Security operations centers could have 50% more engineers than analysts by 2028, according to a 2026 Gartner report on the roles needed for AI-enabled SOCs. The forecast reflects a shift as AI agents take on more routine alert handling and investigation work, changing how teams use their time and skills.
The report, authored by analyst Pete Shoard, argues that alert processing is no longer likely to remain the SOC’s primary function. Instead of concentrating on triaging alerts, human analysts are expected to take ownership of cases: validating an agent’s findings, deciding on an appropriate response and communicating the available options to those responsible for acting.
Gartner also says AI-generated case files still need meaningful human review. Analysts will spend more time assessing whether evidence supports a conclusion, rather than building every verdict from scratch. The report does not predict that SOC teams will shrink by 2030; instead, it expects work to move toward detection engineering, threat expertise, offensive testing and exposure management.
The change also raises questions about how junior staff gain experience. Tier 1 triage has traditionally given new analysts repeated exposure to alerts and helped them learn what is normal in their organization. If AI agents take over that work, teams will need other ways to develop those skills. Gartner’s report discusses changes to L1 and L2 roles, training and staffing.
The source article describes several approaches to replacing that experience: letting junior analysts study an agent’s queries and evidence, giving them ownership of lower-risk cases with senior review, and involving them in feedback that improves AI investigations. It also cautions against analysts simply accepting an agent’s answer, suggesting they could independently assess a sample of cases before comparing their findings with the AI’s.
Engineering work is expected to broaden beyond writing detection rules. Gartner recommends updating detection engineering job descriptions to include prompt design, workflow testing and validation of AI outputs, alongside software engineering practices such as version control, testing and rollback. Those responsibilities support the operation and oversight of agents in production.
The report also points to threat hunting as an area that could benefit from time freed up by automation. In Prophet Security’s 2026 State of AI in Security Operations survey of more than 250 CISOs, SOC leaders and practitioners, 49% of teams that hunted weekly or more often said a hunt had uncovered malicious activity their detections missed. Among teams reporting the lowest hunting frequency, the figure was 8%.
Gartner recommends changing how SOC performance is measured, moving away from a focus on alert volumes and closure rates toward case accuracy, case cycle time and confidence in decisions. Alert counts may still help with capacity planning, but the report says they offer limited insight into whether a determination was correct.
Exposure management is another function Gartner expects SOCs to develop. The report recommends making continuous threat exposure management a standing activity rather than conducting it only annually or quarterly. It also predicts that SOCs will be largely offensively driven by 2030, testing their own organizations in ways that reflect how attackers operate.
The article is sponsored and written by Prophet Security, which offers Gartner’s report as a free download. Its recommendations include reviewing current roles, updating engineering requirements, planning new entry-level career paths and establishing baseline measures before deploying AI agents.
Sources: BleepingComputer.