By 2028, security operations teams will have 50% more engineers than analysts.
Gartner's forecast and the structural shift in SOCs
That projection comes from The Roles Required for the AI-Enabled Security Operations Center (SOC), a 2026 Gartner report by analyst Pete Shoard. Gartner bases the prediction on the growing role of "AI SOC agents" that already cut alert-handling work significantly for common and traditional detection use cases, a change the report describes as "the end of alert processing as the SOC's primary function."
In plain terms, the people who build and tune a SOC's systems will, if Gartner's prediction holds, outnumber the people who work its queue. The report explicitly warns that this is not a jobs-reduction prediction: "The SOC will not shrink by 2030." Instead, Gartner says staff hours freed from alert volume will redirect into detection engineering, threat expertise, offensive testing, and exposure management.
Analysts move from triage to case ownership
Gartner's directive for analysts is straightforward: "Human analysts must transition from alert triage roles to end-to-end case ownership and effective response option communication." The report lays out how that shift plays out in practice: an AI agent investigates the alert and assembles an agentic case file; the analyst then confirms the agent's findings, selects the response, and communicates options to those who must act on them.
The report also cautions that agent-assembled case files still require "meaningful human validation" before teams can rely on them, so analysts will spend more time judging whether a conclusion holds up and less time producing verdicts from scratch. Gartner recommends several concrete practices to retain and build junior judgment now that Tier 1 triage volume will fall:
- Study the agent's work: when an agent records every question, query and piece of evidence, closed alerts become worked examples; at JBPCO this approach enabled onboarding a new analyst to senior proficiency within months.
- Own cases early: give new analysts end-to-end ownership of lower-risk cases with senior review to exercise decision-making and response communication.
- Feed corrections back: analysts should curate the guidance the AI platform uses and provide operational feedback that detection engineers use to improve accuracy; some Prophet Security customers already do this.
Gartner also suggests a control to prevent analysts from only confirming agent output: have analysts work a sample of cases on their own before they see the agent's determination, then compare the two.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleDetection engineering grows into SOC engineering
Gartner argues that detection engineering will broaden into a SOC engineering discipline that includes prompt design, workflow testing, AI output validation, and software engineering practices such as versioning, testing and rollback. The report tells SOC leaders to "redefine detection engineering role descriptions and hiring requirements."
The report maps those tasks to concrete work once agents run in production: writing the instructions and contextual guidance an agent uses (asset criticality, VIP users, known-benign admin activity); backtesting agent workflows against past incidents before going live; sampling agent determinations to measure reviewer agreement; and managing guidance and detection changes as version-controlled artifacts so bad changes can be traced and reverted.
Gartner also notes that the analyst hours agents return commonly go into hunting: in Prophet Security's State of AI in Security Operations 2026 survey, 49% of teams that hunt weekly or more said a hunt had surfaced malicious activity their detections missed, compared with 8% among teams reporting the lowest hunting frequency.
Exposure management as a standing SOC function
The report calls continuous threat exposure management (CTEM) "the emerging SOC capability to invest in before anything else" and recommends running it as a standing SOC function rather than an annual or quarterly exercise. Gartner predicts that by 2030 SOCs will be "largely offensively driven, testing their own business the way an attacker would."
Once agents handle the alert queue, analysts and engineers redeployed into exposure work can validate exposures as they appear and feed findings back to detection writers and hunting plans. Gartner recommends choosing one exposure management practice to run continuously during the transition.
What CISOs, SOC leaders, and Prophet Security customers will watch
CISOs and SOC leaders should map today's roles against the work Gartner expects to grow—case ownership, SOC engineering, hunting and exposure management—and rewrite detection-engineering job descriptions to include prompt design, workflow testing and AI output validation. Gartner advises designing the entry-level path before triage volume drops and recording a baseline for case accuracy and cycle time so the rollout has a measurable before-and-after.
Practitioners and junior analysts should expect training paths that replace high-volume triage with worked examples, early case ownership, and feedback work that helps shape agent guidance. Prophet Security's survey of more than 250 CISOs, SOC leaders and practitioners found 57% expect team size to stay the same and 9% expect it to grow, indicating many teams plan to redeploy rather than shrink.
Prophet Security positions its Prophet AI platform to address these shifts: Prophet AI SOC Analyst records every question, query and piece of evidence; Prophet AI Detection Engineer maintains a live MITRE ATT&CK coverage map and produces version-controlled, backtested detection proposals; Prophet AI Threat Hunter runs automated and scheduled hunts; and Prophet Security measures case accuracy through a continuous QA program using ISO 2859-1 sampling audits.
Gartner's prescriptions are practical and operational: change job descriptions, track different metrics, and make exposure management continuous. The central test, as the report sets it out, is whether SOCs can translate alert-reducing AI into better case decisions, reliable validation practices, and an engineering backbone that treats agent guidance as code to be tested, versioned, and rolled back when necessary.
