How AI Is Changing the Roles Required in the Security Operations Center
Rapid7 says AI should move SOC analysts from alert triage to case ownership, citing Gartner workforce guidance.
Rapid7 promoted a Gartner report on roles for an AI-enabled security operations center and argued that analysts should move from alert triage to case ownership. Gartner assumes that by 2028 security operations teams will have 50% more engineers than analysts, with detection engineering covering prompt design, workflow testing, and AI output validation. Rapid7 says its agentic MDR workflows save more than 200 analyst hours each week at 99.93% benign-disposition accuracy, and it pairs that pitch with Exposure Command.
- Gartner says analysts should own cases, not triage individual alerts
- By 2028, SOCs may have 50% more engineers than analysts
- Rapid7 cites over 200 analyst hours saved weekly and 99.93% benign accuracy
- Detection engineering expands to prompts, workflow testing, and AI validation
- Gartner ranks exposure management as the first SOC capability to fund
- Vendors
- Rapid7
- Products
- Exposure CommandRapid7 MDR
From the original article
3 min read at rapid7.com
As AI takes on more of the enrichment, correlation, and initial assessment inside the SOC, roles, skills, and KPIs still require deliberate redesign.
By Rapid7 · rapid7.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.