The question AI raises most often is also the one that touches us most directly: what will it do to my job? Two visions are usually at odds. On one side, those who predict that AI will massively replace workers. On the other, those who see it as merely an additional productivity tool. Two visions that are equally reductive.
Indeed, AI will eliminate some tasks and some jobs. But when technology enables high-value work to be accomplished faster and at lower cost, demand tends to shift and widen around it. The Industrial Revolution was not limited to replacing human labor with machines. It multiplied production and gave rise to new needs in engineering, rail transport, and logistics, while giving birth to entirely new occupations. AI is beginning to produce similar effects, well beyond its immediate applications.
The question, therefore, is not so much which jobs AI will wipe out, but which activities it will lighten, which it will develop, and how organizations should adapt to this new reality.
This challenge is particularly important in cybersecurity, where AI is often presented as a solution to automate certain tasks and relieve already overburdened teams. Yet operational security is not limited to a set of tasks that could be carried out more efficiently. It sits in a constant clash with adversaries who continually adapt their strategies.
Each new means of action can thus illuminate new risks, multiply decisions to be made, and strengthen the need for human expertise and discernment. For security leaders, the real challenge is therefore not so much determining how many tasks AI can automate, but rethinking the organization of the security function around the work that grows as automation advances.
Distinguishing tasks automatable by AI… from those it amplifies
Some tasks can be automated with AI, which allows reducing human intervention, or even removing it entirely. This is notably the case for data entry, the production of recurring reports, simple analyses, or certain administrative duties. When the workload remains constant, efficiency gains on these tasks are substantial.
Conversely, some tasks become heavier with the advent of AI.
This is what Geoffrey Hinton describes through the concept of “AI elasticity”: far from consistently reducing the need for human activity, artificial intelligence can actually increase the volume of work around an automated task.
Radiology is a good illustration, as explained by Cancerworld, a specialized industry publication. Initially, one might have thought that AI would make the analysis of medical images so effective that it would reduce the number of radiologists needed.
But the opposite happened: by making examinations faster and cheaper, AI contributed to increasing their number. This rise came with more results to interpret, additional tests, quality controls, and exchanges with physicians and patients. The work changed, but it did not disappear.
Human supervision, compliance with standards, and professional accountability remain indispensable for the safe use of AI. It thus helps reduce delays and boost productivity while strengthening the role of clinical judgment and governance.
This distinction applies across all corporate functions. In commercial roles, AI can ease the monitoring of indicators, research, and administrative tasks, while enhancing the value of personalized interactions with customers. In human resources, it can automate the presentation of benefits and the production of reports, while increasing the need to support employees through transformations of their work environment. It is therefore essential to think in terms of tasks rather than roles.
In cybersecurity, work isn’t just becoming more “elastic”: it is scaling up
In cybersecurity, the volume of work is effectively unlimited in the current context. As companies gain visibility into ever-growing data volumes, they detect more signals demanding analysis. This multiplication of alerts leads to more investigations, more decisions to make, more corrective actions, and more coordination with business teams. Thus, even though AI can analyze each alert more quickly, it can paradoxically increase the overall volume of high-value work.
Unlike medicine, where disease does not adapt to treatments thanks to AI, cybersecurity faces adversaries who exploit this technology to automate their attacks, tailor their social-engineering techniques, and adjust their tactics based on the defenses encountered. AI thus accelerates attacks and makes them more sophisticated, while strengthening defense capabilities. It therefore contributes to multiplying both the relevant signals and the noisy ones, complicating the work of security teams.
That is why, faced with adversaries who are constantly evolving, cybersecurity needs continue to grow. If AI allows automating the handling of the most common alerts, it simultaneously increases the need for in-depth investigations, threat hunting, engineering, risk assessment, and coordination with the business units. Mistakes can have serious consequences, just as threats that go undetected. And decision-making responsibility cannot be entrusted to an AI model.
The objective is therefore not to replace analysts, but to enable them to focus on missions where their judgment matters most.
Transforming the SOC into an engineering organization
This evolution also requires a profound rethink of SecOps organizations, in the image of the transformation IT experienced with the emergence of DevOps. By replacing traditional processes, often slow and rigid, with shorter development cycles, agile teams, and a culture of continuous improvement, DevOps has profoundly changed practices. SecOps teams today must undertake a comparable transformation.
AI assistants will progressively take on a growing share of data correlation, alert enrichment, and first-level analysis tasks. The role of analysts will thus no longer be limited to processing alerts, whether level 1, 2, or 3. They will evolve into SecOps engineers, responsible for conducting investigations, orchestrating security operations, testing, supervising, and continuously improving the systems.
This transformation will also reshape career paths. Rather than spending years training by handling repetitive alerts, future experts will develop their skills through on-the-job learning, mentoring, and joining teams that combine human expertise with artificial intelligence.
A change made all the more urgent as exchanges between attackers and defenders accelerate, driven by ever more autonomous systems. If humans continue to define objectives, constraints, and control mechanisms, attacks and responses can now unfold directly from machine to machine, at a speed that outpaces human intervention. This does not mean humans lose their place, but that their responsibility moves upstream. It is now up to them to design resilient architectures, verify AI-produced results, set guardrails, and determine the actions that systems are allowed to undertake.
Leaders should therefore start by distinguishing three categories of activities: those that AI enables to automate, those whose volume it increases, and those whose complexity and volume it amplifies, notably in cybersecurity. The challenge is to automate the first, strengthen the resources devoted to the second, and make the third a genuine strategic priority.
This evolution also requires rethinking jobs, training pathways, and responsibilities, in an environment where AI consistently yields more results and decisions, with increasingly rapid consequences.
The future of work will not be reduced to a dichotomy between humans and machines. It will depend on organizations’ ability to automate what can be automated, while preserving the resources and skills needed for value-creating activities. In cybersecurity, this transformation is already underway.
Organizations that will make the most of it will not be those that use AI to shrink SOC headcount, but those who leverage it to strengthen the efficiency, expertise, and accountability of their security teams.
*Sam Curry, Senior Vice President and CISO of Zscaler
