Gartner 2028-yilga kelib SOClarda muhandislar tahlilchilardan 50% ko'p bo'lishini bashorat qilmoqda

2028-yilga kelib xavfsizlik operatsiyalari jamoalarida muhandislar tahlilchilardan 50% ko'p bo'ladi. Bu 2026-yilgi Gartner hisobotidagi bashoratlardan biri — "AI bilan ta'minlangan Xavfsizlik Operatsiyalari Markazi (SOC) uchun Zarur Rollar", tahlilchi Pit Shord tomonidan tayyorlangan.

Agar bashorat o'zini oqlasa, SOC tizimlarini quradigan va sozlaydigan odamlar uning navbatini ishlaydigan odamlardan ko'proq bo'ladi.

Gartner o'z fikrini ogohlantirishlarni qayta ishlash bilan boshlaydi. Hisobot shuni aniqlaydiki, AI SOC agentlari allaqachon keng tarqalgan va an'anaviy aniqlash holatlari uchun ogohlantirishlarni qayta ishlash ishini sezilarli darajada kamaytiradi. Bu SOCning asosiy vazifasi sifatida ogohlantirishlarni qayta ishlashning tugashi sifatida tasvirlanadi.

Shu yerdan hisobot SOCdagi odamlar uchun bu nimani anglatishini ko'rib chiqadi. Tahlilchilar triagedan holat egaligiga o'tadi, kirish darajasidagi rollar esa yangi yo'lga muhtoj bo'ladi.

Aniqlash muhandisligi kengroq muhandislik ishiga aylanadi, ko'rsatkichlar ogohlantirishlardan holatlar va qarorlarga o'tadi, va ta'sirni boshqarish SOCning doimiy vazifasiga aylanadi.

Prophet Security to'liq hisobotni bepul yuklab olish sifatida taklif qilmoqda.

Tahlilchilar ogohlantirish triagedan holat egaligiga o'tadi

Gartnerning tahlilchilar uchun tavsiyasi to'g'ridan-to'g'ri: "Inson tahlilchilari ogohlantirish triage rollaridan to'liq holat egaligiga va samarali javob variantlari bilan muloqot qilishga o'tishlari kerak." Amalda agent ogohlantirishni tekshiradi, tahlilchi esa keyin nima bo'lishini egallaydi.

Bu agent topgan narsani tasdiqlash, javobni tanlash va ularga amal qilishi kerak bo'lgan odamlarga variantlarni tushuntirishni anglatadi.

Hisobot shuningdek, AI tomonidan yig'ilgan holat fayllari hali ham jamoa ularga tayanishidan oldin mazmunli inson tekshiruviga muhtoj ekanligini ta'kidlaydi, shuning uchun tahlilchilar xulosa to'g'ri ekanligini baholashga ko'proq vaqt sarflaydi va uni noldan ishlab chiqarishga kamroq vaqt sarflaydi.

Gartnerning fikricha, bu jamoani qisqartirmaydi. "SOC 2030-yilga kelib qisqarmaydi," deb ta'kidlaydi hisobot. Ogohlantirish hajmi bilan ishlagan odamlar aniqlash muhandisligi, tahdid ekspertizasi, hujumkor sinov va ta'sirni boshqarish yo'nalishlariga yo'naltiriladi.

Amaliyotchilar ham shuni kutishmoqda. Prophet Security'ning 2026-yilgi Xavfsizlik Operatsiyalarida AI holati so'rovi 250 dan ortiq CISO, SOC rahbarlari va amaliyotchilardan bu haqda so'radi. Ushbu respondentlardan 57% o'z jamoasi hajmi bir xil qolishini kutmoqda, 9% esa o'sishini kutmoqda.

