Gartner Forecasts SOCs to Have 50% More Engineers Than Analysts by 2028

Introduction

Cybersecurity operations are undergoing a significant shift according to Gartner’s latest report, which predicts that by 2028, security operations centers (SOCs) will employ 50% more engineers than analysts. This transformation indicates a move from traditional alert handling to a more engineering-focused approach within SOCs.

Key Findings from the Gartner Report

The report titled The Roles Required for the AI-Enabled Security Operations Center (SOC), authored by analyst Pete Shoard, highlights how artificial intelligence (AI) is reshaping SOC roles. AI SOC agents are increasingly taking over alert-handling tasks, leading to what Gartner believes is the end of alert processing as the primary function of SOC personnel.

Analysts Transitioning to Case Ownership

One of the most notable recommendations from Gartner is that human analysts should transition from alert triage roles to end-to-end case ownership. Specifically, the agent will handle the initial alert investigation, while the analyst is tasked with confirming findings, selecting an appropriate response, and communicating options effectively to teams that must act on them. This shift means that analysts will spend more time validating AI-generated conclusions rather than forming their own from scratch. The report states, "The SOC will not shrink by 2030," emphasizing the need for reallocation rather than reduction in staffing. As a result, analysts are expected to focus on areas such as detection engineering, threat expertise, offensive testing, and exposure management.

Challenges for Entry-Level Roles

As AI assists with front-line alert processing, entry-level analysts may find traditional pathways into the profession altered. Many analysts have previously learned the role through experience in Tier 1 triage. However, the rise of AI may obfuscate the learning process associated with high alert volumes that familiarizes analysts with normal behavioral patterns in their networks. Gartner points out the necessity for SOC leaders to proactively adapt training and recruitment strategies, introducing practices aimed at compensating for any knowledge gaps left by the diminished emphasis on triage roles. Gartner suggests three key practices to ensure new analysts develop adequate judgment:

• Study the agent's work: By examining the decisions made by AI agents, junior analysts can learn to evaluate the logic employed by these systems.
• Own cases early: New analysts should be assigned to manage lower-risk cases to practice decision-making and response strategies within a supportive environment.
• Feed corrections back: Analysts must have opportunities to provide feedback on AI output to refine the algorithms further. This feedback loop can also be beneficial for new hires, allowing them to learn through corrective measures.

The Expansion of Detection Engineering

Gartner highlights that detection engineering will evolve into a broader discipline comprising multiple engineering roles. SOC leaders are encouraged to redefine job descriptions within their teams to reflect this new reality, updating them to accommodate responsibilities that extend beyond traditional rule writing. New roles should include tasks such as prompt design, workflow testing, and AI output validation. The following areas will become integral to the roles within SOCs:

• Prompt Design: Creating and refining the instructions that AI agents utilize during investigations, tailored specifically to organizational protocols and activities.
• Workflow Testing: Evaluating the effectiveness of agent workflows against historical incidents, similar to backtesting in financial markets.
• AI Output Validation: Institutions will need a routine process of checking AI determinations to ensure they align with human judgment.
• Versioning and Rollback: Managing all changes to guidance and detection protocols as codified versions, allowing for easy tracking and reversion when necessary.

Metrics Transitions for SOCs

Gartner advocates for a major shift in the metrics that SOCs use to gauge performance. Analysts will move away from metrics based on alert volume, such as closure rates and mean time to detect. Instead, SOC performance will hinge on measures including:

• Case Accuracy: This metric assesses how often the reviewer agrees with outcomes determined by both AI agents and analysts.
• Cycle Time: Measuring the total time taken from the initial alert signal to a final decision on the case, including response actions.
• Decision Confidence: Evaluating how robust the evidence is behind decisions made in response to alerts, including instances where decisions are overturned.

Continuous Threat Exposure Management

The report identifies continuous threat exposure management (CTEM) as a vital SOC function that should be operational rather than conducted intermittently. By 2030, Gartner predicts SOCs will more frequently operate offensively, adopting a perspective akin to that of threat actors themselves. Such proactive measures will allow teams to continuously validate and address exposure vulnerabilities, integrating findings into their detection strategies and threat-hunting endeavors.

Planning the Transition to an AI-Enabled SOC

Organizations are encouraged to take preemptive steps to transition to an AI-enabled SOC successfully. Gartner outlines strategies for SOC leaders to implement now to prepare for these upcoming changes, including:

• Mapping current roles against expected future responsibilities, such as case ownership and engineering skills.
• Updating detection engineering job descriptions as recommended.
• Designing a structured entry-level path that incorporates feedback and case ownership responsibilities.
• Establishing a baseline for key performance metrics like case accuracy and cycle time to measure progress post-AI rollout.
• Selecting one exposure management practice to conduct continuously rather than as an annual routine.

How Prophet Security Aids in Transition

Prophet Security, the sponsoring entity of the Gartner report, provides an AI SOC platform aimed at facilitating these transformations. Recognized in the Rising in Cyber 2026 report, Prophet's AI, named Prophet AI, is designed to:

• Support Case Ownership: Each alert is thoroughly investigated by the Prophet AI SOC Analyst, with detailed logs of queries and evidence documented for analyst review.
• Enhance SOC Engineering: The AI platform maintains a live coverage map of MITRE ATT&CK frameworks tailored to a team’s previous investigations, ensuring that detection is continuously refined based on real-world findings.
• Facilitate Threat Hunting: Automatically scheduled hunts are initiated when high-risk threats are detected, allowing for consistent monitoring and rapid responses to new risks.

Conclusion

As the landscape of cybersecurity evolves with the increasing integration of AI into security operations, SOCs stand at the precipice of a significant restructuring in both personnel and workflow. Gartner's report provides substantial foresight into the changes that will shape the future of SOCs, emphasizing the need for analysis, responsibility, and adaptation. By recognizing the value of advanced engineering roles alongside traditional analyst responsibilities, organizations can better prepare for the challenges and opportunities that lie ahead.

Key Takeaways

• By 2028, SOCs are expected to have 50% more engineers than analysts.
• Human analysts are encouraged to transition from alert triage to case ownership.
• Entry-level roles in SOCs will require new approaches due to changes in expert responsibilities.
• Continuous threat exposure management is predicted to become a core function of SOCs.
• Gartner advises operational shifts away from alert-centric metrics to case and decision-based metrics.