Security analyst (SOC)

University researchers generating network intrusion-detection rules with language models and putting them to ten domain experts. They report that large models achieved up to 90% syntactic validity, but the experts deemed only 37.5% of generated rules semantically correct and deployable, mainly because of insufficient specificity, heavy reliance on content matching and hallucinated logic; practitioners viewed the models as support tools for drafting and verification rather than independent generators, and small models were largely ineffective. It is a preprint with a small expert panel, in a laboratory setting.

A demo, benchmark or paper shows the task can be done. Updates what the technology can do — not what employers will do.

Microsoft researchers testing AI-assisted authoring of security detections against 92 of the company's production detections across five platforms and three query languages, generating 5,796 detections with eleven models. Generated detections matched the targeted attack technique 99.4% of the time and were syntactically valid 95.9% of the time, but matched the original exclusion logic only 8.9% of the time; the authors write that detection logic relies on unwritten environmental context, and that AI can accelerate drafting the skeleton and syntax while human engineers remain essential for environment-specific context and exclusions. It is a test against existing detections, not a deployment, and Microsoft sells security detection products.

A demo, benchmark or paper shows the task can be done. Updates what the technology can do — not what employers will do.

One agency, and only the unclassified, non-sensitive use cases it is required to publish under the Advancing American AI Act — classified work is outside the inventory by construction, so absence from this list is not absence from the agency. It is CISA's own statement about its own operations, and CISA runs a security operations centre rather than selling tooling to others, which is why this is recorded as an employer deployment rather than vendor material. Two things sit side by side and both belong on this page: network anomaly detection over critical infrastructure and automated detection of personal data inside cybersecurity data are listed under Deployment, while the use case named Security Operation Center (SOC) Network Anomaly Detection is listed under Inactive, next to confidence scoring for threat indicators. The inventory records status, not reasons: it does not say why the SOC use case stopped, whether something replaced it, how many analysts any of this touches, or what it cost. Statuses read from the 2025 annual update published 28 January 2026.

An employer has put it into production. Can move the baseline — weighted by scale and how similar the setting is.

United States, one employer. A paper by the employer's own staff says RuleForge is an AWS internal system that automatically generates detection rules identifying malicious HTTP requests that exploit specific vulnerabilities; that each generated rule passing automated validation is submitted as an individual code review to the internal security team; and that the volume processed was intentionally limited to avoid overwhelming the human reviewers. Its evaluation covers the last four months of 2025. A preprint by the employer's staff; the rules target web exploits, not an organisation's own estate, and its productivity figure is relative.

An employer has put it into production. Can move the baseline — weighted by scale and how similar the setting is.

A national rule for every network operator in China. Article 4 requires an operator that discovers or learns of an incident to assess it against the attached grading guide and, for incidents graded significant or above, report within one hour for critical information infrastructure, two hours for central government bodies and four hours for others. Article 5 requires operators to make providers of security and operations services report the incidents they detect to the operator and help it report. Article 10 provides heavier penalties for the operator and the responsible persons where late, missed, false or concealed reports cause serious harm. It puts the determination and the accountability on the operator; it does not say whether a person or a system does the grading.

Failure, rollback, regulation or cost is suppressing adoption. Can lower an assessment or widen its uncertainty.

One bureau (EOUSA) inside one department, reported under a statutory duty rather than chosen for publication. Entry DOJ-0119 in the individually-reported CSV. The inventory gives the month, not the day, so the date here is the first of that month. The claim that matters is the department describing the problem it solves as "identification and prevention of anomalous user behavior too subtle for human detection and analysis" — an employer stating in a filing that a machine covers ground its people cannot. Two things are in the same rows and belong beside it. The department classified this system High-impact, and every safeguard the high-impact classification requires is recorded as in progress: testing, impact assessment, independent review, ongoing monitoring, training, failsafe, appeal process and public consultation, with authority to operate answered No. The system holds personal data. Separately, entry GSA "Elastic Machine Learning Threat Detection (Phase 2)" describes the other side of the same boundary in a different agency, saying its models allow "isolation and ranking of cyber threats, facilitating faster and more accurate escalation to threat hunting and incident response teams" — the machine ranks and the hunting team still receives. Neither entry reports a headcount, a caseload or a measured detection rate, and the department's own evaluation of whether the claim holds is one of the items marked in progress.

An employer has put it into production. Can move the baseline — weighted by scale and how similar the setting is.

Researchers from Australia's national science agency, with co-authors from the security firm, analysing 3,090 queries that 45 analysts at eSentire — a company selling 24/7 managed detection and response — submitted to GPT-4 during live investigations from May 2023 to March 2024. They found the model used mainly to interpret low-level telemetry such as commands and to refine written communication, in short exchanges; only 4% of queries sought explicit recommendations such as "is this malicious?", which the authors read as a strong preference for keeping decision authority. It is one company's SOC, measures what analysts asked rather than how accurate the answers were, and the firm has a commercial stake.

