\cleardoublepage \part{Verification, Improvement and Conclusions} \setbookpart{Verification, Improvement and Conclusions}

Part VIII: Verification, Improvement and Conclusions

Security controls fail silently when the estate changes, and the organisation usually learns of it from an adversary. The final part therefore begins by proving, continuously, that the capabilities of Parts II to VII work, then closes the loop and draws the book together.

Chapter 25 introduces security chaos engineering and shows how AI makes it practical at estate scale: experiments that check steady-state hypotheses across all six Functions, a platform that separates planning, control and execution, and the safety boundaries that keep it from causing the harm it is meant to find (ID.IM). Chapter 26 makes the purple loop explicit, carrying findings to verified controls, measuring whether defensive AI improves outcomes and updating the CSF profile (ID.IM, GV.OV). Chapter 27 gives the conclusions for Nordvik Region and Hansa Mutual, and Chapter 28 the consolidated analysis, the answers to open questions from the earlier volumes and a labelled forward look.

What you will learn in this part:

• How security chaos engineering verifies capabilities continuously, and which safety boundaries it needs
• How every finding becomes a verified control, and which metrics show that defensive AI helps