Rapid7 highlights Gartner research on AI-enabled SOC roles

Rapid7 is offering complimentary access to a Gartner report, The Roles Required for the AI-Enabled Security Operations Center, which examines how SOC roles and capabilities are expected to change as AI becomes embedded in security operations.

Gartner expects human analysts to move from alert triage to end-to-end case ownership, and recommends running the SOC on cases and decisions rather than alert metrics. The report also predicts that by 2028 security operations teams will have 50% more engineers than analysts, with detection engineering role descriptions widened to cover prompt design, workflow testing and AI output validation.

Rapid7 said its own agentic workflows inside its MDR SOC have saved more than 200 analyst hours a week and reached 99.93% benign-disposition accuracy. The vendor argues exposure management should become a continuous SOC function, connecting discovery, validation, prioritisation and remediation with detection and response.