AI Makes Cybersecurity Work Easier and Getting In Harder
Security teams say AI has improved their jobs. Nearly half also expect it to raise the bar for newcomers. The gap between those two findings is a training problem employers can still solve.
hilighter editorial team•Published •9 min read
Picture a security analyst's queue on a Monday morning. An AI system has already grouped related alerts, pulled the relevant logs and suggested what to check next. For an overstretched team, that is a relief. For someone in their first year on the job, it raises a less comfortable question: if software now handles the routine investigations, where does the next analyst learn to investigate?
Our view is that this is not mainly a question about job numbers. It is about what happens to the learning that used to be built into routine work. Cybersecurity makes the problem easy to see, because the profession has long relied on repetitive alert handling as its apprenticeship. But the same pattern applies wherever AI takes over the "simple" tasks that newcomers once practiced on.
What the new survey actually found
On 30 September 2026, the security automation company Swimlane published a survey of 500 security operations professionals and leaders in the United States and the United Kingdom, conducted by Sapio Research.1 The headline results pull in two directions:
| Finding | Share of respondents |
|---|---|
| AI has increased their job satisfaction | 88% |
| AI has improved their skill development | 62% |
| AI has limited their ability to build security skills | 24% |
| Expect AI to make cybersecurity harder to enter | 47% |
| ...of whom: expect higher requirements for entry-level roles | 37% |
| ...of whom: expect fewer opportunities for junior analysts | 10% |
| Expect new roles centered on AI oversight, validation and orchestration | 41% |
The most telling detail sits inside the 24% group. Even among people who said AI had limited their own skill-building, 91% still reported higher job satisfaction. Work can become more pleasant while the path into it becomes harder. Those are different outcomes, and an employer can easily notice the first while missing the second.
Some limits matter here. The survey covered organizations with at least 500 employees that already use AI, and it was commissioned by a vendor that sells security automation. Its figures describe respondents' experiences and expectations, not a measured drop in junior hiring. They should not be applied to small businesses or to employers in general.
Why routine alerts were the training ground
Security operations centers (SOCs) have traditionally given junior analysts a steady diet of suspicious emails, unusual logins, endpoint alerts and messy evidence. Most of it is repetitive. It is also how an analyst learns to tell an ordinary anomaly from a real threat, to ask better questions and to sense when a tidy explanation is wrong.
AI-assisted tools can now triage alerts, summarize evidence, group related incidents and draft response recommendations. That can cut the time spent on obvious false positives, which is useful when the alternative is alerts nobody looks at. The risk is subtler than "fewer junior tasks". It is that organizations keep the tasks but remove the learning from them. A junior employee asked to approve an AI recommendation, without knowing which logs were checked, which explanations were ruled out or how the conclusion could fail, is supervising without understanding. That is not expertise, and it does not become expertise with time.
The distinction between AI advice and AI action sharpens this. A system that suggests a line of investigation is one thing. A system allowed to isolate a laptop, disable an account or block a business process is another. The more consequential the action, the more it matters what the human reviewer has actually learned and can verify.
A skills problem more than a headcount problem
Other research published this year points the same way: the pressure is on skills and career routes more than on the number of jobs.
- SANS Institute and GIAC (March 2026, 947 respondents worldwide). 74% of organizations said AI was changing security team size or role structures, but only 16% reported an actual headcount reduction from AI. Just 24% said they had well-defined, clearly communicated cybersecurity career paths. 60% saw skills gaps as the bigger problem, against 40% citing staffing shortages.2 Note that 72% of respondents were security leaders, which shapes how hiring and development are described.
- ISC2 (April 2026). Drawing on its Cybersecurity Workforce Study, ISC2 reported that 95% of respondents said their organization had at least one cybersecurity skills need, and 59% described the deficiency as critical or significant. It warned hiring managers against chasing an "impossible-to-find" profile that combines security fundamentals with the ability to configure and interpret AI systems, and recommended investing in existing staff.3
- PwC (June 2026, beyond cybersecurity). In an analysis of 2.4 million US entry-level job ads, PwC found that the entry-level roles most exposed to AI were seven times more likely to require skills traditionally associated with senior roles, such as leadership, creativity or face-to-face interaction.4 Job ads show what employers ask for, not who gets hired or whether AI caused the change.
None of these measures are interchangeable. A redesigned role is not a layoff, and a skills gap does not prove that suitable candidates are missing. Taken together, though, they suggest that many employers are changing the work faster than they are building routes into it. We described the same pattern across other professions in AI is changing tasks faster than job titles.
New AI roles still depend on old expertise
Automation does create work. Security teams may need people who test AI recommendations, audit automated decisions, investigate model failures, design escalation rules and explain incidents to non-technical colleagues. Swimlane's 41% captures that expectation, but it is a forecast of roles, not a count of vacancies or hires. We looked at how this kind of oversight work is emerging in AI is creating jobs to keep AI in check.
