100×worker · job analysis

Will AI Replace Cybersecurity Analysts?

By Hendrik De Winne Last updated: August 6, 2026 Lees dit in het Nederlands

AI will not eliminate the cybersecurity analyst role, but it is rewriting the task list. Microsoft Research found generative AI applies to about 22% of work activities in information security roles, mostly log triage, ticket drafting and report generation. Judgment-heavy work such as incident response, forensic investigation of novel attacks and crisis communication stays with people.

Illustration: how AI changes the work of a cybersecurity analyst

A cybersecurity analyst, also called an ICT security administrator, IT security specialist or security officer, plans and runs the measures that protect systems and data from unauthorized access, attacks, theft and damage. The job has never been static, but generative AI is changing which parts of it need a human at all.

Microsoft Research analyzed 200,000 real Copilot conversations and scored how applicable generative AI is to specific occupations. For information security analysts, the closest match to this role, the score comes out at 22.2%. That places security work in the middle of the pack: far below translation work (49%), well above nursing (12%). Anthropic's Economic Index, which classifies millions of Claude conversations against O*NET tasks, adds a useful distinction here: AI use in a given occupation splits between automation-like use (AI does the task) and augmentation-like use (AI helps a person do the task faster).

Adoption is already broad. Eurostat reports that 32.7% of the EU population aged 16 to 74 used generative AI in the three months before being surveyed in 2025. For a security team, the practical question is not whether AI shows up in the workflow. It already has. The question is which tasks it should own outright, which ones it should draft for you, and which ones need a human making the final call.

A cybersecurity analyst protects IT systems and data from unauthorized access, attacks, theft and damage.

The task split: what AI takes over and what stays yours

Not every task in a cybersecurity analyst's job responds to AI the same way. Some tasks disappear because a tool now does them by default. Some get automated end to end with light human oversight. Some are best delegated to AI for a first draft that a person then checks. And some require judgment, context or accountability that no current model can carry. Sorting the job this way, task by task, gives a more honest answer than asking whether the whole role will survive.

Task distribution for cybersecurity analyst across the four buckets, based on the ESCO skills list.

Task	Bucket	Why
Manually scanning log files for anomalous patterns	eliminate	AI-driven correlation in a SIEM finds anomalies faster and more consistently than manual log scrolling.
Maintaining separate spreadsheets for vulnerabilities and patch status	eliminate	Vulnerability management tools with AI-based prioritization fully replace the manual spreadsheet.
Manually drafting first-line tickets from raw alert data	eliminate	Agents convert raw alerts into structured, readable tickets automatically.
First triage of security alerts (SOC tier 1)	automate	AI classifies, deduplicates and escalates alerts based on recognizable patterns, and this is already production-ready.
Patch prioritization based on CVE scores and asset criticality	automate	An agent combines vulnerability data with your asset inventory and outputs a ranked list instantly.
Generating standard compliance reports, for example ISO 27001 logs	automate	An AI agent fills fixed-structure report templates directly from system data.
Drafting incident reports after an attack	delegate	AI writes the first version from logs and timeline, you verify cause, impact and liability.
Summarizing threat intelligence and threat analysis	delegate	AI gathers and condenses sources, you judge relevance and urgency for your organization.
Drafting security policy, such as access control and mobile device management	delegate	AI produces a draft based on existing policies, you check it against organizational culture.
Risk analysis for new IoT deployments or systems	delegate	AI structures possible risks, you weigh business impact and make the final call.
Crisis communication during an active incident	keep	Word choice and timing shape trust, reputation and legal exposure for the organization. (Your edge: Building trust under time pressure is not a model's job.)
Negotiating with management over budget and risk appetite	keep	This requires reading organizational politics, priorities and who has the final say. (Your edge: Reading organizational politics stays human work.)
Forensic investigation of new, undocumented attack patterns	keep	Novel anomalies without precedent need creative reasoning, not pattern matching from training data. (Your edge: Reasoning beyond known patterns stays human work.)
Assessing weaknesses in custom systems without documentation	keep	Sensing what looks wrong in an undocumented system is hard to automate. (Your edge: Sensing what's off, without a spec sheet.)

Harvest map for cybersecurity analyst: four buckets of tasks

Will AI replace cybersecurity analysts?

No, not as a whole role. Microsoft Research's applicability score for information security analysts sits at 22.2%, meaning most of the job still sits outside what current generative AI does well. What changes is the mix of tasks: repetitive triage, log review and report drafting shrink, while judgment work such as incident command, forensic reasoning on new attack types and stakeholder communication grows in relative importance. Anthropic's Economic Index frames this as a shift toward augmentation, AI helping with a task, rather than full automation, AI doing the task alone. Expect fewer entry-level tasks and more demand for analysts who can direct AI tools and make the calls AI cannot make.

Which cybersecurity analyst tasks will AI take over first?

Tasks with clear structure and repeatable patterns go first. First-line alert triage, deduplication and initial classification are already handled by AI-driven SOC tools. Patch prioritization based on CVE scores and asset criticality is a natural fit for an agent that can combine data feeds instantly. Standard compliance reporting, drafting from fixed templates against system logs, follows the same logic. Manual log scanning for anomalies and spreadsheet-based vulnerability tracking are disappearing entirely as SIEM platforms and vulnerability management tools absorb them by default. These are the tasks that used to eat hours of an analyst's week without requiring much judgment.

What can you do this month to become the AI-savvy person on your team?

