AI-Driven Shift: Engineers Set to Outnumber Analysts in SOCs by 2028

Gartner's latest forecast indicates that by 2028, security operations centers (SOCs) will employ roughly 50 percent more engineers than analysts, a change driven by the expanding role of artificial‑intelligence agents in handling routine alerts.

The research firm attributes the shift to AI‑powered automation that can triage and resolve low‑complexity incidents without human intervention. As these systems mature, they free analysts from repetitive tasks, allowing them to concentrate on higher‑order activities such as threat hunting, strategic planning, and incident response coordination.

Industry observers, including Prophet Security, note that the evolving landscape will reshape job descriptions across the SOC spectrum. Detection engineers, for example, will be tasked with designing and maintaining the AI models that sift through massive data streams, while analysts will need deeper expertise in interpreting the nuanced outputs of those models and guiding remediation efforts.

Historically, SOCs have been staffed predominantly by analysts who monitor alerts, investigate anomalies, and perform manual triage. The influx of automation tools—ranging from machine‑learning‑based correlation engines to autonomous response bots—has begun to compress the analyst pipeline, prompting organizations to invest more heavily in engineering talent capable of building, tuning, and overseeing these systems.

Experts caution that the transition will not eliminate analyst roles but will elevate the skill set required. Analysts will likely need stronger knowledge of scripting, data science concepts, and the underlying architecture of AI tools to collaborate effectively with engineering teams.

For enterprises, the projected staffing realignment carries both operational and budgetary implications. While AI can reduce the volume of alerts that demand human review, the upfront costs of hiring and training engineers, as well as procuring advanced platforms, may offset some savings in the short term. Over the longer horizon, however, organizations anticipate faster response times and a lower rate of false positives, potentially delivering a net efficiency gain.

Regulators and auditors are also watching the trend, recognizing that reliance on automated decision‑making introduces new compliance considerations. Clear governance frameworks will be needed to ensure AI actions are transparent, auditable, and aligned with existing security policies.

Looking ahead, Gartner suggests that the ratio of engineers to analysts could continue to tilt further as generative AI and autonomous response capabilities evolve. Companies that proactively reskill their workforce and integrate engineering expertise into their SOCs are likely to stay ahead of emerging threats while maintaining robust security postures.