Asl matn EN tilida, manba saytidan olindi. Manba ↗

By 2028, security operations teams will have 50% more engineers than analysts. That is one of the predictions in The Roles Required for the AI-Enabled Security Operations Center (SOC), a 2026 Gartner report by analyst Pete Shoard.

If the prediction holds, the people who build and tune a SOC's systems will outnumber the people who work its queue.

Gartner starts its reasoning with alert handling. The report finds that AI SOC agents already cut alert-handling work significantly for common and traditional detection use cases. It describes this as the end of alert processing as the SOC's primary function.

From there, the report works through what that means for the people in the SOC. Analysts move from triage to case ownership, and entry-level roles need a new way in.

Detection engineering grows into a broader engineering job, the metrics shift from alerts to cases and decisions, and exposure management becomes a standing SOC function.

Prophet Security is offering the full report as a free download.

Analysts move from alert triage to case ownership

Gartner's recommendation for analysts is direct: "Human analysts must transition from alert triage roles to end-to-end case ownership and effective response option communication." In practice, the agent investigates the alert, and the analyst owns what happens next.

That means confirming what the agent found, choosing the response, and explaining the options to the people who have to act on them.

The report also holds that AI-assembled case files still need meaningful human validation before a team can rely on them,so analysts spend more of their time judging whether a conclusion holds up and less of it producing verdicts from scratch.

None of this shrinks the team, in Gartner's view. "The SOC will not shrink by 2030," the report states. The people who worked alert volume get redirected toward detection engineering, threat expertise, offensive testing, and exposure management.

Practitioners expect the same. Prophet Security's State of AI in Security Operations 2026 survey asked more than 250 CISOs, SOC leaders, and practitioners about this. Of those respondents, 57% expect their team size to stay the same, and 9% expect it to grow.

Entry-level roles need a new way in

Many analysts learned the job in Tier 1 triage, and AI is flattening those tiers. Working a high alert volume taught them what normal looks like in their environment. Gartner's report addresses how L1 and L2 roles change and the training and staffing changes SOC leaders should make now. If agents take over triage, junior analysts lose the repetitions that built their judgment, unless the team replaces those repetitions on purpose.

Three practices can do that:

  • Study the agent's work. When an agent records every question it asked, every query it ran, and the evidence behind its determination, each closed alert becomes a worked example. Junior analysts can check whether they would have run the same queries and reached the same conclusion. At JBPCO, the team was able to onboard a new analyst to senior level proficiency within months.
  • Own cases early.Gartner's shift to case ownership applies to new analysts too. Giving them end-to-end ownership of lower-risk cases, with a senior reviewer, lets them practice the decisions and response communication the report puts at the center of the analyst role.
  • Feed corrections back.Gartner lists "operational feedback management" among the responsibilities of the future detection engineer, and expects analysts to give more feedback to improve AI accuracy. Among Prophet Security's customers, some analysts have already moved from handling alerts to curating the guidance the AI platform uses in its investigations. The same work suits a new hire who is still learning the environment.

The risk to manage is an analyst who only confirms what the agent says. One control is to have analysts work a sample of cases on their own before they see the agent's determination, then compare the two.

Detection engineering grows into SOC engineering

The 2028 prediction rests on a wider definition of engineering work. Gartner describes detection engineering expanding into a broader SOC engineering discipline.

The report tells SOC leaders to "redefine detection engineering role descriptions and hiring requirements." The new descriptions should go beyond rule writing to include prompt design, workflow testing, and AI output validation. The report also calls for software engineering practices such as versioning, testing, and rollback.

Each of those maps to work that exists once agents run in production:

  • Prompt design and guidance: writing the instructions and context an agent uses to investigate in your environment, such as asset criticality, VIP users and known-benign admin activity.
  • Workflow testing: checking an agent workflow against past incidents before it goes live, the way a detection is backtested before it ships.
  • AI output validation: sampling the agent's determinations on a schedule and measuring how often a reviewer agrees with them.
  • Versioning and rollback: managing guidance and detection changes as code, so a bad change can be traced and reverted.

