On 3 November BleepingComputer carried a piece headlined Gartner Predicts SOCs Will Have 50% More Engineers Than Analysts by 2028. It is worth knowing what it is. It is a sponsored article, written by Prophet Security, a vendor of AI SOC agents, to promote a 2026 Gartner report by Pete Shoard, The Roles Required for the AI-Enabled Security Operations Center (SOC). Prophet offers the report as a free download, and Rapid7 and Strike48 offer the same report. That is how analyst research usually reaches the market, and there is nothing wrong with it, but it explains why a prediction about 2028 is being read as news.

I read it with a strong sense of having been here before. Almost everything in it describes the security operations centre we have run at UK Cyber Defence since 2022, not as a pilot but as the normal shape of the business. So this is not an argument that Gartner is wrong. On most points it is right. It is an argument that it is late, and an account of what the change actually involves, from a team that has already made it.

What the report says

Gartner starts from alert handling. AI SOC agents, it finds, already cut alert-handling work significantly for common detection use cases, and it calls this the end of alert processing as the SOC's primary function. From there it works through the people.

Analysts, it says, "must transition from alert triage roles to end-to-end case ownership and effective response option communication". The agent investigates and the analyst owns what happens next. Detection engineering widens into a broader SOC engineering discipline, with prompt design, workflow testing, AI output validation, and software practices such as versioning and rollback. On measurement it is blunt: "Stop recording alert metrics and run the SOC on cases and decisions." Exposure management is "the emerging SOC capability to invest in before anything else", and by 2030 it expects SOCs to be largely offensively driven, testing their own business the way an attacker would.

It also says, reassuringly, that "the SOC will not shrink by 2030". The people who worked the alert queue get redirected rather than removed. The headline number follows from all of that: by 2028, security operations teams will have 50 per cent more engineers than analysts.

Why it arrives late

Gartner's job is to tell the mainstream what to do next, and its predictions follow adoption rather than lead it. Its own recent record shows the lag. In December 2024 it published Predict 2025: There Will Never Be an Autonomous SOC, urging security leaders to aim AI at augmenting analysts rather than replacing them. In June 2025 its Hype Cycle for Security Operations placed AI SOC agents at the Innovation Trigger, the very start of the curve, with adoption that vendors quoting it put at 1 to 5 per cent of the target market. Little more than a year later the same firm describes the end of alert processing as the SOC's main job.

The technology did not appear in that time. It became common enough for the mainstream to notice. Emily, the AI analyst at the heart of EmilyAI, has worked in our SOC since 4 April 2018, when we were still trading as Hedgehog Security. By the time she had been in production for four years, the change Gartner now forecasts for 2028 was already under way in our shift rota.

That does not make the analysis worthless. It makes it a lagging indicator, and boards should read it as one. By the time a prediction like this is published, the useful question for a buyer is no longer whether the change will happen. It is whether their provider has already made it.

What happened in our SOC

Before the change, our SOC kept two analysts on every shift, three shifts a day. The work was what SOC work was everywhere: read the alerts, triage them, decide, escalate. Each year Emily took on more of it, and by 2022 she was absorbing so much of the day-to-day analyst function that the real question was what the analysts should do instead.

We did not cut the team. We kept our analysts and moved them into engineering roles, running Wazuh and Graylog, two of the platforms our SOC runs on, and monitoring Emily's work. We retrained them ourselves, in-house, on our own platform. Gartner says the SOC will not shrink by 2030. We reached the same conclusion in 2022.

Today Emily takes 99.4 per cent of signals through analysis, into events and on to escalation as tickets. Our figures for August to October 2026 show what that means in practice. Across 21 client organisations and 47,619 monitored endpoints, EmilyAI analysed about 60 million log events a day, roughly 5.4 billion in the quarter. At one event a second, without a break, one person would need about 171 years to read a single quarter's events.

From those billions came 63 security investigations and threat advisories, about one for every 86 million events, and Emily raised 56 of them first. All four priority 1 investigations were picked up within four minutes, and all 11 priority 2 investigations within the hour, nine of them within 15 minutes. Twenty-five of the 63 began outside office hours.

So what is our ratio of engineers to analysts? If Emily is the analyst, every person in our SOC is an engineer. Gartner's 50 per cent more engineers than analysts is, for us, a cautious description of 2022.

Case ownership is how Emily was built

Gartner's model of the agent investigating and the human owning the case is not a future state for us. It is the design. Emily raises, measures, explains and recommends, but she never contains a machine or locks an account herself. A human engineer decides, and calls the client when the decision needs their knowledge of their own business.

