That is one of the predictions in The Roles Required for the AI-Enabled Security Operations Center (SOC), a 2026 Gartner report by analyst Pete Shoard. If the prediction holds, the people who build and tune a SOC's systems will outnumber the people who work its queue.
Gartner starts its reasoning with alert handling. The report finds that AI SOC agents already cut alert-handling work significantly for common and traditional detection use cases.
It describes this as the end of alert processing as the SOC's primary function. From there, the report works through what that means for the people in the SOC. Analysts move from triage to case ownership, and entry-level roles need a new way in.
