Gartner Predicts SOCs Will Have 50% More Engineers Than Analysts by 2028

Summary

Gartner's 2026 report The Roles Required for the AI-Enabled Security Operations Center (SOC), by analyst Pete Shoard, predicts that by 2028 SOCs will have 50% more engineers than analysts as AI agents take over routine alert handling. The report says AI SOC agents already cut alert-handling work significantly for common and traditional detection use cases, and it argues analysts will shift from triage to end-to-end case ownership. Prophet Security's 2026 survey of more than 250 respondents found 57% expect team size to stay the same and 9% expect it to grow.