Kirish darajasidagi rollar yangi yo'lga muhtoj

Ko'plab tahlilchilar ishni 1-darajali triageda o'rgandilar, va AI bu darajalarni tekislashmoqda. Yuqori ogohlantirish hajmi bilan ishlash ularga o'z muhitida normal nima ekanligini o'rgatdi. Gartner hisoboti L1 va L2 rollari qanday o'zgarishini va SOC rahbarlari hozir qilishlari kerak bo'lgan o'qitish va xodimlar o'zgarishlarini ko'rib chiqadi. Agar agentlar triageni o'z zimmalariga olsalar, kichik tahlilchilar o'z hukmlarini qurish uchun takrorlanishlarni yo'qotadilar, agar jamoa bu takrorlanishlarni maqsadli ravishda almashtirmasa.

Uchta amaliyot buni amalga oshirishi mumkin:

• Agentning ishini o'rganing. Agent har bir so'rovni, har bir so'rovni va o'z qarorining orqasidagi dalillarni yozib olganda, har bir yopilgan ogohlantirish ishlangan misolga aylanadi. Kichik tahlilchilar o'zlari bir xil so'rovlarni bajarib, bir xil xulosaga kelgan bo'lishlarini tekshirishlari mumkin. JBPCO'da jamoa yangi tahlilchini bir necha oy ichida yuqori darajali malakaga olib kelishga muvaffaq bo'ldi.

• Holatlarni erta egallang. Gartnerning holat egaligiga o'tishi yangi tahlilchilarga ham tegishli. Ularga past xavfli holatlarning to'liq egaligini berish, yuqori darajali tekshiruvchi bilan, ularga hisobot markaziga qo'yilgan qarorlar va javob muloqotini amalda bajarish imkonini beradi.

• Tuzatishlarni qayta yuboring. Gartner "operatsion fikr-mulohazalarni boshqarish"ni kelajakdagi aniqlash muhandisining mas'uliyatlari orasida sanab o'tadi va tahlilchilardan AI aniqligini yaxshilash uchun ko'proq fikr-mulohaza berishlarini kutadi. Prophet Security mijozlari orasida ba'zi tahlilchilar allaqachon ogohlantirishlarni qayta ishlashdan AI platformasi tekshiruvlarida foydalanadigan yo'riqnomani tuzatishga o'tgan. Xuddi shu ish hali muhitni o'rganayotgan yangi xodimga ham mos keladi.

Boshqarilishi kerak bo'lgan xavf — bu faqat agent aytgan narsani tasdiqlaydigan tahlilchi. Bitta nazorat — tahlilchilarga agentning qarorini ko'rishdan oldin o'zlari holat namunasini ishlashni, so'ngra ikkalasini solishtirishni talab qilish.

Aniqlash muhandisligi SOC muhandisligiga aylanadi

2028-yilgi bashorat muhandislik ishining kengroq ta'rifiga asoslanadi. Gartner aniqlash muhandisligining kengroq SOC muhandisligi intizomiga kengayishini tasvirlaydi.

Hisobot SOC rahbarlariga "aniqlash muhandisligi rol tavsiflari va ishga olish talablarini qayta belgilash"ni aytadi. Yangi tavsiflar qoidalar yozishdan tashqari tezkor dizayn, ish oqimi sinovi va AI natijalarini tekshirishni ham o'z ichiga olishi kerak. Hisobot shuningdek, versiyalash, sinov va orqaga qaytarish kabi dasturiy muhandislik amaliyotlarini ham talab qiladi.

Ularning har biri agentlar ishlab chiqarishda ishlaganda mavjud bo'lgan ishga mos keladi:

• Tezkor dizayn va yo'riqnoma: agent sizning muhitda tekshirish uchun foydalanadigan ko'rsatmalar va kontekstni yozish, masalan, aktivning muhimligi, VIP foydalanuvchilari va ma'lum yaxshi ma'muriy faoliyat.

• Ish oqimi sinovi: agent ish oqimini jonli ishga tushirishdan oldin o'tgan hodisalar bilan tekshirish, xuddi aniqlash jo'natilishidan oldin orqaga sinovdan o'tkazilgandek.

• AI natijalarini tekshirish: agentning qarorlarini belgilangan jadval bo'yicha namuna olish va tekshiruvchi ular bilan qanchalik tez-tez rozi bo'lishini o'lchash.

