Security Teams Will Soon Need More Engineers Than Analysts

Gartner predicts AI will flip security team roles, requiring 50% more engineers than analysts to manage automated systems by 2028.

A new forecast from Gartner signals a major transformation in how companies defend themselves against cyberattacks. According to a report highlighted by BleepingComputer, the research firm predicts that by 2028, security operations centers (SOCs) will employ 50% more engineers than analysts. This represents a fundamental inversion of the traditional SOC model, which has long relied on a larger number of analysts to manually triage and investigate security alerts. The primary driver for this change is the increasing adoption of AI agents, which are becoming capable of handling the routine, high-volume work that currently consumes most analysts' time.

The shift from an analyst-heavy to an engineer-heavy model reflects a deeper change in the nature of security work. Historically, a security analyst’s job has been largely reactive: monitoring dashboards, investigating alerts generated by security tools, and escalating potential incidents. An engineer, by contrast, builds and maintains the systems that generate those alerts. As AI takes over the initial alert filtering and correlation, the demand for manual triage will decrease. Instead, the critical need will be for engineers who can build, integrate, and fine-tune these complex AI-driven automation platforms. Their work will focus on detection engineering, creating custom rules, and developing automated response playbooks, transforming the SOC from a reactive monitoring post into a proactive, self-improving system.

This trend is not emerging in a vacuum. It is the acceleration of a long-standing effort within the cybersecurity industry to combat alert fatigue and a persistent talent shortage. For years, security teams have been overwhelmed by the sheer volume of alerts from a growing number of tools, many of which are false positives. Automation has always been seen as the solution, but early attempts were often brittle and required significant maintenance. The rise of more sophisticated AI and machine learning models now makes it possible to automate not just simple filtering but also more complex analysis and investigation, finally delivering on the promise of a more efficient and effective security operation. This aligns with broader IT trends like DevSecOps, which emphasize building security into systems from the start rather than bolting it on at the end.

For technology leaders, this prediction is a clear call to action. It’s time to rethink hiring roadmaps, career development paths, and technology investments for security teams. The future value of a SOC will be measured less by the number of alerts it can close and more by the resilience and sophistication of its automated defenses. This means prioritizing the hiring of professionals with skills in software development, data science, and automation alongside traditional security expertise. It also requires creating pathways for current analysts to upskill into more technical roles like detection engineering, threat hunting, and exposure management. The SOC of the near future is not a room full of people watching screens, but a small, elite team of engineers building a system that largely defends itself.

This prediction signals a fundamental change in the skills required to run a modern security operations center. Engineering and automation skills will become more valuable than traditional alert triage, directly impacting career paths for security professionals and hiring strategies for engineering leaders.

Companies must prepare for a significant shift in security team budgets and hiring priorities. Investing in automation and engineering talent will be crucial for efficiency and staying ahead of threats, while failing to adapt could lead to higher operational costs and security gaps.