AI in SOCs: How the Work of Security Analysts Changes

Artificial intelligence revolutionizes roles in SOCs: more satisfaction, but access to junior positions becomes more difficult

The adoption of artificial intelligence tools in Security Operations Centers (SOCs) is radically transforming the skills landscape, with 45% of analysts predicting an increase in the difficulty of accessing entry-level roles. The data emerges from a Swimlane survey conducted on 500 security professionals in companies that have already implemented AI solutions, such as those developed by Allama.

Quick Response

AI automates repetitive work, but the traditional learning path disappears

AI tools are replacing repetitive tasks such as phishing analysis, malware tracking, and case note compilation, activities that traditionally constituted the training path for new hires. This change has led to a paradox: while 89% of security analysts say AI has made their job more satisfying, 25% say it has hindered their professional development.

Junior positions risk becoming more elusive

1% of respondents predict that the career of a security analyst will remain unchanged, while nearly half expect entry-level roles to become harder to obtain. This is because AI is removing precisely those activities that allowed new hires to gain practical experience. According to analysts, new roles could focus on supervising, verifying, and coordinating AI systems, as described in the Snyk report.

Verifying AI recommendations becomes a critical skill

Analysts are spending more and more time reviewing AI-generated recommendations, with over 90% saying they are able to detect errors or omissions. Interviewees say they rely on their own judgment when evidence contradicts AI conclusions or when recommendations could disrupt business operations or critical systems.

The perception of AI impact differs between leaders and practitioners

Business leaders describe a more advanced AI implementation than field practitioners. 75% of leaders say AI is widely distributed across various security functions, compared to 50% of practitioners. In addition, leaders report greater role redefinition, capabilities, and satisfaction. Large companies with over 10,000 employees show a lower increase in satisfaction compared to medium-sized companies.

Formal role redefinition increases satisfaction

Organizations that have formally redefined analyst roles to focus on higher-value activities report a significant increase in job satisfaction. 71% of analysts with formally redefined roles say AI has improved their satisfaction, compared to 29% of those who have not undergone formal changes. This redefinition also provides managers with a clear benchmark for assessing the development of analysts' skills.

The main risk: excessive reliance on AI

The main concern of analysts is the possibility of over-relying on AI recommendations, which could reduce their ability to recognize when AI conclusions are incorrect. This risk is closely followed by the concern of exposing sensitive data. Analysts emphasize the importance of maintaining their critical skills to ensure a balance between efficiency and security.

Differentiated impact by company size

Large companies with over 10,000 employees show a lower increase in satisfaction compared to medium-sized companies. This could be due to greater organizational complexity or less uniform implementation of AI solutions. Smaller companies may benefit from greater flexibility in adopting new technologies.

The need for structured training programs

With the disappearance of the traditional on-the-job learning path, organizations will need to develop structured training programs to bridge the gap. This could include simulations, advanced training courses, and mentorship, as suggested in the Proofpoint report. Without a proactive approach, the risk is that essential skills will no longer be acquired, making it harder for new hires to develop the necessary skills to advance their careers.

The importance of measuring skills beyond satisfaction

While 91% of analysts are satisfied with their work, it is crucial for managers to distinguish between satisfaction and skill development. Formal role redefinition offers an opportunity to track these two aspects separately. This approach allows for the identification of potential training gaps and timely intervention to ensure that new hires acquire the necessary skills.

The challenge of compliance with NIS2 and DORA

The adoption of AI in SOCs also raises compliance issues with regulations such as the NIS2 Directive and the DORA Regulation. Organizations must ensure that the use of AI does not compromise digital operational resilience or the protection of sensitive data. This requires continuous risk assessment and the implementation of adequate security measures.

Impact on cyber insurance

The adoption of AI in SOCs could also influence the cost of cyber insurance. Insurance companies may require more rigorous demonstrations of risk management capabilities, especially in the ransomware area. Organizations that invest in training and role redefinition may benefit from more favorable premiums.

The importance of SOC as a Service

For smaller companies, the adoption of a SOC as a Service could offer a practical alternative. These services can provide access to advanced skills and AI technologies without the need for significant infrastructure investments. However, it is essential to carefully evaluate providers to ensure they meet the required security standards.