The Future Of Human-Machine Teaming: Why AI Won't Replace Security Operators
Lydia Zhang, President and Co-founder of Ridge Security.
gettyEvery time a new AI capability lands in security operations, someone asks how many analysts it lets us cut. It’s become almost reflexive. But it might be the wrong question, and an investigation into Meta handed us a pretty good real-world example of why.
According to an August 2026 Reuters investigation, Meta had explored an “AI native” restructuring effort called Project OT, cutting some teams by as much as 60% and having a smaller group of employees supervise AI agents doing most of the routine work. Meta completed one round of layoffs in May (about 8,000 people), then quietly shelved the bigger second wave. Internally, code changes were up 220% year over year, but the share that turned into actual new or better features for users rose only 36%. Major technical and security incidents rose 40%. This means more activity, barely more progress and more things breaking.
That’s not proof that AI agents don’t work. It suggests a job is rarely just a stack of tasks you hand off one by one, and security is a clear example of that.
Watching an alert queue and flagging what’s malicious is only part of a security operator’s job. A good analyst is constantly building context: What does this system do? Who depends on it? If it’s a real attack, what happens to the business if we shut it down? AI can help pull that context together fast. It doesn’t inherently know why any of it matters.
The fear that AI replaces analysts also misreads what’s broken in most SOCs. It was never that there are too many people, but that there’s too much work. A typical team faces roughly 4,330 alerts a day, and only around 37% ever get a proper look. Nearly 90% of teams report meaningful skills gaps, and most tie a recent incident directly to one.
Labor data backs this up. A June 2026 Ramp and Revelio Labs study tracked AI spending across more than 21,000 U.S. companies and found the heaviest adopters grew total headcount by around 10% over the following two years, with entry-level hiring up nearly 12%. The companies spending the most on AI were often hiring faster, not slower. AI’s job isn’t to make the people already doing this work redundant, but to help them cover more ground.
A 2025 Cloud Security Alliance benchmark of AI-assisted SOC analysts found investigation accuracy up 22% to 29% and completion time down 45% to 61%. More telling was the fatigue data: Analysts working alone saw the completeness of their work drop 29% as a shift wore on, versus 16% for those working with AI.
But there’s a ceiling, and the research is starting to show where it sits. A Harvard Business School study on consultants using AI found speed and quality both rose sharply on familiar work, but those using AI were 19% less likely to produce correct solutions. Researchers call this the “jagged frontier,” where AI’s competence simply stops, often without warning.
Security has plenty of those edges: a novel attack chain that doesn’t match anything the model has seen, a judgment call about which of 10 exposures actually threatens the business this quarter, a conversation with the board about acceptable risk. AI can lay out the options. It can’t own what happens after.
It’s also worth saying plainly: AI can be extremely convincing when it’s wrong. Treating its output as correct just because it arrived fast is exactly the kind of mistake security teams can’t afford to make.
None of this points to replacing analysts. It points to routing work more deliberately. Let AI own the repeatable investigation, the triage and the first-pass reporting. Save human attention for calls that carry real consequences, and build trust through visibility into how the tool reached an answer, not a dashboard that just looks fast.
There’s a hiring implication too: The most valuable hire in 2027 probably isn’t another Tier 1 analyst. It’s someone who knows how to get the most out of AI without blindly trusting it.
The best security teams will keep dividing work along the lines of what each side is good at. AI takes scale, repetition and speed. People take ambiguity, context and accountability. That line shouldn’t be fixed. As the tools improve, more work can shift toward the machine, and when something unfamiliar or high-stakes shows up, it shifts back to a person.
I believe the teams that get this right will be the ones where every person is spending their time on the part of the job that actually needs a human. That’s not a smaller security team. It’s a more capable one.
Forbes Technology Council is an invitation-only community for world-class CIOs, CTOs and technology executives. Do I qualify?
