Gartner has predicted a structural shift in Security Operations Centers (SOCs) by 2028, with the cybersecurity sector seeing a 50% increase in the number of engineers compared to analysts. This change is driven by the ability of AI agents to handle routine alert processing, ending the era where "alert triage" is considered the primary function of these centers.
The Shift in Analyst Roles: From Triage to Case Ownership
According to the Gartner report, the size of SOC teams will not shrink, but the nature of their tasks will change. Analysts will stop playing the role of "triage" handlers dealing with massive volumes of alerts, transitioning instead to the role of "case owner." In this new model, an AI agent conducts the initial investigation of an alert, while the human analyst takes responsibility for verifying the findings, selecting an appropriate response, and communicating the available options to decision-makers.
This shift requires new skills; analysts will no longer build conclusions from scratch but will spend more time evaluating the accuracy of the conclusions reached by AI before approving them.
The Rise of SOC Engineering
The report noted that the concept of "detection engineering" is expanding into a broader discipline known as "SOC engineering." The tasks of engineers will not be limited to writing code, but will include advanced technical areas such as:
- Prompt Design: Crafting the instructions and context used by the AI agent to investigate the security environment.
- Workflow Testing: Examining agent workflows against past incidents to ensure efficiency before actual deployment.
- AI Output Verification: Periodic monitoring of how well agent decisions align with human assessment.
- Versioning: Managing changes in directives and rules as traceable and retrievable code.
Changing Performance Metrics
Gartner recommends that SOC managers stop relying on metrics like alert volume or closure rates, and shift toward metrics that focus on decision quality, including:
- Case Accuracy: The extent to which expert review aligns with decisions made by agents or analysts.
- Cycle Time: The time taken from the first signal to the final decision and response.
- Decision Confidence: Measuring the strength of supporting evidence for each decision and its stability.
What Changes Practically for New Employees?
This shift poses a significant challenge regarding the training of entry-level (Tier 1) analysts. Traditional training relied on repetitive alert handling to build experience, a task that AI will handle in the future. To bridge this gap, the report suggests strategies such as having beginners study agent logs to understand how results are reached, or granting them ownership of low-risk cases early on to enhance their decision-making skills.
Why This News Matters
This report serves as a clear signal to cybersecurity professionals that traditional technical skills in "triage and monitoring" are beginning to lose market value in favor of "engineering and verification" skills. The change is not merely the automation of jobs, but a complete redefinition of what it means to work in a Security Operations Center; the value add will shift from the "ability to detect an alert" to the "ability to engineer systems that detect and manage alerts with precision."