The exception is the clear-cut attack, where waiting for a person would only help the attacker. There, EmilyAI's automated defences act on their own. In the quarter they updated firewall rules 95 times and dynamic blocklists 5,771 times, and sent 1,390 abuse reports to the ISPs and hosting providers behind attacking machines. In September one client came under an AI-generated attack running at 271 attempts a second for six hours. EmilyAI made 11 automated responses, each updating the firewall, and the attack was defended. An attack written by a machine moves at machine speed, so the defence has to as well, with people watching over it.

Most days look quieter. In October a rule linked to Blackbit ransomware fired 20 times on one workstation at a healthcare provider just after 7am. Within about an hour the SOC had traced it to a single Defender policy update pushed by the client's own IT team, the client confirmed it, and the ticket was closed before the working day began. That is what case ownership means to a client: an answer with the evidence, not an alert.

Trust, but check

The report insists that AI-assembled case files need meaningful human validation before a team can rely on them, and Prophet suggests that analysts work a sample of cases blind before seeing the agent's answer. We agree, and it is exactly what we do.

Each day we select five events at random. A senior engineer or I work them through blind, from the raw data, and then compare our conclusion with the one Emily put forward. It is deliberately simple. A validation process that needs a project to run will not run every day, and the value is in its never stopping.

Engineering also means fixing the detections themselves. When a rule built to spot the Tor anonymity browser fired across a private bank's laptops one Sunday morning, the SOC proved by late morning that it was matching two Microsoft programs whose names happen to contain "tor", told the bank, and rewrote the rule so it would not fire again. Gartner calls this operational feedback management. We call it the job.

Alert counts never mattered

Gartner tells SOC leaders to stop recording alert metrics. I would go further: they never mattered. Alert counts were always a poor indicator, and too often they were used by weaker SOCs to show activity rather than value. A thousand alerts tells you how noisy an estate is, not how safe it is.

We report what our clients care about. The attacks that were defended. The issues we identified and saw resolved, such as the 310 critical and high vulnerabilities proved fixed by a follow-up scan between August and October. And, more deeply, who is actually attacking you. Sometimes that is a threat actor group. Sometimes it is a penetration tester.

When a UK pension fund commissioned a two-week test in October, the SOC picked up the testers at every stage, from an unfamiliar machine scanning the network to an attempt to copy every password hash from a domain controller. Each alarm was checked with the client by phone, and the testers were left to finish undisturbed. Around three in four of the quarter's alarms turned out to have a legitimate cause, and each client got that answer with the evidence. A penetration test tells you whether an attacker could get in. A SOC tells you whether you would know.

Offensive needs a wider definition

I agree that exposure management is the capability to invest in first, and that by 2030 SOCs will be largely offensively driven. But "offensive" needs a wider definition than the one most people will read into it.

Everyone who tests your defences belongs in it. Threat actor groups, certainly. Chaotic actors too: the opportunists and the automated scanning that never stops, which in four weeks this autumn hit one client's internet-facing honeypot 10.8 million times from 37,124 addresses, more than four attempts every second. Penetration testers. Auditors and regulators, who test your controls with a different motive and leave a report rather than a ransom note. And insiders: the rare one with malicious intent, and the far more common one simply having a bad day and clicking the wrong thing.

A SOC that only looks for the dramatic adversary will miss the ordinary one, and the ordinary one is most of what happens. Seeing all of them, and knowing which is which, is what lets a client sleep.

Rebuilding the way in

The hardest problem in Gartner's report is the entry route. If agents do the triage, junior analysts lose the repetitions that built their judgement. That is a real problem, and one I care about, because this industry only has a future if we keep training the people who will run it.

I am redesigning our entry scheme around it. A new joiner now works through Security Blue Team's BTL1 and BTL2 certifications, then the Linux Professional Institute's LPIC-1 and LPIC-2, and then in-depth internal training on our platform and on Emily. It takes one to two years, and the result is a well-rounded SOC engineer rather than a triage operator.

The old Tier 1 seat taught people what normal looks like, but it taught them slowly, through a great deal of repetition. The new route teaches the defensive craft and the platforms underneath it, so that a new engineer can judge Emily's conclusions rather than simply confirm them.

Questions for your SOC provider

For a board or a buyer, the report boils down to a few questions worth asking any SOC provider. Who reads your events overnight, a person or a machine, and who checks the machine, how, and how often? What do they report to you, alert counts or outcomes? Can they tell you who is attacking you, and whether it was your own penetration tester? And if AI has taken over their alert queue, what did their analysts become?

The answers will tell you whether your provider is still preparing for 2028, or already living in it.

The point

Gartner is right about the destination and late about the date. For us the move began in 2022: the analysts became engineers and Emily took the queue. That is what she is for, so that people spend their time on judgement, and clients start the day with an answer rather than a question.

Emily has worked quietly in the background since 2018. It is time she stepped out of the shadows and said hello.