\cleardoublepage \part{Identify} \setbookpart{Identify}

Part III: Identify

The Identify Function covers assets, risks and the improvements that tests and exercises reveal, so the red team lives here in CSF terms.

Chapter 9 extends asset management to AI systems and agents (ID.AM). Chapter 10 makes threat modelling continuous and risk assessment evidence-based (ID.RA). Chapter 11 turns AI-assisted vulnerability discovery on the organisation's own code and runs exposure management at machine speed (ID.RA, PR.PS). Chapter 12 describes adversary emulation and continuous red teaming with AI under rules of engagement (ID.IM). Chapter 13 red teams the organisation's own AI systems and agents (ID.RA, ID.IM).

What you will learn in this part:

• How to inventory an estate that includes AI
• How to find and fix vulnerabilities at machine speed
• How to emulate AI-enabled adversaries safely and test agent containment

Every worked example ends with the control that closes the finding, preparing the purple loop of Chapter 26.