Every few months a vendor deck promises an autonomous SOC: no analysts, no tiers, no queue, just a model quietly closing tickets overnight. Having run security programmes through three previous waves of automation, I can tell you how this one ends. The team survives. The job does not.
What actually gets automated
The parts of security work that AI absorbs first are the parts nobody wanted anyway: triage of low-fidelity alerts, enrichment, first-pass correlation, drafting the incident summary at 3 a.m. That is real value. A tier-one analyst whose day is eighty per cent lookups becomes an analyst whose day is eighty per cent judgement. But judgement is a different job, with a different hiring profile, and most security leaders have not yet admitted that to their HR partner.
AI security automation does not shrink the security team. It moves the whole team one level up the stack, whether they are ready or not.
Les Ottolenghi
The new questions the board will ask
Once the models are in the loop, the board stops asking how many alerts you closed and starts asking how you know the model is right. Who reviewed its decisions this month? What did it miss? How would you know if an attacker learned to game it? These are governance questions, not tooling questions, and the CISO who arrives with a dashboard instead of an answer will not enjoy the meeting.
How to redefine the team on purpose
- Rewrite the analyst job around decisions, not tickets. Measure the quality of calls, not the volume of closures.
- Keep a human-audited sample. Ten per cent of automated closures reviewed weekly, with findings reported upward.
- Hire for curiosity and writing. The people who thrive next to a model are the ones who can explain why it was wrong.
- Budget for the transition, not just the tool. Training and role changes cost more than licences.
The security team of 2028 will be smaller in headcount only if you let it be. Treated well, it becomes the most leveraged group in the company: a handful of people supervising systems that see everything, with the authority to say stop.
