As AI SOC agents take on a rapidly growing share of alert triage and investigation, the role of SOC analysts – and the value that the SOC needs to provide to organizations more broadly – is shifting.
According to Gartner, that shift changes three things: what the SOC produces, who works in it, and how it measures success. In this report, you’ll learn:
-
How L1/L2 roles are evolving and what to change in training and staffing today
-
Which KPIs Gartner recommends in place of alert volume, closure rates, and MTTD
-
How detection engineering is broadening
-
What the SOC engineers of 2030 should be proficient in
-
How to shift towards proactive, exposure-driven outputs
Download your copy of the full report!
Source: Gartner, The Roles Required for the AI-Enabled Security Operations Center (SOC), Pete Shoard, 30 April 2026.
GARTNER is a trademark of Gartner, Inc. and/or its affiliates.