Gartner Predicts SOCs Will Have 50% More Engineers Than Analysts by 2028

Security operations centers (SOCs) could have 50% more engineers than analysts by 2028, according to a 2026 Gartner report by analyst Pete Shoard. The forecast reflects a shift in which AI agents handle more alert processing, while human teams focus on case ownership, SOC engineering, threat hunting, exposure management, and validating automated decisions.

If the prediction holds, the number of people building and coordinating SOC systems will exceed the number of people handling security queues.

Gartner’s analysis begins with alert processing. The report finds that AI SOC agents are already significantly reducing the effort required to process alerts in common traditional detection use cases. Gartner describes this as the beginning of the end of alert processing as the SOC’s primary function.

That shift changes the responsibilities of SOC staff. Analysts are moving from triage to case ownership, while organizations need new ways to train entry-level employees. Detection engineering is expanding into a broader engineering discipline, metrics are shifting from alerts to cases and decisions, and exposure management is becoming a permanent SOC function.

Prophet Security offers the complete report as a free download.

Analysts move from alert prioritization to case ownership

Gartner’s recommendation for analysts is direct: “Human analysts must move from alert triage roles to end-to-end case ownership and communication of effective response options.” In practice, an AI agent investigates the alert, while an analyst determines what should happen next.

That means explaining the available options to the people who must review the agent’s findings, select a response, and take action.

AI-assembled case files still require meaningful human verification before teams can trust them. Analysts will therefore spend more time determining whether a conclusion is valid and less time reaching a verdict from scratch.

Gartner does not expect this change to reduce the size of SOC teams. “SOC will not shrink by 2030,” the report states. People who previously handled high volumes of alerts will instead be redirected to detection engineering, threat expertise, offensive testing, and exposure management.

Practitioners surveyed for Prophet Security’s The Current State of AI in Security Operations 2026 report expressed a similar view. The survey included more than 250 CISOs, SOC leaders, and practitioners. Among respondents, 57% expected their team size to remain the same, while 9% expected it to increase.

Entry-level SOC roles need new training methods

Many analysts begin their careers in Tier 1 triage, where repeated exposure to alerts helps them learn what is normal in their environment. However, AI can flatten traditional SOC hierarchies by taking over much of that work.

Gartner’s report examines how L1 and L2 roles are changing and what training and staffing adjustments SOC leaders need to make. When agents handle triage, junior analysts can lose the repeated decision-making opportunities needed to develop sound judgment unless organizations deliberately replace those experiences.

There are three practical ways to do that:

Study the agent’s work. Record every question an agent asks, every query it runs, and the evidence supporting its decisions. Each closed alert can then become a training example. Junior analysts can repeat the queries and compare their conclusions with the agent’s. In a JBPCO example, the team was able to bring new analysts to senior-level proficiency within a few months.
Give junior analysts early case ownership. Gartner’s move toward case ownership should also apply to new analysts. Assigning them end-to-end responsibility for low-risk cases, alongside senior reviewers, gives them practice in decision-making and response communication.
Use feedback to improve the system. Gartner lists “operational feedback management” among the responsibilities of future detection engineers and expects analysts to provide more feedback to improve AI accuracy. Some analysts at Prophet Security customers have already moved from handling alerts to managing the guidance an AI platform uses during investigations. The same work can provide a useful learning path for new employees.

The main risk is that analysts simply confirm what an agent says. One control is to have analysts work through a sample of cases independently and compare their conclusions with the agent’s assessment before approving it.

As AI SOC agents take on more alert triage and investigation, the role and skill set of SOC analysts are changing. Gartner’s 2026 report examines the roles needed for an agent-enabled SOC.

Download the report.

Detection engineering expands into SOC engineering

The 2028 forecast is based on a broader definition of engineering work. Gartner says detection engineering will expand into the broader field of SOC engineering.

The report asks SOC leaders to “redefine detection engineering role descriptions and hiring requirements.” Future roles should cover more than creating detection rules. They should also include prompt and guidance design, workflow testing, and AI output validation. Gartner additionally recommends software engineering practices such as version control, testing, and rollbacks.

