VQV Signal

USEFUL NOW SOURCE-BACKED TECHNICAL

Gartner Predicts SOCs Will Have 50% More Engineers Than Analysts by 2028

Gartner predicts that security operations centers (SOCs) will have 50% more engineers than analysts by 2028, as AI agents take over routine alert handling. The prediction is reported by BleepingComputer, which cites a Prophet Security examination of how AI is reshaping SOC roles. That examination covers analyst responsibilities, detection engineering, threat hunting and exposure management. The source snippet gives the forecast and the areas of change but does not provide further figures or details on methodology.

Source: BleepingComputer · bleepingcomputer.com Published 2026-11-03T15:00:10+00:00 Detected 2026-11-03T18:17:52+00:00
View original source

Gartner predicts that security operations centers (SOCs) will have 50% more engineers than analysts by 2028, as AI agents take over routine alert handling. The prediction is reported by BleepingComputer, which cites a Prophet Security examination of how AI is reshaping SOC roles. That examination covers analyst responsibilities, detection engineering, threat hunting and exposure management. The source snippet gives the forecast and the areas of change but does not provide further figures or details on methodology.

AI-assisted summary based on the listed source.

Gartner predicts that security operations centers will have 50% more engineers than analysts by 2028 as AI agents take over routine alert handling. Prophet Security examines how AI is reshaping SOC roles, from analyst responsibilities and detection engineering to threat hunting and exposure management. [...]

Security teams and the vendors that serve them would see their staffing mix shift from alert triage toward engineering work if this forecast holds. Analysts whose daily work is routine alert handling may need to build skills in detection engineering, threat hunting or exposure management. Leaders planning SOC hiring and tooling should watch how quickly AI agents take over routine alerts in practice.

Developers may have a new tool, API, or workflow change worth testing against their own stack.

Signal Strength 95% Technical label SOURCE-BACKED Public Interest 32 Category USEFUL NOW Reader Depth TECHNICAL

Signal Strength reflects source quality, relevance, freshness and evidence. Public Interest helps organize discovery; it is not proof of truth.

Public Interest components
Recognizable Entity Score 0 Practical Impact Score 20 Novelty Interest Score 70 Consequence Score 50 Curiosity Score 16 Shareability Score 45

VQV surfaced this signal because it is recent, relevant to AI Agents, connected to BleepingComputer.