AI for Security, Resilience and Cognitive Superiority of Nations
Tuesday 6 October — Art of Intelligence · Security & the defence industry
The table
The case
Subtitle: An illustrative scenario for discussion and adaptation by the case lead. The officials, events and decisions are fictional. Source: The owner's own case (Dražen Kapusta, 2026-09-13), verbatim — filed by the owner under "Art of Intelligence"; The Table: Gordan Akrap — Case lead and moderator
The official chairing the meeting has forty minutes before she must brief the prime minister. Three reports on her desk agree that a disruption at a freight terminal is part of a coordinated attack. The transport operator wants to keep essential deliveries moving. The security team wants time to investigate. Her communications adviser needs to know what the government will tell the public.
She has spent years preparing for difficult decisions. She knows the people around the table, understands the cost of an unnecessary closure and has seen how quickly a cautious assessment can become a confident headline. Yet the agreement between the reports is reassuring. Each comes from a different organisation. Each has been prepared with AI assistance. Each describes the same pattern.
Then a junior analyst asks whether the three reports depend on the same original source.
The room pauses. Nobody has checked.
Before the decision
The terminal has experienced a genuine interruption. Some shipments are delayed. An online claim alleges that other facilities have also been compromised, but direct confirmation has not arrived. A summary of that claim appears in the transport operator’s briefing, in a contractor’s security assessment and in the ministry’s AI-generated morning update. Three organisations have processed the information. The apparent corroboration may still rest on one unverified account.
The chair’s first responsibility is to protect people and maintain essential services. She also needs to preserve the ability to investigate. Closing the terminal could interrupt supplies and spread the disruption to neighbouring countries. Keeping it fully operational could expose workers or customers to a risk she does not yet understand. Publicly naming an attacker would carry consequences well beyond the terminal.
The difficult part is personal. She has already told her superior that the reports appear consistent. Reopening the assessment means admitting that the consistency may have been misunderstood. Her team is watching how she responds to the analyst. If she treats the question as an embarrassment, people will learn something about the next meeting.
She asks the analyst to show the source chain. She also asks the operator which activities can continue safely while the uncertain part is investigated. The meeting now has two connected tasks: establish what the reports actually support, and identify what can responsibly be done before the uncertainty is resolved.
The preparation behind judgment
The chair needs a disciplined way to examine the problem. What is directly observed? What has been inferred? Which assumptions connect the evidence to the recommendation? What would make the team change its assessment?
Several explanations remain possible. The disruption could be a technical failure accompanied by a false online claim. It could involve a malicious intrusion with a limited effect. It could be part of a wider incident. The immediate operational response does not require every question of intent and attribution to be settled first.
She asks what evidence would distinguish those explanations. She assigns responsibility for obtaining it and sets the point at which the decision must be reviewed. She invites the operator to challenge the security assessment and the security team to challenge the operational assumptions. Her authority makes that disagreement possible; her behaviour determines whether it is honest.
She also notices her own temptation to prefer whichever explanation makes her earlier statement look reasonable. A structured process helps only if she is willing to apply it to herself. Her preparation includes the ability to remain composed while changing her mind in front of colleagues whose respect matters to her.
That ability develops before the crisis. It grows through reviewing previous decisions, listening to people with different responsibilities and examining occasions when confidence exceeded the evidence. Experience becomes useful when the leader is willing to learn from it.
What a nation needs to learn
For this discussion, cognitive superiority means the ability to form, revise and act on sound judgments under pressure. It includes recognising attempts to distort the decision process and correcting weaknesses within the institution itself. It cannot be inferred simply from the volume of information collected or the capability of a purchased model.
A smaller country may depend on models developed elsewhere. That raises difficult questions about access, dependency and the pace of change. It still has choices about the preparation of its leaders, the boundaries of delegated authority and the way institutions share and challenge information. Those choices matter to a ministry, a national operator and a founder whose business depends on both.
Trust between people becomes practical infrastructure here. An official needs to know whom to call, what that person actually knows and whether disagreement can survive the relationship. Shared work, exercises and informal conversations can build that familiarity before a crisis. A discussion continued over dinner may create the confidence to ask a difficult question later.
