.png)
If AI Takes the First SOC Tasks, Where Will Tomorrow's Analysts Learn?
Automation can help security teams work faster. But if junior analysts lose access to the routine tasks that once trained them, organizations could weaken their own future talent pipeline.
ITSEC Asia
Security operations centres have long served as training grounds for cybersecurity professionals. New analysts learn to review alerts, investigate suspicious activity, correlate logs and recognize patterns that experienced colleagues can identify almost instinctively. The work may be repetitive, but repetition builds judgment.
AI is changing that arrangement. Automated systems can summarize alerts, correlate events and prioritize potential threats, reducing the time analysts spend on routine investigation. The productivity gains are attractive, especially for teams managing large volumes of security events. The workforce question is what happens to the people who would have learned by doing that work.
The UK government's Cyber Security Skills in the UK Labour Market 2026, published on 29 September 2026, found that 70% of cybersecurity businesses reported staff using AI in their daily work, up from 53% in the previous study. The report also found that 73% expected their need for AI skills to increase over the following 12 months. Its qualitative research raised a specific concern: automation and agentic AI could displace some entry-level SOC tasks, restricting opportunities for junior professionals to develop into experienced analysts. GOV.UK
This is a workforce risk worth planning for, rather than a reason to resist automation.
Routine work is where professional judgment begins
An alert that turns out to be harmless can still teach an analyst something. Why did the system flag it? Which logs help confirm the activity? What evidence would change the assessment? When should the issue be escalated?
These questions develop investigative habits that automated summaries cannot guarantee a learner will acquire. If junior staff only receive AI-generated conclusions, they may become proficient at processing answers without learning how to challenge them.
Organizations should therefore distinguish between automating a task and removing the learning opportunity attached to it. A SOC can automate initial alert grouping while still requiring junior analysts to examine selected cases, verify evidence and explain their reasoning to a mentor.
Design training around the work AI changes
Three practices can help preserve the talent pipeline:
- Keep supervised investigations. Assign junior analysts selected alerts to investigate independently before comparing their conclusions with AI recommendations and senior analysts' assessments.
- Train verification, not blind acceptance. Ask learners to identify missing context, test alternative explanations and document why they accepted or rejected an automated recommendation.
- Create progression milestones. Move analysts from alert triage to investigation, incident coordination and more advanced detection work as their demonstrated competence improves.
The US National Institute of Standards and Technology's NICE Framework offers a useful way to structure this development. Its updated components, released on 28 April 2026, describe cybersecurity work through roles, competency areas and task, knowledge and skill statements. Organizations can use this structure to define what junior analysts should learn and what evidence demonstrates readiness for the next level. NIST
The aim isn't to preserve every manual task indefinitely. It's to make sure that automation doesn't quietly remove the experiences people need to become capable of handling more complex incidents.
Measure what analysts can do without the assistant
Training assessments should include scenarios where learners must inspect evidence, explain uncertainty and make decisions before seeing AI-generated recommendations. Other exercises can test how well they use AI to accelerate an investigation while retaining accountability for the result.
For Indonesia's cybersecurity workforce, this approach can help organizations adopt AI while continuing to develop the people who will supervise, validate and improve security operations in the years ahead.
ITSEC Cyber & AI Academy supports cybersecurity and AI capability development through structured learning. Connecting technical foundations with realistic exercises can help learners prepare for work in which AI is part of the toolkit, but sound judgment remains their responsibility.
Build practical cybersecurity and AI skills with ITSEC Cyber & AI Academy.
References
- UK Department for Science, Innovation and Technology. Cyber security skills in the UK labour market 2026. Published 29 September 2026. Read the official report
- National Institute of Standards and Technology (NIST). NICE Releases NICE Framework Components v2.2.0. Published 28 April 2026. Read the NIST announcement