There is a catch. Those responsibilities require exactly the judgment that routine investigations used to build. Nobody can reliably evaluate a threat-detection model having learned only where to click "approve". They need enough practical exposure to spot missing context, flawed assumptions and the business cost of a mistake.
For experienced staff, less time on repetitive triage could mean more time for mentoring, testing controls and complex investigations. For newcomers, the opportunity only exists if someone designs it. Automation does not create an apprenticeship by itself.
What smaller organizations can do
A small business or a nonprofit should not try to copy a large SOC. Many rely on an external provider, a generalist IT employee or a shared team. They may benefit from automated detection while having even less capacity to check it. The Swimlane sample says nothing about how common these situations are, so its percentages should not be transferred to smaller employers.
The following suggestions are our editorial proposals, not validated research. They aim to make learning part of the workflow rather than a separate program:
- Keep the evidence. When an automated system flags or closes an incident, keep enough of the underlying data for a person to rebuild the reasoning later.
- Review a few cases every week. For example, a short weekly session on one alert the AI handled, one false positive and one case it escalated. The point is not busywork, but feedback.
- Rotate juniors through supervised reviews of both correct and incorrect AI recommendations, and use simulations or post-incident reviews to practice decisions that automation rarely exposes.
- Write down who may authorize high-impact actions (isolating a device, disabling an account) and when escalation is mandatory.
- Be honest in job descriptions. If a junior role now involves evaluating AI output, plan to teach the domain knowledge behind that evaluation. Otherwise "junior" becomes a lower salary attached to senior expectations.
In the EU there is also a legal baseline. Article 4 of the AI Act requires providers and deployers of AI systems to take measures to support the AI literacy of their staff. Since the 2026 "Digital Omnibus" amendments, the text states that this does not mean guaranteeing a specific level for each individual.5, 6 Building AI review into everyday training is one practical way to show that such measures exist.
The career ladder is a management decision
The studies above do not show that AI has already removed the first rung of cybersecurity careers. The strongest new figures are survey perceptions, not evidence of cause and effect. They do show enough tension to justify care rather than complacency.
The deciding question is what organizations do with the time AI saves. They can use it only to process more alerts with fewer people, or also to teach people how to challenge automated decisions. If juniors lose the repetitive work but gain structured exposure to evidence, judgment and responsibility, the profession could become more attractive and more capable. If they lose both the tasks and the training, today's productivity gain becomes tomorrow's shortage of experts. AI may be making security work easier. Whether it makes security careers harder is, to a large degree, being decided by employers now.
Frequently asked questions
Is AI eliminating entry-level cybersecurity jobs?
The available evidence does not show that. In the SANS and GIAC survey, 74% of organizations said AI was changing team size or role structures, but only 16% reported headcount reductions. What surveys do show is concern about higher entry requirements and fewer chances for juniors to gain foundational experience.
Why does automating alert triage affect skill development?
Routine alerts are where analysts learn to recognize normal and abnormal patterns. If AI handles them and juniors only approve its conclusions, they may take on difficult decisions without the experience needed to judge them.
How can a small team keep juniors learning when AI handles routine work?
Keep the evidence behind automated decisions, review a few AI-handled cases with juniors each week, use simulations and post-incident reviews, and define clearly who can authorize high-impact actions.
How hilighter can help
Keeping a career ladder intact starts with knowing which skills each role needs and where people stand. hilighter helps you map skills by role, category and proficiency level, involve managers in assessing them, compare people’s skills with what a role requires and build personalized development paths for those taking on new responsibilities, such as reviewing AI output. Its AI Job Impact analysis gives an indicative view of how AI may change your roles. A free plan is available, and plans are priced by the number of job roles, with unlimited employees.
Sources
- Swimlane, Swimlane Research: How AI is Reshaping the SOC Career Ladder, 30 September 2026. Survey of 500 respondents conducted by Sapio Research for Swimlane, a security automation vendor.
- SANS Institute, SANS Research: The Cybersecurity Talent Shortage Narrative Is Wrong, March 2026; GIAC, 2026 Cybersecurity Workforce Research Report, 11 March 2026.
- ISC2, ISC2 Cybersecurity Workforce Study Deep Dive: Aligning Skills, People and Hiring in Cybersecurity, 17 April 2026.
- PwC, AI reshapes global labour market into two distinct paths, rewarding human skills: PwC 2026 Global AI Jobs Barometer, press release, 15 June 2026.
- AI Act Service Desk, Article 4: AI literacy, consolidated text; Regulation (EU) 2024/1689 (Artificial Intelligence Act), Article 4.
- Regulation (EU) 2026/1744 amending Regulation (EU) 2024/1689 ("Digital Omnibus on AI"), Official Journal of the European Union, 24 July 2026.
Sources and regulatory references last reviewed: 19 October 2026.