Short answer: By 2028, security operations teams will have more engineers than analysts. This means analysts will focus more on decision-making and response. Stay updated and consider developing skills in both roles.
TL;DR
- Security operations teams will have more engineers by 2028.
- Analysts will handle cases from start to finish.
- Entry-level analysts need new training methods.
- Detection engineering becomes broader SOC engineering.
What happened?
Gartner predicts that by 2028, security operations centers (SOCs) will have 50% more engineers than analysts. This shift means that engineers will build and maintain SOC systems, while analysts will focus on decision-making and communication. Analysts will no longer just handle alerts but will own cases from start to finish. SOC leaders should train analysts to review agent work and provide feedback to improve AI accuracy.
Key facts
| Reported by | BleepingComputer |
|---|---|
| Date reported | 03 Nov 2026 |
How it works
By 2028, security operations teams (SOC) will have more engineers than analysts. Engineers build and tune SOC systems, while analysts handle cases and make decisions. AI reduces alert handling, so analysts focus on case ownership and communication.
Timeline
| Date | Event | Source |
|---|---|---|
| 2026-11-03 | Reported by BleepingComputer | BleepingComputer |
| 2026-11-07 | This Skillmate explainer published | Skillmate |
How to fix it
- Keep systems and network devices updated and follow vendor security notices.
- Make sure an incident response contact and plan exist before an attack happens.
- Ask your service providers which protections they offer, and test them.
How to detect it
Detection looks for signs like unusual logins, system crashes, and odd logs.
What is confirmed
- Reported by BleepingComputer
Why it matters
This matters because SOC teams will need to adapt. Engineers will outnumber analysts, focusing on system building and tuning. Analysts will need new skills in case ownership and decision-making. Companies must prepare for these changes to maintain security.
Learn the skills behind this story
Want to understand attacks like this and defend against them? Join Skillmate cybersecurity training or practise hands-on in Skillmate Labs.
FAQ
What is SOC engineering?
SOC engineering is about building and maintaining security systems, which is becoming more important than just analyzing alerts.
How will analysts' roles change?
Analysts will focus more on confirming findings and communicating responses, rather than just triaging alerts.
What new skills will analysts need?
Analysts will need to learn how to validate AI findings and communicate decisions effectively.
Sources
- Gartner Predicts SOCs Will Have 50% More Engineers Than Analysts by 2028 (BleepingComputer)
How we wrote this: facts come from the sources above. An on-prem AI model drafted the plain-English parts and every sentence was checked against the sources; unsupported sentences were removed. MITRE mapping is our own judgement.
