Skip to content
Deepak Gupta markTech Graveyard

Tech Graveyard/workflow

Manual SOC Tier-1 Triage (1998 to Dying)

Tier-1 SOC analysts face thousands of alerts a day and cannot get to most of them. AI agents now triage alerts end to end, and Tier-1 headcount is the first line item to shrink.

Born 1998 · Still dying, projected end 2028 · Status: dying

By Deepak Gupta · Published · Last updated

Paired prediction: what replaces it in Future Tech

Certificate of Death

Name of decedent

Manual SOC Tier-1 Triage

Born
1998
Died
Not yet
Age
28+

Cause of death

Generative AI is making alert triage cheaper and faster than human Tier-1 review at scale

Survived by

Autonomous SOC platforms, AI-augmented SOAR, Tier-2 incident responders

Invented by

No single inventor; enterprise and managed security operations centers of the late 1990s

Status: DyingProjected final breath: 2028

Filed by D. Gupta · guptadeepak.com

The hook

Vectra's 2023 survey of 2,000 SOC analysts found teams receive an average of 4,484 alerts a day and cannot deal with 67% of them. AI agents now triage alerts end to end. The economics are not close.

Thesis. The Tier-1 SOC analyst job is not being augmented by AI. It is being eliminated by AI. Tier-2 and above are safer, for now.

The story

The origin

SOC frameworks formalized in the late 1990s. Tier-1 analyst role: triage alerts, decide escalate or close. The model assumed a human in the loop because no other option existed.

The volume problem

Vectra's 2023 survey put the average at 4,484 alerts a day. Analysts said 83% of them were false positives. The job became impossible at scale; the response was to staff it harder.

The burnout era

2015 to 2022. Burnout and high turnover become fixtures of Tier-1 SOC work. The job is grinding, undervalued, and underpaid for the cognitive load it requires. Much of the cybersecurity skills shortage shows up as a Tier-1 SOC shortage.

The AI arrival

Prophet Security, Dropzone AI, Torq. Generative AI agents that triage alerts end to end: enrich, investigate, decide, document. Dropzone AI raised its seed round in August 2023. Prophet Security raised a $30M Series A in July 2025.

The headcount flip

My expectation: Tier-1 headcount shrinks sharply within two years of a serious AI deployment. The team shape changes: fewer Tier-1, more Tier-2 and threat hunters, a new 'AI ops' function that did not exist in 2022.

Key data points

  • Average alerts per SOC per day: 4,484 (Vectra, 2023)
  • Share of daily alerts teams cannot deal with: 67% (Vectra, 2023)
  • Analyst-reported false positive share: 83% (Vectra, 2023)
  • Dropzone AI founding: 2023
  • Prophet Security Series A: $30M, July 2025

Contrarian angle

'AI augments analysts, does not replace them' was true until 2024. It stopped being true the moment Tier-1 ROI math worked. The cybersecurity industry has not admitted this yet.

The flip side

What replaces it

The paired prediction in Future Tech.

Read the prediction

◆ Technology Rewired

See the full evolution in Technology Rewired:

FAQ

Will Tier-2 and Tier-3 analyst roles also disappear?

Compress, not disappear. Tier-2 incident response and Tier-3 threat hunting require investigative judgment that current AI agents do not replicate reliably. Expect 20 to 30% productivity gains, not 80% headcount cuts, at those tiers.

What happens to the cybersecurity skills shortage if AI handles Tier-1?

It shifts. The 'shortage' was always a Tier-1 burnout pipeline problem. The remaining shortages (cloud security architects, AppSec engineers, GRC specialists) are not addressable by AI agents at the current state of capability.

Is 'autonomous SOC' the same as 'AI-augmented SOC'?

No. AI-augmented means a human reviews each AI suggestion. Autonomous means the AI closes alerts independently with sampled human audit. The trust threshold is different by an order of magnitude.

More from guptadeepak.com

Further reading

Related obituaries

More from the workflow graveyard.