What comes out is a gap list worth acting on: the expected detections that did not fire, the alerts that arrived too late, the blind spots the move walked straight through. From there the work is concrete, a rule built from the technique just seen and then retested, a playbook step that was missing, a tool measured against what it actually caught rather than what it was sold to catch. The detection and hunting depth, the layers and the tooling, lives in the blue repo; the loop’s contribution is the evidence that tells the blue seat which parts of it are real.

Last updated: 1 July 2026