• Versiyalash va orqaga qaytarish: yo'riqnoma va aniqlash o'zgarishlarini kod sifatida boshqarish, shunda yomon o'zgarish kuzatilishi va bekor qilinishi mumkin.

Agentlar qaytaradigan tahlilchi soatlari ham tahdid oviga kiradi. 2026-yilgi Xavfsizlik Operatsiyalarida AI holati so'rovida haftada yoki undan ko'p ov qiladigan jamoalarning 49% ov ularning aniqlashlari o'tkazib yuborgan zararli faoliyatni aniqlaganini aytdi.

Eng past ov chastotasini xabar qilgan jamoalar orasida bu ko'rsatkich 8% edi. Tasdiqlangan ov topilmasi ko'pincha muhandislarga o'z muhitlari uchun yangi aniqlash yozish imkonini beradi.

Ko'rsatkichlar ogohlantirishlardan holatlar va qarorlarga o'tadi

Gartnerning o'lchov bo'yicha yo'riqnomasi qisqa: "Ogohlantirish ko'rsatkichlarini yozishni to'xtating va SOCni holatlar va qarorlar asosida boshqaring." Hisobot SOC rahbarlarini ogohlantirish hajmi, yopilish tezligi va aniqlash uchun o'rtacha vaqtdan uzoqlashtiradi va holat aniqligi, sikl vaqti va qaror ishonchiga yo'naltiradi.

Har biriga raqam qo'yishning bir usuli:

• Holat aniqligi: har hafta agentlar va tahlilchilardan yopilgan holatlarning belgilangan namunasini tekshiring va tekshiruvchi qaror bilan qanchalik tez-tez rozi bo'lishini kuzating.

• Sikl vaqti: birinchi signaldan holat bo'yicha qarorgacha, javobni ham o'z ichiga olgan holda, vaqtni o'lchang.

• Qaror ishonchi: har bir qarorni qo'llab-quvvatlaydigan dalil miqdorini va keyinchalik qanchalik tez-tez bekor qilinishini yozib oling.

Ogohlantirish sonlari hali ham sig'imni rejalashtirishga yordam beradi, lekin ular qaror to'g'ri ekanligi haqida kam narsa aytadi. Yangi o'lchovlar jamoa allaqachon xabar qiladigan SOC ko'rsatkichlari, masalan, javob berish uchun o'rtacha vaqt bilan birga joylashishi mumkin.

Ta'sirni boshqarish SOCning doimiy vazifasiga aylanadi

Gartner hisoboti ta'sirni boshqarishni "har narsadan oldin sarmoya qilish kerak bo'lgan yangi SOC qobiliyati" deb ataydi. U doimiy tahdid ta'sirini boshqarish (CTEM) yillik yoki choraklik mashq sifatida emas, balki doimiy SOC vazifasi sifatida ishlashini talab qiladi.

Shuningdek, 2030-yilga kelib SOClar asosan hujumkor yo'naltirilgan bo'lishini, o'z bizneslarini hujumkor kabi sinovdan o'tkazishini bashorat qiladi.

Ko'plab xavfsizlik jamoalari ko'p yillar davomida bu turdagi doimiy sinovni o'tkazishni xohlashgan va kamdan-kam hollarda buning uchun soatlari bo'lgan. Agentlar ogohlantirish navbatini egallagach, ta'sir ishiga o'tgan tahlilchilar va muhandislar ta'sirlar paydo bo'lishi bilan ularni tekshirishlari mumkin.

Ular topgan narsalar aniqlashlarni yozadigan va ovlarni rejalashtiradigan odamlarga yuboriladi.

O'tishni rejalashtirish

Hisobot tavsiyalari AI SOC joriy etilishidan oldin qilish osonroq bo'lgan qarorlarga aylanadi:

1. Bugungi rollarni Gartner o'sishini kutadigan ish bilan solishtiring: holat egaligi, SOC muhandisligi, ov va ta'sirni boshqarish.

