● Covered by 2 sources · 2 reportsMedium impact2 neutral
AI Redefines Security Operations, Shifting Analyst Roles to 'Threat Operator'
Key points
- AI automates traditional security analyst tasks.
- Security operations centers (SOCs) will reorganize.
- New role: 'Threat Operator' emerges.
- Threat Operators direct AI, prioritize defenses.
- By 2028, SOCs will have 50% more engineers than analysts.
- The Gartner report is titled 'The Roles Required for the AI-Enabled Security Operations Center (SOC)'.
- Pete Shoard is the Gartner analyst who authored the report.
- Prophet Security offers the full report as a free download.
AI's Impact on Security Analyst Roles
Artificial intelligence is beginning to automate many tasks historically performed by security analysts. These tasks include investigating alerts, collecting evidence, correlating activity across various tools, and executing response actions. As AI capabilities mature, security operations centers (SOCs) will experience significant changes in how work is structured, how decisions are made, and the expectations for security personnel.
Introduction of the 'Threat Operator' Role
This automation allows security professionals to adopt a broader role. With AI handling operational workloads, analysts can move beyond individual alerts and investigations to direct the overall defense across the entire security lifecycle. This emerging role is termed the 'Threat Operator,' an AI-native security professional responsible for translating business risks into defensive priorities, directing AI-driven operations, and exercising judgment over the decisions and actions taken by these AI systems.
Changes in SOC Structure and Skill Requirements
The implications extend beyond daily SOC activities, affecting the skills organizations require, how security professionals develop expertise, and available career paths. The traditional SOC model, with specialized functions like threat intelligence, detection engineering, threat hunting, and incident response, often involves manual handoffs between teams. AI is starting to integrate these activities, allowing for coordinated workflows where context and findings are carried from one stage to the next by AI agents.
Shifting Value Proposition for Security Professionals
This integration changes where security professionals provide the most value. A Threat Operator will work across the entire defensive lifecycle, establishing priorities based on the organization's exposure, business operations, and the current threat landscape. They will determine which risks warrant attention, what the defense should achieve, the level of autonomy AI systems should have, and when human judgment is required for decisions.
Updates
- By 2028, SOCs will have 50% more engineers than analysts.
- The Gartner report is titled 'The Roles Required for the AI-Enabled Security Operations Center (SOC)'.
- Pete Shoard is the Gartner analyst who authored the report.
- Prophet Security offers the full report as a free download.
✨ This summary was generated by AI from the outlets' reporting listed below. It is not independently verified and may contain errors — check the original sources. How BrevFeed works →
The daily brief
One email each morning: the day's tech stories, clustered across outlets and summarized. No account needed.
One email a day. Unsubscribe in one click, any time.
Today's brief
Spend a few minutes, get the whole day. Every topic's top stories in one hands-free rundown — listen, watch, or read the transcript.
▶ Play today's brief
New every morning, and the back catalogue is archived by date.
How outlets covered it
A Gartner report predicts that by 2028, Security Operations Centers (SOCs) will have 50% more engineers than analysts. This shift is attributed to AI agents handling common alert-handling tasks, moving analysts from alert triage to end-to-end case ownership and response communication.
AI is increasingly automating tasks traditionally performed by security analysts, such as alert investigation and response actions. This shift will transform Security Operations Centers (SOCs) by integrating security functions and creating a new role called the 'Threat Operator'. Threat Operators will direct AI-driven operations, translate business risks into defensive priorities, and oversee AI system decisions across the security lifecycle.