These responsibilities apply to the systems and processes used after an agent enters production:

Rapid design and guidance: Define the steps and context agents should use when investigating activity in a particular environment, including asset criticality, VIP users, and known benign administrative activity.
Workflow testing: Check agent workflows against historical incidents before deployment, effectively backtesting detections before they go live.
AI output validation: Sample agent decisions on a regular schedule and measure how often human reviewers agree with them.
Version control and rollback: Manage guidance and detection changes as code so teams can track and revert inappropriate changes.

AI agents can also return analyst time for threat hunting. In the State of AI in Security Operations 2026 study, 49% of teams that hunted weekly or more often said their hunts uncovered malicious activity that would otherwise have gone undetected. Among teams that hunted least frequently, the figure was 8%.

Verified hunting results can give engineers new findings to turn into detections for their environments.

Security metrics shift from alerts to cases and decisions

Gartner’s guidance on measurement is concise: “Stop recording alert metrics and run SOC on cases and decisions.” The report recommends that SOC leaders continue tracking alert volume, closure rates, and average time to detection, while also measuring case accuracy, cycle time, and decision reliability.

Possible measurements include:

Case precision: Review a fixed sample of cases closed by agents and analysts each week, and track how often reviewers agree with the decisions.
Cycle time: Measure the period from the first signal to the incident decision, including the response.
Decision confidence: Record the strength of the evidence supporting each decision and track how often decisions are later reversed.

Alert counts remain useful for capacity planning, but they reveal little about whether decisions were correct. The newer measurements can be used alongside existing SOC metrics, including average response time.

Exposure management becomes a permanent SOC function

Gartner’s report calls exposure management “the new SOC capability to invest in first and foremost.” It recommends making continuous threat exposure management (CTEM) a permanent SOC function rather than an annual or quarterly exercise.

The report also predicts that by 2030, SOCs will be primarily offensive, testing organizations in the same way attackers do.

Many security teams have wanted to perform continuous testing for years but have lacked the time. Once agents process the alert queue, analysts and engineers can focus on identifying and validating exposures as they emerge.

Their findings can then be passed to the people responsible for creating detections and planning threat hunts.

Planning the transition to an AI-enabled SOC

Gartner’s recommendations translate into several decisions that are easier to make before an AI SOC is deployed:

Map current roles to the areas Gartner expects to grow: case ownership, SOC engineering, threat hunting, and exposure management.
Rewrite detection engineering job descriptions to include rapid design, workflow testing, and AI output validation.
Design an entry-level career path that includes case ownership and feedback work before triage volume declines.
Establish baseline measurements for case accuracy and cycle time so the results of the rollout can be compared with the starting point.
Choose at least one exposure management technique to perform continuously rather than once a year.

How Prophet Security says its platform can help

Prophet Security says it was recognized among the leading agentic AI SOC platforms in an honor recognized at Rising in Cyber 2026 and voted on by more than 150 CISOs and security leaders.

The company’s Prophet AI platform uses specialized AI agents to investigate alerts, hunt for threats, and build and orchestrate detections on top of the security tools a team already operates.

Case ownership: Prophet AI SOC Analyst investigates alerts and records the questions, queries, and evidence behind its decisions. Analysts can review the case, confirm the reasoning, group related investigations into a single incident, and take only team-approved response actions.
SOC engineering: Prophet AI detection engineers maintain live MITRE ATT&CK coverage maps based on the team’s research and build or adjust detections in response to research, hunts, and coverage gaps. Changes are backtested against the team’s history and delivered as versioned proposals for review. By default, the changes do not enter production until the team approves them. Guidance that modifies investigation steps is also versioned and testable.
Threat hunting: Prophet AI Threat Hunter automatically searches for critical new threats as they emerge. Teams can schedule hunts for coverage gaps or create hunts as plain-language questions. Suspicious findings are sent to Prophet AI SOC Analyst for investigation, and verified findings can become candidates for new detections.
Case accuracy: Prophet Security says it measures the quality of Prophet AI decisions through an ongoing quality-assurance program using ISO 2859-1 sampling audits. If the evidence does not support a verdict, Prophet AI SOC Analyst does not return a definitive decision rather than make a guess.

Read the full Gartner report

Gartner’s report outlines the roles, metrics, and skills that SOCs will need as AI agents take over more alert processing.

Download “Roles needed for an AI-enabled security operations center (SOC)” for Gartner’s guidance on L1 and L2 roles, SOC metrics, and the skills required by future SOC engineers.

Sponsored and written by Prophet Security.

Source: www.bleepingcomputer.com