1. Hisobot tavsiya qilganidek, tezkor dizayn, ish oqimi sinovi va AI natijalarini tekshirishni o'z ichiga olgan aniqlash muhandisligi ish tavsifini qayta yozing.

1. Triage hajmi tushishidan oldin holat egaligi va fikr-mulohaza ishini o'z ichiga olgan kirish darajasidagi yo'lni loyihalashtiring.

1. Holat aniqligi va sikl vaqti uchun asosiy chiziqni yozib oling, shunda joriy etish oldin va keyin bo'lishi mumkin.

1. Yiliga bir marta emas, balki doimiy ravishda ishlaydigan bitta ta'sirni boshqarish amaliyotini tanlang.

Prophet Security qanday yordam beradi

Prophet Security — bu yetakchi agentik AI SOC platformasi, 2026-yilgi Rising in Cyber'da tan olingan, 150 dan ortiq CISO va xavfsizlik rahbarlari tomonidan ovoz berilgan sharaf. Uning platformasi, Prophet AI, jamoa allaqachon ishlaydigan tizimda ogohlantirishlarni tekshirish, tahdidlarni ovlash va aniqlashlarni qurish va sozlash uchun maxsus AI agentlaridan foydalanadi.

Quyida yuqorida tasvirlangan o'zgarishlarga qanday mos kelishi ko'rsatilgan:

• Holat egaligi. Prophet AI SOC Analyst har bir ogohlantirishni tekshiradi va o'z qarorining orqasidagi har bir so'rov, so'rov va dalilni yozib oladi, shuning uchun tahlilchilar holatni egallab, fikrlashni tekshirishlari mumkin. U bog'liq tekshiruvlarni bitta hodisaga birlashtiradi va faqat jamoa tasdiqlagan javob harakatlarini bajaradi.

• SOC muhandisligi. Prophet AI Detection Engineer jamoaning o'z tekshiruvlaridan qurilgan jonli MITRE ATT&CK qamrov xaritasini saqlaydi, so'ngra tekshiruvlar, ovlar va qamrov bo'shliqlari ochib bergan narsadan aniqlashlarni quradi va sozlaydi. Har bir o'zgarish jamoaning o'z tarixi bilan orqaga sinovdan o'tkaziladi va tekshiriladigan, versiyalangan taklif sifatida keladi, va sukut bo'yicha jamoa tasdiqlamaguncha hech narsa ishlab chiqarishga yetmaydi. Tekshiruv qadamini o'zgartiradigan yo'riqnoma ham versiyalangan va sinovdan o'tkaziladigan.

• Tahdid ov. Prophet AI Threat Hunter jiddiy yangi tahdid paydo bo'lganda avtomatik ravishda ovlarni ishga tushiradi. Qamrov bo'shliqlariga qarshi rejalashtirilgan ovlar va jamoa oddiy til savollari sifatida yozgan ovlar jamoa belgilagan tezlikda ishlaydi. Shubhali topilmalar to'liq tekshiruv uchun Prophet AI SOC Analyst'ga yuboriladi, va tasdiqlanganlari yangi aniqlashlar uchun nomzodga aylanadi.

• Holat aniqligi. Prophet Security Prophet AI'ning qarorlarining sifatini ISO 2859-1 namuna tekshiruvlari bilan doimiy QA dasturi orqali o'lchaydi. Dalil xulosani qo'llab-quvvatlamaganda, Prophet AI SOC Analyst taxmin qilish o'rniga noaniq qaror qaytaradi.

To'liq hisobotni o'qing

Gartner hisoboti AI agentlari ogohlantirishlarni qayta ishlashni egallaganda SOCga kerak bo'ladigan rollar, ko'rsatkichlar va ko'nikmalarni belgilaydi.

AI bilan ta'minlangan Xavfsizlik Operatsiyalari Markazi (SOC) uchun Zarur Rollar to'liq Gartner yo'riqnomasi — L1 va L2 rollari, SOC ko'rsatkichlari va kelajak SOC muhandislari kerak bo'ladigan ko'nikmalar haqida — yuklab oling.

