Dive Brief:
- AI is changing how security operations centers (SOCs) work, making it easier for some to develop new skills while hampering others’ professional development, the agentic AI firm Swimlane said in a report published on Wednesday.
- As businesses integrate AI more deeply into their security processes, employees are spending less time on mundane work and more time on strategic activities, according to the report.
- At the same time, Swimlane found, human judgment remains essential for AI-enhanced SOCs to avoid costly mistakes.
Dive Insight:
One of the biggest questions about AI’s use in cybersecurity is how it will affect workforce development and career advancement for security professionals. Swimlane’s report, which is based on a survey of 500 security workers in the U.S. and the U.K. between August and September, offers a clue as to how those and other trends are unfolding.
Nearly two-thirds (62%) of workers said AI was helping them develop their cybersecurity skills, and 92% of those workers said their job satisfaction had improved. At the same time, 24% of workers said AI was limiting their ability to enhance their skills. But even among that group, 91% reported higher job satisfaction because of AI’s integration into their workflows. With other research showing that burnout is prompting many cybersecurity workers to consider leaving their jobs, AI’s ability to reduce workloads could be a major boon to security teams.
As AI becomes more capable of performing repetitive tasks and analyzing large quantities of data, cybersecurity professionals worry that SOC jobs will start disappearing. Almost half (47%) of respondents predicted that SOC analyst careers would be harder to get in the future, as companies automate practices that can be performed more cheaply by machines.
More than four in 10 respondents said AI had reduced the amount of time they spent investigating known threat patterns, while roughly one-third said it had sped up the process of creating remediation recommendations and a similar share said it had saved them time while reviewing and triaging alerts.
But those repetitive tasks are only part of what happens inside a SOC, and AI still struggles to supplant human judgment. Roughly half of respondents said they were more likely to trust their instincts over an AI’s output when the AI’s recommendation conflicted with the available evidence. Roughly one in five respondents said their biggest worry about AI’s integration into the SOC was that their team would become overly reliant on the AI’s recommendations.
“As AI assumes more investigative work, analysts are increasingly responsible for validating evidence, handling exceptions and making higher-impact decisions,” Swimlane said in its report.
Nearly six in 10 workers said AI had created new opportunities for SOC workers to hone their strategic decision-making skills, highlighting AI’s mixed impact — reducing the need for human involvement in certain SOC activities while magnifying the need for it elsewhere.
Executives are more likely than lower-level workers to embrace AI’s transformation of cybersecurity operations. Fifty-two percent of leaders reported being able to manage more security activities, compared with only 36% of practitioners. Leaders and practitioners also had different perceptions of how much their businesses were using AI for cybersecurity — 74% of leaders said their deployments were extensive, compared with 49% of practitioners.
“These respondents were not paired within the same organizations, so the findings do not show leaders and practitioners disagreeing about identical environments,” Swimlane said, “but the pattern still matters because leaders often set investment priorities, define success and communicate results.”
