How long can a security team afford to hunt down threats before an attacker migrates to another group? The median time from the initial access event to a hand-off to another threat group decreased from more than eight hours in 2022 to just 22 seconds in 2025. With such a short fuse, the frequency of disjointed, slow investigations will continue unabated.
By 2028, security investigation powered by AI is going to change the way Security Operations Centers discover, assess and act on threats. Here’s what’s driving the end of alert fatigue, how AI will change the SOC and why humans will still matter.
The Breaking Point as Traditional Alert Management Starts Failing
A modern Security Operations Center has no shortage of data. The challenge lies in understanding what’s happening before a threat can penetrate deeper into the network. Cloud apps, remote endpoints, identity providers, and on-premises assets are creating security signals in an even more complex environment. According to Microsoft, it logs more than 165 trillion security signals a day throughout its security infrastructure across the world. While this demonstrates the amount of security telemetry created today, it doesn’t equate to alerts seen by the analyst in a SOC.
The problem gets bigger when security tools work in isolation. Different tools, such as a SIEM solution monitoring for abnormal login behavior or other endpoint and network technologies, may observe a different piece of the same event. Analysts then need to reassemble the evidence, often while working on multiple investigations. This results in three key problems.
- Alert Fatigue When analysts receive a never-ending flow of alerts and cannot distinguish between real threats and standard activity.
- Contents High Turnover Repetitive triaging, long shifts and relentless pressure take their toll on security personnel.
- Missed lateral movements These are when disconnected tools prevent analysts from associating separate events, which are part of the same attacker movement across systems.
The result is a SOC that spends more time processing alerts than understanding threats. That is a serious operational weakness.
Also Read: Inside the AI Security Operations Center: How Teams Are Automating Alert Investigation
The 2028 AI-Enabled SOC Will Shift from Analysts to Engineers
The role of security staff will also shift the most in the AI-enabled SOC. A lot of analysts begin their day in a concentration of alerts, scanning logs, confirming anomalies, and assessing which need followed up on. However, before long, AI agents will proactively learn by correlating indicators, picking up context, creating a risk hierarchy of potential threats, and doing this during off hours so security analysts can focus on research and discovery.
But this change will also alter what organizations expect from their security staff. Analysts will have to learn to comprehend the evolution of an attack, the reasons behind failure of detection rules and the weak points in the entire environment. Their workload will gravitate in three areas.
- Detection engineering will use the process of creating and refining rules that pick up suspicious activity before it causes harm.
- Threat hunting will be geared towards finding hidden threats that automatic notifications might miss.
- The management of exposure enables teams to identify weak systems, misconfigurations and security weaknesses that adversaries could use to attack.
But it doesn’t mean analysts will go away. Their job will shift. The SOC will put less emphasis on humans sifting through individual alerts, and more on experts who can enhance detection, dispute reports generated by AI and bolster organizational security.
How AI-Powered Investigations Actually Work
This integration of AI into security investigation is particularly valuable when it can piece together details that many security tools simply scatter around. An alert may point toward abnormal account activity, but it doesn’t tell us if someone has stolen the identity of a user or if a user is indeed being actively interacting with critical systems. Or walking within the network.
The process generally follows four steps.
-
Data Ingestion and Normalization
The system gathers logs, alerts, and telemetry from various cloud environments, endpoints, networks, and identity sources. It transforms each data type into a uniform format for the AI to analyze.
-
AI Contextualization
It links relevant events, searches affected resources, and provides threat intelligence. Analysts can also run natural language queries which allows them to ask questions in plain English rather than having to write out complex queries.
-
Automated Investigation and Triage
The AI analyzes the evidence, assesses the risk and provides the risks, confidence levels, MITRE ATT&CK mapping and recommend priorities. For example, the Amazon Guard Duty automated investigation agent does just this and presents a risk, confidence levels, MITRE ATT&CK mappings and prioritized recommendations. AWS claims it can cut investigation time from hours to minutes.
-
Human Verification and Response
Analysts interrogate the evidence, question ambiguous results, and authorize delicate steps. Playbooks can be modified when additional information arises as part of an investigation, removing the need to redo manual effort.
This workflow provides analysts with a more solid foundation from which to begin their investigation. But speed of investigation only makes a difference when the evidence is valid and the response is suitable.
Human Expertise Will Remain Central to the AI-Enabled SOC
The rise of AI in security operations raises an obvious concern. If agents can investigate alerts, connect evidence and recommend responses, what happens to the people doing that work today? While an AI can analyze data and find patterns, security decisions are made based on the business context, how much risk the organization is willing to accept, and the implications of what a security event might mean.
Microsoft’s Security Analyst Agent offers an example of this changing relationship. It drills down on Microsoft Defender and Microsoft Sentinel telemetry by following a variety of workflows, surface inherently risky behaviors, and provides prioritized findings with corresponding evidence. This provides analysts a more concrete starting point for examining an incident than requiring analysts to start from disparate alerts.
This transition might provide a new function for security experts as ‘cyber curators’ who will oversee AI representatives, verified results, determine scope of work and its turning points to a human being. They will also challenge half-baked evidence and ensure autonomous systems don’t make choices they shouldn’t.
The distinction matters. AI can speed up the investigation, but the accountability can’t be shifted to an agent. The best SOCs will leverage human-guided reasoning alongside the speed of a machine, leveraging each where it’s most effective.
Preparing Your Security Team for 2028
The pivot begins by expanding your people and your infrastructure. Rather than employing automation to cut the head count of Tier 1 analysts, train up these people in detection engineering, threat hunting, and AI management.
In addition, ensure your new operating model takes a single common data platform so AI agents can make sense of your current security solutions. An AI-first operating model should also outline when AI agents should be autonomous and when they should seek human approval.
According to IBM, the average breach-cost savings from widespread use of AI and security automation is $1.93 million for those with access to those tools, compared to those without access.
The Future of Security Operations Will Be Automated but Human-Led
By 2028, the ability of a SOC to respond will be based less on their speed of alert validation and more on their ability to understand and investigate the threat. Security investigations driven by AI can give security teams the speed and the context that manual methods miss. Yet simply purchasing these AI tools doesn’t deliver this advantage. Organizations will have to redesign workflows, acquire new skills and implement clear ownership of automated decisions. The future is less about ‘responding to every alert’ and more about designing a defense that can predict, investigate and act more precisely.