Prophet Security tomonidan homiylik qilingan va yozilgan.

By 2028, security operations teams will have 50% more engineers than analysts. That is one of the predictions in The Roles Required for the AI-Enabled Security Operations Center (SOC), a 2026 Gartner report by analyst Pete Shoard.

If the prediction holds, the people who build and tune a SOC's systems will outnumber the people who work its queue.

Gartner starts its reasoning with alert handling. The report finds that AI SOC agents already cut alert-handling work significantly for common and traditional detection use cases. It describes this as the end of alert processing as the SOC's primary function.

From there, the report works through what that means for the people in the SOC. Analysts move from triage to case ownership, and entry-level roles need a new way in.

Detection engineering grows into a broader engineering job, the metrics shift from alerts to cases and decisions, and exposure management becomes a standing SOC function.

Prophet Security is offering the full report as a free download.

Analysts move from alert triage to case ownership

Gartner's recommendation for analysts is direct: "Human analysts must transition from alert triage roles to end-to-end case ownership and effective response option communication." In practice, the agent investigates the alert, and the analyst owns what happens next.

That means confirming what the agent found, choosing the response, and explaining the options to the people who have to act on them.

The report also holds that AI-assembled case files still need meaningful human validation before a team can rely on them,so analysts spend more of their time judging whether a conclusion holds up and less of it producing verdicts from scratch.

None of this shrinks the team, in Gartner's view. "The SOC will not shrink by 2030," the report states. The people who worked alert volume get redirected toward detection engineering, threat expertise, offensive testing, and exposure management.

Practitioners expect the same. Prophet Security's State of AI in Security Operations 2026 survey asked more than 250 CISOs, SOC leaders, and practitioners about this. Of those respondents, 57% expect their team size to stay the same, and 9% expect it to grow.

Entry-level roles need a new way in

Many analysts learned the job in Tier 1 triage, and AI is flattening those tiers. Working a high alert volume taught them what normal looks like in their environment. Gartner's report addresses how L1 and L2 roles change and the training and staffing changes SOC leaders should make now. If agents take over triage, junior analysts lose the repetitions that built their judgment, unless the team replaces those repetitions on purpose.

Three practices can do that:

• Study the agent's work. When an agent records every question it asked, every query it ran, and the evidence behind its determination, each closed alert becomes a worked example. Junior analysts can check whether they would have run the same queries and reached the same conclusion. At JBPCO, the team was able to onboard a new analyst to senior level proficiency within months.

• Own cases early.Gartner's shift to case ownership applies to new analysts too. Giving them end-to-end ownership of lower-risk cases, with a senior reviewer, lets them practice the decisions and response communication the report puts at the center of the analyst role.

• Feed corrections back.Gartner lists "operational feedback management" among the responsibilities of the future detection engineer, and expects analysts to give more feedback to improve AI accuracy. Among Prophet Security's customers, some analysts have already moved from handling alerts to curating the guidance the AI platform uses in its investigations. The same work suits a new hire who is still learning the environment.

The risk to manage is an analyst who only confirms what the agent says. One control is to have analysts work a sample of cases on their own before they see the agent's determination, then compare the two.

Detection engineering grows into SOC engineering

The 2028 prediction rests on a wider definition of engineering work. Gartner describes detection engineering expanding into a broader SOC engineering discipline.

The report tells SOC leaders to "redefine detection engineering role descriptions and hiring requirements." The new descriptions should go beyond rule writing to include prompt design, workflow testing, and AI output validation. The report also calls for software engineering practices such as versioning, testing, and rollback.

Each of those maps to work that exists once agents run in production:

• Prompt design and guidance: writing the instructions and context an agent uses to investigate in your environment, such as asset criticality, VIP users and known-benign admin activity.

• Workflow testing: checking an agent workflow against past incidents before it goes live, the way a detection is backtested before it ships.

• AI output validation: sampling the agent's determinations on a schedule and measuring how often a reviewer agrees with them.

• Versioning and rollback: managing guidance and detection changes as code, so a bad change can be traced and reverted.