Such relationships need room for independent judgment. Familiarity can help people exchange unwelcome information, but it can also make them reluctant to question one another. A leader must recognise when trust is strengthening scrutiny and when it is quietly replacing it.
National resilience therefore involves more than keeping systems running. It also involves preserving the capacity to recognise error, coordinate across institutional boundaries and recover the quality of judgment after confusion or pressure.
The record that remains
In the scenario, the chair authorises a limited operational response, keeps essential deliveries moving where the operator can substantiate safety and defers public attribution. She records the reasons, the unresolved questions and the conditions for changing course. This choice carries trade-offs: further disruption may follow, and information received later may require a different response.
The quality of the decision will eventually be examined through what was known at the time. Which report reached the chair? Was its uncertainty preserved in the summary? Who approved the operational instruction? Did the operator carry it out as intended?
A connected record of recommendations, approvals and execution can help answer those questions. Its value depends on what was actually captured and whether the relevant sources and confirmations remain available. Missing evidence must remain visible.
An agent’s technical ability to send an instruction does not establish its authority to do so. A recorded claim does not become true because its integrity can be verified. These distinctions matter when a review asks whether the problem began with a bad source, a mistaken inference, an excessive mandate or a failure to carry out the authorised decision.
AI can help organise the evidence and identify inconsistencies. Human reviewers must judge its significance, including what the record cannot establish. The resulting account should help the institution improve its next decision while preserving responsibility for this one.
The operational outcome remains open. The chair must now explain her choice to the prime minister and eventually to others affected by it. Around the CDayZ table, the question is what each of us would need to have practised, built or changed before being ready to occupy her seat.
Discussion Questions
- What would you authorise in the next forty minutes, and what would you leave open?
- When has changing your mind publicly made you a better or worse leader?
- What preparation or relationship would most improve your judgment in this situation?
- What would you require an AI agent to record so you could later explain the decision?
- What does forty minutes of caution cost, and who pays for it?
- Three organisations, one claim: what do the operator, the contractor and the ministry owe each other before the next incident?
- A smaller country runs its morning update on a model built elsewhere: what is still yours to decide?
- The NEO Turn. What changes when the summary that describes the disruption can also reroute the deliveries?
The closure, the delayed shipments, the neighbouring countries — and the bill nobody sends.
The source chain on every summary, the right to challenge, and exercises that produce disagreement.
Access, dependency and pace of change are real — so is the list of things they do not touch.
Capability moves faster than the meeting; the mandate must be specific; someone remains answerable when the record is incomplete.
Moderator Note
Open by asking participants to take the chair’s seat and state their first decision before discussing technology. Draw out how they judge source independence, institutional confidence and the pressure to offer a clear answer.
Ask one participant for an experience of changing an assessment after a junior colleague challenged it. Ask another about the cost of waiting for greater certainty. Keep both the operational consequences and the leader’s personal preparation visible. If the room agrees too quickly, ask which fact would change its preferred response.
Deepen the discussion by examining how institutions build trust without losing the ability to challenge each other. Invite examples from government, security and business.
Move to the NEO Turn by asking participants to imagine that some recommendations become executable instructions. Explore who grants authority, who reviews the evidence and who remains answerable when the record is incomplete.
CDayZ output: A one-page decision brief recording the chosen action, its evidence, remaining uncertainty, responsible person and conditions for reconsideration.
The NEO Turn
What changes when the AI that summarises the disruption can also reroute deliveries, notify suppliers or issue instructions to another agent?
The chair’s judgment now has to govern a chain of activity that may move faster than the meeting. A general intention to protect essential services must be translated into a specific mandate: which actions are permitted, under what conditions and when human review is required. Technical capability may extend far beyond that mandate.
Additional governance safeguards can help structure the decision and its limits. Evidence infrastructure can preserve and connect records for subsequent examination. Neither a coherent AI explanation nor an intact record settles whether the underlying information was correct.
The next question for the table is therefore personal and institutional: what are you prepared to delegate, and what evidence would you need to remain meaningfully responsible for the result?
Closing line
Proposed moderator closing: "A nation’s judgment is strengthened each time a leader makes it possible for the evidence to change the decision."
Your comment on this chapter
A question for the table, a disagreement, what you would have done. The case lead reads every comment; the ones the table takes up enter the chapter as questions from the room, with your name.