Gartner® report

The Roles Required for the AI-Enabled Security Operations Center (SOC)

AI can change SOC work faster than roles, skills, and KPIs can evolve. Security leaders need to decide what analysts should own, which engineering capabilities their teams require, and where future investment could have the greatest impact.

Get complimentary access to the Gartner® report now.

Our key takeaways

Inside the Research

  • Where analysts should own decisions and response
  • Which engineering skills AI-enabled workflows may require
  • How exposure management can become a continuous SOC function
Get the report
rapid7-inside-the-research-1200x900.png

Rapid7 Perspective

Human-led, AI-driven

Rapid7 believes AI can reduce repetitive work while analysts retain ownership of consequential decisions. Managed Detection and Response adds investigation and response capacity, while Exposure Command supports continuous exposure reduction.

Get the report
rapid7-human-led-1200x900.png

Main focus

Changing SOC roles

Quote Icon

Human analysts must transition from alert triage roles to end-to-end case ownership and effective response option communication.

Gartner, The Roles Required for the AI-Enabled Security Operations Center (SOC), Pete Shoard, 1 May 2026
Quote Icon

By 2028 there will be 50% more engineers in security operations teams than analysts.

Gartner, The Roles Required for the AI-Enabled Security Operations Center (SOC), Pete Shoard, 1 May 2026
Quote Icon

Exposure management is the emerging SOC capability to invest in before anything else.

Gartner, The Roles Required for the AI-Enabled Security Operations Center (SOC), Pete Shoard, 1 May 2026
Get the report

About the publication

Gartner, The Roles Required for the AI-Enabled Security Operations Center (SOC), Pete Shoard, 1 May 2026.

GARTNER is a trademark of Gartner, Inc. and/or its affiliates in the U.S. and internationally and is used herein with permission. All rights reserved

Gartner does not endorse any vendor, product, or service depicted in its research publications and does not advise technology users to select only those vendors with the highest ratings or other designation. Gartner research publications consist of the opinions of Gartner’s research organization and should not be construed as statements of fact. Gartner disclaims all warranties, expressed or implied, with respect to this research, including any warranties of merchantability or fitness for a particular purpose.

Plan the next version of your SOC

Access The Roles Required for the AI-Enabled Security Operations Center (SOC) to explore how security leaders may need to rethink role ownership, engineering capabilities, performance measures, and investment priorities.

Get the report