Gartner Predicts SOCs Will Have 50% More Engineers Than Analysts by 2028
Gartner report shifts analyst roles to case ownership as AI agents handle triage, with metrics moving to cases and decisions.
A 2026 Gartner report predicts that by 2028 security operations teams will have 50% more engineers than analysts. AI agents will reduce alert-handling work, moving analysts to end-to-end case ownership and response communication. Detection engineering expands to include prompt design, workflow testing, and AI validation. SOC leaders should stop using alert metrics and focus on cases and decisions instead.
- Analysts shift from triage to case ownership
- Detection engineering adds prompt design and AI validation
- Metrics change from alerts to cases and decisions
- New analysts practice case ownership with senior review
- SOC team size expected to remain stable or grow
- Vendors
- Gartner
- Organizations
- Prophet Security
From the original article
7 min read at bleepingcomputer.com
Gartner predicts that security operations centers will have 50% more engineers than analysts by 2028 as AI agents take over routine alert handling. Prophet Security examines how AI is reshaping SOC roles, from analyst responsibilities and detection engineering to threat hunting and exposure management. [...]
By Sponsored by Prophet Security · bleepingcomputer.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.