By 2028, the landscape of the Security Operations Center (SOC) is poised for a dramatic re-engineering. A 2026 **Gartner** report, "The Roles Required for the AI-Enabled Security Operations Center (SOC)" by analyst **Pete Shoard**, projects that security operations teams will see a 50% increase in engineers compared to analysts. This signals a future where those who build and refine SOC systems will significantly outnumber those who manage the alert queue. The core reasoning behind this prediction lies in the evolving nature of alert handling. **Gartner** notes that AI SOC agents are already adept at substantially reducing the workload associated with common and traditional detection use cases. This development marks the end of alert processing as the primary function of the SOC. This fundamental shift will ripple through the entire SOC structure. Analysts will transition from mere triage to comprehensive case ownership, while entry-level roles will require new pathways for development. Detection engineering will evolve into a broader SOC engineering discipline, metrics will pivot from alerts to cases and decisions, and exposure management will solidify its position as a standing SOC function. Prophet Security is currently offering the full **Gartner** report as a [free download](https://resources.prophetsecurity.ai/gartner-report?Lsource=bleeping&utm_source=bleepingcomputer&utm_medium=paid-article).  ## Analysts Move from Alert Triage to Case Ownership **Gartner**'s directive for analysts is clear: "Human analysts must transition from alert triage roles to end-to-end case ownership and effective response option communication." In practice, the AI agent will handle the initial investigation, while the analyst will own the subsequent actions. This entails validating agent findings, selecting appropriate responses, and clearly communicating options to stakeholders who need to act. The report also emphasizes that even AI-assembled case files necessitate meaningful human validation before teams can fully rely on them. Consequently, analysts will dedicate more time to assessing the veracity of conclusions and less to generating verdicts from scratch. Crucially, **Gartner** does not foresee a reduction in team size. "The SOC will not shrink by 2030," the report states. Instead, personnel previously engaged in high-volume alert processing will be redirected towards detection engineering, threat expertise, offensive testing, and exposure management. This perspective is echoed by practitioners. Prophet Security's "State of AI in Security Operations 2026" survey, which polled over 250 CISOs, SOC leaders, and practitioners, found that 57% expect their team size to remain stable, with an additional 9% anticipating growth. ## Entry-Level Roles Need a New Way In Historically, many analysts gained their foundational experience in Tier 1 triage roles, a function that AI is now effectively flattening. The high volume of alerts in these tiers provided invaluable exposure to what constitutes 'normal' within an environment. The **Gartner** report addresses how L1 and L2 roles will transform and the proactive training and staffing adjustments SOC leaders should implement. If AI agents take over triage, junior analysts risk losing the critical repetitions that build their judgment, unless deliberate efforts are made to replace these experiences. Three key practices can facilitate this: * **Study the agent's work:** When an agent meticulously records its investigative steps—including questions asked, queries run, and supporting evidence—each closed alert becomes a valuable case study. Junior analysts can review these examples to compare their own hypothetical queries and conclusions. At **JBPCO**, this approach enabled a new analyst to achieve senior-level proficiency within months. * **Own cases early:** The shift to case ownership extends to new analysts. Assigning them end-to-end responsibility for lower-risk cases, under the guidance of a senior reviewer, allows them to practice the decision-making and response communication central to the evolving analyst role. * **Feed corrections back:** **Gartner** identifies "operational feedback management" as a responsibility of the future detection engineer, expecting analysts to provide more feedback to enhance AI accuracy. Among Prophet Security's clients, some analysts are already transitioning from alert handling to curating the guidance used by AI platforms in investigations, a task well-suited for new hires learning the environment. A critical risk to manage is analysts merely confirming agent findings. A control mechanism involves having analysts work a sample of cases independently before reviewing the agent's determination, then comparing the two. ## Detection Engineering Grows into SOC Engineering The 2028 prediction is underpinned by a broader understanding of engineering work. **Gartner** describes detection engineering expanding into a more comprehensive SOC engineering discipline. The report advises SOC leaders to "redefine detection engineering role descriptions and hiring requirements." These new descriptions should extend beyond traditional rule writing to encompass prompt design, workflow testing, and AI output validation. The report also advocates for the adoption of software engineering best practices such as versioning, testing, and rollback. Each of these aligns with tasks that emerge once AI agents are operational in production environments: * **Prompt design and guidance:** Crafting the instructions and contextual information an agent uses for investigations within a specific environment, including asset criticality, VIP users, and known-benign administrative activities. * **Workflow testing:** Evaluating an agent's workflow against historical incidents before deployment, akin to backtesting a detection rule. * **AI output validation:** Regularly sampling the agent's determinations and measuring the consistency of reviewer agreement. * **Versioning and rollback:** Managing changes to guidance and detections as code, enabling traceability and the ability to revert problematic modifications. The analyst hours reclaimed by AI agents will also be reinvested into threat hunting. Prophet Security's "State of AI in Security Operations 2026" survey revealed that 49% of teams engaging in weekly or more frequent hunting activities discovered malicious activity that their existing detections missed. For teams with the lowest hunting frequency, this figure dropped to 8%. A confirmed hunt finding often provides engineers with valuable insights to develop new detections tailored to their environment. ## The Metrics Move from Alerts to Cases and Decisions **Gartner**'s guidance on measurement is concise: "Stop recording alert metrics and run the SOC on cases and decisions." The report steers SOC leaders away from traditional metrics like alert volume, closure rates, and mean time to detect, advocating instead for metrics such as case accuracy, cycle time, and decision confidence. Here's how each can be quantified: * **Case accuracy:** Weekly review of a fixed sample of closed cases, from both agents and analysts, to track reviewer agreement with the determination. * **Cycle time:** Measuring the duration from the initial signal to a final decision on the case, including the response. * **Decision confidence:** Recording the amount of evidence supporting each determination and the frequency with which decisions are later overturned. While alert counts remain useful for capacity planning, they offer little insight into the correctness of a determination. These new measures can complement existing SOC metrics, such as mean time to respond. ## Exposure Management Becomes a Standing SOC Function **Gartner** identifies exposure management as "the emerging SOC capability to invest in before anything else." It advocates for Continuous Threat Exposure Management (**CTEM**) to operate as a standing SOC function, moving beyond annual or quarterly exercises. Furthermore, the report predicts that by 2030, SOCs will largely adopt an offensively driven approach, continuously testing their own business assets from an attacker's perspective. Many security teams have long aspired to implement this continuous testing model but have often lacked the resources. With AI agents managing the alert queue, analysts and engineers can redirect their efforts towards exposure work, validating vulnerabilities as they emerge. The findings from these efforts will then inform the development of new detections and the planning of proactive threat hunts.