The analyst hours that agents return also go into threat hunting. In the State of AI in Security Operations 2026 survey, 49% of teams that hunt weekly or more said a hunt had surfaced malicious activity their detections missed.

Among teams reporting the lowest hunting frequency, the figure was 8%. A confirmed hunt finding often gives the engineers a new detection to write for their own environment.

The metrics move from alerts to cases and decisions

Gartner's guidance on measurement is short: "Stop recording alert metrics and run the SOC on cases and decisions." The report points SOC leaders away from alert volume, closure rates and mean time to detect, and toward case accuracy, cycle time and decision confidence.

One way to put a number on each:

  • Case accuracy: review a fixed sample of closed cases each week, from agents and analysts alike, and track how often the reviewer agrees with the determination.
  • Cycle time: measure the time from the first signal to a decision on the case, including the response.
  • Decision confidence: record how much evidence supports each determination and how often one is overturned later.

Alert counts still help with capacity planning, but they say little about whether a determination was right. The new measures can sit alongside the SOC metrics a team already reports, such as mean time to respond.

Exposure management becomes a standing SOC function

Gartner's report calls exposure management "the emerging SOC capability to invest in before anything else." It calls for continuous threat exposure management (CTEM) to run as a standing SOC function, rather than as an annual or quarterly exercise.

It also predicts that by 2030, SOCs will be largely offensively driven, testing their own business the way an attacker would.

Many security teams have wanted to run this kind of continuous testing for years and rarely had the hours for it. Once agents handle the alert queue, the analysts and engineers who move into exposure work can validate exposures as they appear.

What they find goes to the people writing detections and planning hunts.

Planning the transition

The report's recommendations translate into decisions that are easier to make before an AI SOC rollout than after it:

  1. Map today's roles against the work Gartner expects to grow: case ownership, SOC engineering, hunting and exposure management.
  1. Rewrite the detection engineering job description to include prompt design, workflow testing, and AI output validation, as the report recommends.
  1. Design the entry-level path, including case ownership and feedback work, before triage volume drops.
  1. Record a baseline for case accuracy and cycle time, so the rollout has a before and an after.
  1. Choose one exposure management practice to run continuously instead of once a year.

How Prophet Security helps

Prophet Security is a leading agentic AI SOC platform, recognized in Rising in Cyber 2026, an honor voted on by more than 150 CISOs and security leaders. Its platform, Prophet AI, uses specialist AI agents to investigate alerts, hunt for threats, and build and tune detections on the stack a team already runs.

Here is how it maps to the shifts described above:

  • Case ownership. Prophet AI SOC Analyst investigates every alert and records every question, query, and piece of evidence behind its determination, so analysts can own the case and check the reasoning. It groups related investigations into one incident and takes only the response actions a team has approved.
  • SOC engineering. Prophet AI Detection Engineer keeps a live MITRE ATT&CK coverage map built from a team's own investigations, then builds and tunes detections from what investigations, hunts, and coverage gaps reveal. Each change is backtested against the team's own history and arrives as a reviewable, version-controlled proposal, and by default nothing reaches production until the team approves it. Guidance that changes an investigation step is versioned and testable too.
  • Threat hunting. Prophet AI Threat Hunter runs hunts automatically when a severe new threat emerges. Scheduled hunts against coverage gaps, and hunts a team writes as plain-language questions, run on the cadence the team sets. Suspicious findings go to Prophet AI SOC Analyst for a full investigation, and validated ones become candidates for new detections.
  • Case accuracy. Prophet Security measures the quality of Prophet AI's determinations through a continuous QA program with ISO 2859-1 sampling audits. When the evidence does not support a verdict, Prophet AI SOC Analyst returns an inconclusive determination instead of guessing.

Read the full report

Gartner's report sets out the roles, metrics and skills a SOC needs as AI agents take over alert handling.

Download The Roles Required for the AI-Enabled Security Operations Center (SOC) for Gartner's full guidance on L1 and L2 roles, SOC metrics and the skills future SOC engineers will need.

Sponsored and written by Prophet Security.