AI Resilience Report forInformation Security Engineers

The good news for anyone curious about cybersecurity is that AI is mostly augmenting information security engineers rather than replacing them. In a typical SOC, a Tier 1 analyst might spend 20–30 minutes investigating a single phishing alert — pivoting across email logs, endpoint data and threat intelligence tools. It's necessary work, but it's also highly repetitive and time-consuming.

Agentic AI now takes over that grunt work ^[1], so the human role shifts from operator to "manager of agents" who reviews investigations and validates conclusions. SANS notes that adoption is uneven ^[2] — 40 percent of SOCs use AI or ML tools without making them a defined part of operations, and 42 percent rely on AI/ML tools "out of the box" with no customization at all. AI is also generating new defensive work: Gartner predicts ^[3] that by 2028, half of all enterprise incident response will involve custom AI applications themselves.

Adoption is moving fast because attackers are moving faster. IBM's 2026 X-Force report ^[4] found a 44% increase in attacks that began with the exploitation of public-facing applications, largely driven by missing authentication controls and AI-enabled vulnerability discovery, forcing defenders to match speed with their own AI. A massive talent shortage also pushes adoption: ISC2 reports that AI was identified as the most pressing skills need by 41% of cybersecurity professionals ^[5], and the World Economic Forum argues ^[6] AI is becoming an "abstraction layer" that lets people express their security intent in natural language, while the system translates that intent into technical action — potentially opening the field to newcomers without traditional technical backgrounds.

The hopeful takeaway: judgment, curiosity, and ethical decision-making remain irreplaceably human, and demand for those skills is growing, not shrinking.