Gartner has predicted that security operations centres will employ 50% more engineers than analysts by 2028, a shift the research firm attributes to AI agents taking over the routine alert handling that has historically defined entry-level SOC work.
The forecast, reported by BleepingComputer, points to a structural reweighting of the security operations function rather than a simple headcount change: as automated agents absorb first-line triage and repetitive investigation tasks, the roles that remain, and grow, are closer to building, tuning and operating the systems that do the triage in the first place.
From queue-clearing to system-building
The prediction lands amid a longer-running debate about what the junior analyst tier is actually for. For years, tier-one SOC work has been criticised as a grind of repeated, low-context alert clearance — work that is well suited to automation and, a long-running critique in the industry holds, poorly suited to retaining talent. If AI agents reliably perform that first pass, the traditional on-ramp into security careers narrows, and the discipline's centre of gravity moves toward detection engineering, automation design and adversarial testing.
Prophet Security's analysis of the shift, referenced alongside the forecast, breaks the change down across specific functions: how analyst responsibilities are being rewritten as triage is delegated to machines, how detection engineering becomes a larger share of the workload, and how threat hunting and exposure management absorb people who might otherwise have been clearing queues.
Why it matters beyond the SOC
For security teams, the near-term implication is a hiring profile that looks less like a pyramid of analysts and more like an engineering organisation with a smaller analytical layer on top. Job requirements shift toward scripting, data engineering, model evaluation and the discipline of writing detections that machines can execute consistently — skills that have historically been treated as a second-stage career move rather than an entry point.
There is also a market dimension. Managed detection and response and SOC-as-a-service providers have been steadily absorbing routine monitoring for organisations that lack the scale to staff a 24/7 function internally, and the economics of automated triage suggest that expansion accelerates as the marginal cost of continuous coverage falls. That matters here because it changes where the Gartner prediction bites first: outsourced providers, running high-volume alert pipelines for many customers, have the strongest incentive — and the clearest economics — to swap analyst hours for engineered automation. Whichever way the ratio moves at in-house teams, service providers are effectively the pilot environment for the model.
The counterargument is that AI-driven triage raises, rather than lowers, the bar for the analysts who remain. When a machine handles the obvious cases, humans are left with the ambiguous, the novel and the deliberately misleading — scenarios where adversarial pressure and contextual judgement matter most. That pushes the analyst role upward in seniority, even as its headcount share declines.
Where the pipeline comes from
Gartner's 2028 horizon gives security leaders roughly two years to reassess workforce planning, training pipelines and job architecture. The practical questions are whether junior-level entry points will be redefined around tooling and detection work rather than alert queues, and whether teams can source engineers from a talent pool that security hiring has not traditionally competed for.
Prophet Security's framing of the transition suggests a further consequence: if the entry-level queue disappears, security hiring is pushed to compete for talent from outside its traditional pool, and the burden shifts to employers to build the on-ramp themselves — through structured training, internal mobility and clearer paths from adjacent disciplines into SOC engineering.
According to BleepingComputer, which carried the prediction, the analyst-to-engineer inversion is a direct consequence of AI agents processing routine alerts at scale. Whether the ratio lands exactly where Gartner projects it, the direction of travel is the story: the SOC of the late 2020s is being rebuilt as an engineering function with an analyst complement, not the other way around.
Gartner 預測，到2028年，安全營運中心（SOC）雇用的工程師人數將比分析師多50%。這家研究機構認為，此轉變源於 AI agent 接管了歷來界定入門級 SOC 工作的常規 alert 處理任務。
據 BleepingComputer 報道，這項預測指向安全營運職能的結構性權重重整，而非單純的人手數字變化：隨著自動化 agent 承擔一線 triage 及重複性調查工作，得以保留、甚至擴張的職位，將更聚焦於構建、調校及營運那些從事 triage 的系統本身。
由清理 queue 轉向構建系統
這項預測出台之際，業界正就初級分析師層級的真正定位進行一場持續多時的辯論。多年來，一級 SOC 工作一直被批評為機械式、脈絡有限的 alert 清理工作——這類工作極適合自動化，而業界一項長久以來的批評認為，它亦極不利於留住人才。假如 AI agent 能可靠地執行這道首輪篩查，傳統進入安全職業的途徑將會收窄，該領域的重心亦會轉向 detection engineering、自動化設計及對抗性測試。
Prophet Security 就此轉變所作的分析（與該項預測一併被引用）將變化細分至各項具體職能：當 triage 委託予機器後，分析師的職責如何被改寫；detection engineering 在工作量中所佔比重如何上升；以及威脅狩獵（threat hunting）與暴露面管理如何吸納原本可能在清理 queue 的人手。
為何影響不止於 SOC
對安全團隊而言，短期而言的啟示是：招聘的人員結構將不再像以分析師組成的金字塔，而更像一家頂部只有較小分析層的工程組織。職位要求將轉向 scripting、數據工程、模型評估，以及撰寫機器能一致執行的 detection 的紀律——歷來這些技能被視為職涯第二階段的跳板，而非入門起點。
市場層面亦有其影響。託管偵測與回應（MDR）及 SOC-as-a-service 供應商一直穩步吸納缺乏內部規模以維持24/7崗位編制的機構之日常監控工作，而自動化 triage 的經濟性顯示，隨著持續覆蓋的邊際成本下降，此類擴張將會加速。這一點在此之所以重要，在於它改變了 Gartner 預測首先發酵的位置：為大量客戶運行高流量 alert pipeline 的外判供應商，擁有最強烈的動機——以及最清晰的經濟理據——以工程化的自動化取代分析師工時。無論內部團隊的比例如何變動，服務供應商實際上就是此模式的試點環境。
反方論點是，AI 驅動的 triage 提高而非降低留任分析師的要求門檻。當機器處理明顯個案，人類便要應付含糊、新穎及刻意誤導的情況——在這些情境中，對抗性壓力與脈絡判斷最為關鍵。這會將分析師角色的資歷層級推高，即使其人數佔比下降。
人才 pipeline 從何而來
Gartner 的2028年時限，給予安全主管大約兩年時間重新評估人力規劃、培訓 pipeline 及職位架構。實際問題在於：初級入門點是否會圍繞工具運用及 detection 工作、而非 alert queue 重新定義；以及團隊能否從安全招聘向來未曾競爭的人才庫中吸納工程師。
Prophet Security 對此過渡的闡述引出另一後果：若入門級 queue 消失，安全招聘便被迫從傳統人才庫以外競爭人才，責任亦轉移至雇主身上，須自行構建入門途徑——透過結構化培訓、內部流動，以及為相鄰學科通往 SOC engineering 開闢更清晰的路徑。
據刊載該項預測的 BleepingComputer 報道，分析師與工程師比例倒轉，是 AI agent 大規模處理常規 alert 的直接結果。即使最終比例未必與 Gartner 預測完全一致，發展方向才是重點：2020年代末的 SOC 正被重建為以工程職能為主體、分析師為輔的架構，而非倒過來。