The analyst hours that agents return also go into threat hunting. In the State of AI in Security Operations 2026 survey, 49% of teams that hunt weekly or more said a hunt had surfaced malicious activity their detections missed.

Among teams reporting the lowest hunting frequency, the figure was 8%. A confirmed hunt finding often gives the engineers a new detection to write for their own environment.

The metrics move from alerts to cases and decisions

Gartner's guidance on measurement is short: "Stop recording alert metrics and run the SOC on cases and decisions." The report points SOC leaders away from alert volume, closure rates and mean time to detect, and toward case accuracy, cycle time and decision confidence.

One way to put a number on each:

• Case accuracy: review a fixed sample of closed cases each week, from agents and analysts alike, and track how often the reviewer agrees with the determination.

• Cycle time: measure the time from the first signal to a decision on the case, including the response.

• Decision confidence: record how much evidence supports each determination and how often one is overturned later.

Alert counts still help with capacity planning, but they say little about whether a determination was right. The new measures can sit alongside the SOC metrics a team already reports, such as mean time to respond.

Exposure management becomes a standing SOC function

Gartner's report calls exposure management "the emerging SOC capability to invest in before anything else." It calls for continuous threat exposure management (CTEM) to run as a standing SOC function, rather than as an annual or quarterly exercise.

It also predicts that by 2030, SOCs will be largely offensively driven, testing their own business the way an attacker would.

Many security teams have wanted to run this kind of continuous testing for years and rarely had the hours for it. Once agents handle the alert queue, the analysts and engineers who move into exposure work can validate exposures as they appear.

What they find goes to the people writing detections and planning hunts.

Planning the transition

The report's recommendations translate into decisions that are easier to make before an AI SOC rollout than after it:

1. Map today's roles against the work Gartner expects to grow: case ownership, SOC engineering, hunting and exposure management.

1. Rewrite the detection engineering job description to include prompt design, workflow testing, and AI output validation, as the report recommends.

1. Design the entry-level path, including case ownership and feedback work, before triage volume drops.

1. Record a baseline for case accuracy and cycle time, so the rollout has a before and an after.

1. Choose one exposure management practice to run continuously instead of once a year.

How Prophet Security helps

Prophet Security is a leading agentic AI SOC platform, recognized in Rising in Cyber 2026, an honor voted on by more than 150 CISOs and security leaders. Its platform, Prophet AI, uses specialist AI agents to investigate alerts, hunt for threats, and build and tune detections on the stack a team already runs.

Here is how it maps to the shifts described above:

• Case ownership. Prophet AI SOC Analyst investigates every alert and records every question, query, and piece of evidence behind its determination, so analysts can own the case and check the reasoning. It groups related investigations into one incident and takes only the response actions a team has approved.

• SOC engineering. Prophet AI Detection Engineer keeps a live MITRE ATT&CK coverage map built from a team's own investigations, then builds and tunes detections from what investigations, hunts, and coverage gaps reveal. Each change is backtested against the team's own history and arrives as a reviewable, version-controlled proposal, and by default nothing reaches production until the team approves it. Guidance that changes an investigation step is versioned and testable too.

• Threat hunting. Prophet AI Threat Hunter runs hunts automatically when a severe new threat emerges. Scheduled hunts against coverage gaps, and hunts a team writes as plain-language questions, run on the cadence the team sets. Suspicious findings go to Prophet AI SOC Analyst for a full investigation, and validated ones become candidates for new detections.

• Case accuracy. Prophet Security measures the quality of Prophet AI's determinations through a continuous QA program with ISO 2859-1 sampling audits. When the evidence does not support a verdict, Prophet AI SOC Analyst returns an inconclusive determination instead of guessing.

Read the full report

Gartner's report sets out the roles, metrics and skills a SOC needs as AI agents take over alert handling.

Download The Roles Required for the AI-Enabled Security Operations Center (SOC) for Gartner's full guidance on L1 and L2 roles, SOC metrics and the skills future SOC engineers will need.

Sponsored and written by Prophet Security.