Measured, large-scale use of a tool for real work, where the decision to use it was the worker's rather than an employer's. It is more than a capability record — the work is real, not a demo — and less than a deployment record, because no employer put it into production, required it, or built a process around it. Weighted `cautious`: `automating` means the machine can do the task AND there are adoption signs, and this is an adoption sign — but usage can be experimental, and much of the measurement comes from a party with a stake, so one record is never enough and two independent ones are. Note who is counting. Vendor telemetry sees this directly and sells the tool, so such a record names that stake in its scope; a statistics agency asking firms whether their workers use AI in tasks sees the same channel with no stake at all, and that is the better source where it exists.

An intelligence-style assessment using calibrated probability language, not a measurement — 'almost certainly' and 'highly likely' are defined terms on the NCSC's own scale, which the report publishes alongside the judgements. Its relevance to this occupation is indirect but specific: more attacks and more effective social engineering mean a larger and noisier alert queue, which is the most exposed task on this page, so the forecast and the automation point at the same place from opposite directions. The assessment also judges that the near-term uplift comes from evolution of existing techniques rather than novel ones, and that sophisticated uses stay restricted to actors with quality training data, expertise and resources — both of which cut against the most dramatic readings of it.

A named person with standing publicly predicted something, on a date, in an attributable statement. It is recorded so that who said what, and when, stays checkable — and it never moves a task's assessment, because a prediction is not an observation. Its value arrives later: the record sits on the same page as the evidence about that occupation, so anyone reading the forecast reads the record of what happened next beside it. That is the reckoning; this site publishes no verdict on whether a forecast came true.

A commissioned sector study, not a measurement of anything that happened, which is why it sits in a stage that changes nothing. Read the mechanism carefully, because it is not the one most readers will assume: the tool named is SOAR — security orchestration, automation and response — which is workflow automation, not a language model. The report is dated October 2022 and its underlying analysis is dated December 2020, so it was written before generative AI reached the public; 'AI and analytics' appears in it as a trend heading covering machine learning for alert prioritisation, not chat models. What it claims specifically is that SOAR will take over manual cyber monitoring and reporting and potentially replace core tasks such as managing cyber security systems and operations, thereby reducing the manpower required for those tasks, while job holders keep the analysis of log data and reports. It covers Singapore's infocomm workforce only, it aggregates stakeholder interviews rather than measuring employment, and the report itself says its findings were taken at a point in time and must be re-contextualised by whoever reads them later.

A named person with standing publicly predicted something, on a date, in an attributable statement. It is recorded so that who said what, and when, stays checkable — and it never moves a task's assessment, because a prediction is not an observation. Its value arrives later: the record sits on the same page as the evidence about that occupation, so anyone reading the forecast reads the record of what happened next beside it. That is the reckoning; this site publishes no verdict on whether a forecast came true.

The entry rung in this field is the alert queue, and it is the rung with the clearest automation mechanism pointed at it. That is a genuine problem for the profession and not only for you: the judgement senior analysts have was built by grinding that queue, and nobody has designed a replacement for it. Get to incident work early, and treat any team that lets you sit in on a real incident as worth more than a pay rise.

Two numbers decide your team's future and both are yours to produce: the true-positive rate of your queue, and how many detections you retired last quarter. A team that cannot answer the second will find its tooling budget spent on generating more of what it already cannot read.

Stay and strengthen

Move up the queue, not along it

The people who survive triage automation are the ones who tune what generates the alerts rather than the ones who read them faster.

Reshape the role

Be the person who knows this estate

Every tool needs a baseline for normal and no vendor can supply one for your company. That knowledge is the input nothing can buy and it is what hunting runs on.

Triage is genuinely moving, and for a reason worth understanding: it is the same task as a guard watching camera feeds, and software does not get bored. What is not moving is calling an incident, because that decision is made with authority rather than certainty and the cost of both errors is severe. The real risk to the profession is not replacement, it is that automating triage removes the rung where analysts' judgement was built.

No date. The signal is the true-positive rate of your own queue and what share of your shift goes to alerts a system could correlate without you. Both are measurable this week. The organisational signal to watch is different and more predictive: whether your employer is talking about a managed service, because outsourcing moves this work without automating any of it and it arrives much faster than any tool.

Models draft the rule's skeleton well, but experts judged only 37.5% of generated network rules deployable, and AI-written detections reproduced engineers' exclusions only 8.9% of the time. Deciding what to detect is the other half and it depends on knowing what normal looks like in your specific estate — knowledge held by people and written down almost nowhere. The caution is that cheap rule-writing makes the false-positive problem worse, because the constraint was never the writing: a team producing ten times the detections has to be ten times more disciplined about retiring them, and almost nobody staffs for that.

Protected from automation, yes — hunting is defined by the absence of a trigger, which removes the input every detection tool needs. But it is the first activity cut when the queue is loud, because it produces no ticket and no metric. That is the pattern worth internalising: a task can be entirely human and still vanish from a team's week without anyone deciding to remove it, and in this occupation that is the usual way it goes.