Gartner: 70% of SOCs will pilot AI agents. Only 15% will see results
Gartner predicts 70% of large SOCs will pilot AI agents by 2028, but only 15% will achieve measurable improvements.
A Gartner report by analysts Craig Lawson and Andrew Davies projects that by 2028, 70% of large SOCs will pilot AI agents for Tier 1 and Tier 2 operations, but only 15% will achieve measurable improvements without structured evaluation. Prophet Security's State of AI in Security Operations 2026 survey found 40% of security teams use AI daily and 56% are evaluating or piloting it. The report offers evaluation questions covering workload reduction, TDIR outcomes, vendor viability, analyst upskilling, and autonomy boundaries to counter AI washing in the market.
- 40% of security teams use AI daily; only 4% have no plans
- 72% of AI-using teams report cutting investigation time by at least 25%
- 46% of homegrown SOC AI builds were abandoned, shelved, or replaced
- 28% of alerts are never investigated; 60% say missed alerts proved material
- 38% of respondents say proactive hunts found activity detections missed
- Vendors
- GartnerProphet Security
- Organizations
- GartnerProphet Security
From the original article
7 min read at helpnetsecurity.com
In the Gartner report Validate the Promises of AI SOC Agents With These Key Questions, analysts Craig Lawson and Andrew Davies posit that “By 2028, 70% of large SOCs will pilot AI agents to augment Tier 1 and Tier 2 operations, but only 15% will achieve measurable improvements without structured evaluation.” Just last year, Gartner placed AI SOC Agents at the Innovation Trigger stage with single-digit adoption.
helpnetsecurity.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.