Start by mapping your own task list against the eliminate, automate, delegate, keep framework, and be honest about which tasks are pure habit. Pick one recurring task, such as incident report drafting or threat intelligence summarizing, and run it through an AI tool for two weeks, keeping the human check at the end. Learn to write clear prompts for structured outputs (ticket summaries, report drafts, risk write-ups) rather than open-ended questions. Document what worked so your team has a repeatable process, not just your personal habit. That documentation is what makes you the person others ask when a new AI tool shows up.

How does AI use in cybersecurity compare to other IT roles?

Security sits in the middle of Microsoft Research's applicability ranking at 22.2%, well below translation work (49%) and above roles like nursing (12%). That places it below content-heavy IT roles, where AI drafts large volumes of similar text, and above hands-on, judgment-first roles. The reason is structural: a lot of security work (triage, reporting, prioritization) is pattern-based and text-heavy, which AI handles well, but the highest-stakes work (incident command, forensic reasoning on unprecedented attacks, negotiating risk with leadership) depends on context and accountability that current models cannot carry. ESCO's taxonomy, which maps skills across 3,039 occupations, reflects this too: security-specific skills such as vulnerability identification sit alongside compliance and organizational skills that resist full automation.

AI use in a given occupation splits between automation-like use, where AI performs the task, and augmentation-like use, where AI helps a person complete it.
Anthropic Economic Index

Become the AI person on your team

Run your own task audit

List every recurring task you do in a month, then sort each one into eliminate, automate, delegate or keep. Share the list with your manager. This turns a vague fear of AI into a concrete plan for redistributing your time.

Pilot one delegate-bucket task

Take incident report drafting or threat intel summarizing and route it through an AI tool for a few weeks. Keep your own review step at the end and track how much time it actually saves versus how much rework it creates.

Build a prompt library for your team

Save the prompts that consistently produce usable drafts for reports, tickets and policy documents. A shared library turns individual AI skill into a team asset, and it is the kind of artifact that gets you noticed as the go-to person on AI.

Want this for your actual task list?

The free scan on the homepage builds your personal task map in 30 seconds, based on your role and industry.

Run the free task scan

Tools for this work

Tool	For which tasks	The sober take
AI-enhanced SIEM platforms	Eliminate: manual log scanning. Automate: first-line alert triage.	These platforms now handle correlation and initial classification by default rather than as an add-on feature.
Vulnerability management platforms with AI prioritization	Eliminate: spreadsheet tracking. Automate: patch prioritization by CVE score and asset criticality.	Replaces the manually maintained vulnerability spreadsheet with a live, ranked list.
Threat intelligence summarization tools	Delegate: summarizing threat intelligence and threat analysis.	Good for a first pass; relevance and urgency judgment still needs a person familiar with your environment.
Compliance reporting agents	Automate: generating standard compliance reports such as ISO 27001 logs.	Works well for fixed-format reports; unusual audit requests still need manual handling.
General-purpose AI chat assistants	Delegate: drafting security policy and incident reports.	Useful for first drafts, but every output needs a human check against your specific organizational context.

Prompts to try today

Draft an incident report from raw notes

Here are my raw notes and log timestamps from a security incident: [paste notes]. Draft a structured incident report with sections for detection, timeline, impact, root cause and remediation steps. Flag any gaps where you need more information from me before the report is complete.

Summarize threat intelligence for your organization

Here are three threat intelligence articles or advisories: [paste text or links summary]. Summarize each in three sentences, then tell me which ones are most relevant to an organization running [list your key systems, e.g. Windows Server, AWS, VPN]. Rank them by urgency and explain your reasoning.

Draft a policy update for a new system

We are deploying [describe system, e.g. IoT sensors on the factory floor]. Based on our existing mobile device and access control policy [paste current policy], draft an updated policy section covering this new system. Highlight any conflicts with the existing policy that I need to resolve.

Related jobs

Frequently asked questions

Do I need to learn to code to keep working as a cybersecurity analyst?

Not necessarily. The Microsoft Research data on applicability points to text-heavy tasks (triage, reporting, summarizing) as the ones most affected by generative AI, not coding specifically. What matters more is learning to direct AI tools effectively: writing clear prompts, checking outputs against your systems, and knowing when a task needs a person instead. Scripting and automation skills help, but they are not the main lever here.

Which cybersecurity tasks are safest from AI for the next few years?

Tasks that depend on context, accountability or reasoning without precedent stay safest: crisis communication during an active incident, negotiating budget and risk tolerance with leadership, and forensic investigation of attack patterns that have never been documented before. These require judgment calls that carry legal or reputational weight, and current AI tools are not built to carry that kind of accountability.

Is the 22.2% applicability score the same as saying 22% of cybersecurity jobs will disappear?

No. The Microsoft Research score measures the share of work activities where generative AI is demonstrably applicable, based on real Copilot conversations, not the share of jobs at risk of disappearing. It is a task-level measure, not a headcount forecast. A role can have a meaningful applicability score and still require the same number of people, doing a different mix of tasks.

How does the ESCO taxonomy relate to how AI affects this job?

ESCO, the European Commission's occupation taxonomy, breaks the ICT security administrator role into specific skills such as identifying vulnerabilities, maintaining database security and managing IT security compliance. That level of detail is exactly what makes a task-by-task AI analysis possible: instead of asking whether 'cybersecurity analyst' as a whole is at risk, you can check which of those named skills map to automatable tasks and which do not.

Sources

Hendrik De Winne, author of Becoming AI-Savvy, founder of VibeLab. Helps teams redesign their work with AI.

This article was drafted with AI assistance from public data sources and editorially reviewed.