Gartner: SOCs Favor Engineers Over Analysts

Gartner has released a recent forecast indicating that security operation teams (SOCs) are expected to employ 50% more engineers than analysts by 2028. This trend is driven by the increasing use of AI agents that take over routine tasks in alarm handling. The study highlights how roles within SOCs are changing, particularly in the areas of analyst responsibilities, detection technology, threat hunting, and exposure management. The role of SOC analysts has significantly evolved in recent years. Traditionally, analysts were responsible for monitoring security events and responding to incidents.

With the introduction of AI technologies, a large portion of these tasks is being automated, reducing the need for human analysts. Gartner emphasizes that AI systems can recognize patterns and identify anomalies faster than humans. Another aspect of the study is the necessity to train engineers in SOCs. These professionals will increasingly be responsible for developing and implementing AI-driven solutions. The demand for technical skills will rise, as engineers will not only maintain systems but also integrate new technologies to enhance the efficiency of security operations.

The changes in SOCs are not only due to automation but also to the increasing complexity of the threat landscape. Cyberattacks are becoming more sophisticated, requiring a proactive approach to security. Engineers will be needed to develop innovative solutions that can respond to these new threats. Gartner predicts that companies investing in the training of their engineers will gain a competitive advantage. The Gartner study also shows that companies integrating AI into their security strategies can achieve higher efficiency and effectiveness in their SOCs.

Automation of routine tasks allows analysts to focus on more complex issues that require human judgment. This could lead to improved response times to security incidents and enhance the overall security posture of a company. Another important point is the change in career paths within the security industry. With the shift towards more engineers, it will be necessary to develop new training programs tailored to the needs of modern SOCs. Colleges and training institutions must adjust their curricula to ensure that future professionals possess the necessary skills to succeed in an increasingly technology-driven environment.

Gartner's forecast is part of a larger trend in the IT security industry that emphasizes the need to adapt to rapidly changing technologies and threats. Companies must be willing to invest in new technologies and training to remain competitive. According to Gartner, the market for security solutions is expected to grow to $300 billion by 2028. The changes in SOCs could also impact how companies plan and implement their security strategies. The integration of AI and the focus on engineers may lead companies to reassess their security budgets and potentially invest more in technological innovations.

Gartner recommends that companies start planning now to take advantage of these changes. The Gartner study underscores the need for companies to proactively address the challenges of cybersecurity. The role of engineers will be crucial in strengthening security infrastructure and responding to new threats. Gartner expects that by 2028, over 60% of SOC personnel will be engineers, significantly influencing the direction of the industry.