How AI Is Changing Cybersecurity Jobs

Cybersecurity beginners often learn from the alerts that turn out to be nothing. They follow an unfamiliar login, check the activity around it and work out why the warning was harmless. After enough investigations, they begin to recognize the cases that really deserve attention.

AI can now gather those clues and write a plausible explanation before a new analyst starts digging. That saves time, but it changes how people learn. If software handles the simpler investigations, where do future experts get the practice they need for difficult ones? Evidence so far suggests new opportunities and real problems for beginners, without settling what will happen to hiring.

Why Entry Level Cybersecurity Jobs Are Changing

The numbers tell an unusual story. The U.S. Bureau of Labor Statistics expects employment for information security analysts to grow 21 percent between 2025 and 2035. That’s much faster than average. It also reports roughly 14,100 job openings per year and a median annual wage of $129,180 in May 2025. Those figures describe the occupation as a whole, including experienced professionals. They don’t promise that a first job will be easy to find.

Demand for security expertise can grow while beginners still struggle to get hired. That apparent contradiction is worth understanding.

In May 2026, ISC2 surveyed 856 cybersecurity professionals who already use AI at work. In its research on changing roles, 56 percent felt that AI had reduced the need for entry-level positions over the preceding year. Yet 53 percent believed AI was creating new kinds of beginner roles. Those numbers reflect what respondents had observed and expected. They’re not a count of jobs gained or lost.

Both views can make sense. A security team might need more expertise overall while giving fewer people the same simple tasks that used to introduce them to the profession. The question then becomes how beginners get experience before they’re expected to judge AI’s work.

What Does AI Do During a Security Investigation?

Cybersecurity teams receive warnings about unusual computer activity. A warning could mean someone is trying to break in, or it could come from an ordinary change that happens to look suspicious. Figuring out which is which takes time.

AI tools can help by gathering information from different systems and drafting an explanation. They may suggest which warning deserves attention or propose a search for more evidence. The security analyst still needs a way to check where the explanation came from.

Microsoft reported a test involving 147 experienced security professionals using Security Copilot. On the tasks it measured, participants working with the tool completed work 22 percent faster and were 7 percent more accurate overall. Microsoft published the findings during its product launch. That’s evidence from a particular vendor’s evaluation, rather than a prediction about job losses.

The tool might collect the surrounding records and suggest a way to spot the same pattern again. That can save an experienced analyst time. A beginner who sees only the finished report has less chance to learn how the evidence was weighed or how a false alarm was ruled out. Those are the judgments they’ll need when an automated explanation is wrong.

Who Checks the AI When It Sounds Certain?

A clear explanation can feel reassuring even when it’s mistaken. Security teams are discovering that checking AI output can become a substantial part of the job.

In ISC2’s 2026 survey, 65 percent of respondents said they were spending more time deciding when to trust AI recommendations. Another 63 percent reported spending more time reviewing the output. That doesn’t establish how every security team works, but it reveals a new kind of pressure. AI can produce findings faster than people can carefully verify them.

If an automated system recommends disconnecting a computer from the network, the analyst still needs to check the evidence before approving it. The same action could contain an intrusion or interrupt an essential service. A fast recommendation helps only when somebody can judge that risk.

The preliminary NIST Cyber AI Profile examines securing AI systems and using them in cyber defense. Underneath the specialized guidance lies a simple principle. Someone needs to be able to explain what a system was allowed to do, which information it relied on and how mistakes will be handled.

That kind of judgment has value, but it doesn’t appear automatically because someone was handed an AI dashboard.

How Different Cybersecurity Jobs Are Changing

A security operations center, often called a SOC, is where analysts watch for signs of attacks. It can receive a flood of warnings from company computers and accounts. Analysts investigate the unusual ones to work out whether there’s a real problem.

AI can gather the background information and produce a first explanation. That sounds ideal until the explanation skips something important. A person who learned to investigate the underlying events can notice the gap. Someone who has only learned to read AI summaries may have a harder time spotting it.

ISC2’s 2026 respondents were almost evenly divided over whether AI was reducing opportunities to learn through practical work. An assistant that hides the evidence can leave a newcomer guessing. One that lets people inspect the original records can become part of their training.

Give beginners access to the records behind a resolved alert and ask what justified closing it. If the AI’s explanation skipped a key detail, that discrepancy can become a useful exercise instead of a silent error in the report.

Can AI Write a Security Rule Without Understanding It?

Security software needs rules for spotting suspicious activity. A rule might look for a pattern of logins or a particular action on a computer. AI can help write those rules quickly, which sounds like a breakthrough when a team has hundreds of possible threats to consider.

But a rule can be perfectly written and still warn about the wrong thing. It might mistake ordinary work for an attack or depend on records that the system doesn’t collect. Detection engineers are the people who test the rules and find out whether they’re useful.

For someone entering the field, there’s a lesson here. Learning to generate a detection is easy to demonstrate. Understanding why it works requires knowing how computers behave and being willing to investigate the times it fails.

When Stopping an Attack Could Stop Everything Else

When an attack may be underway, security specialists have to decide what to do next. AI can build a timeline of the suspicious activity and suggest a response. A good timeline helps, especially when events are moving quickly.

Speed helps only if the response is justified. Shutting down a compromised system could destroy evidence investigators still need, while delaying action could let an attacker continue. The team needs clear authority for those decisions and a way to preserve evidence when circumstances allow.

This is called incident response, and experience matters because the investigator is making decisions under uncertainty. AI can speed up the search for facts. Someone still needs the judgment to decide which action is justified.

What if Every News Report Traces Back to One Claim?

People who study cyber threats often read reports about attacks and try to work out which warnings are relevant. AI can summarize those reports in seconds. The difficult part is knowing what the reports really establish.

Several articles may describe the same incident, but all of them may be repeating one original claim. An AI summary can make that agreement sound stronger than it is. Our guide to verifying public information examines how to check whether sources are genuinely independent.

Researchers also have to understand how attackers use these tools. Anthropic studied 832 accounts associated with malicious cyber activity and documented uses of AI across different stages of observed operations. Its research on AI and cyber threats offers a useful look at the activity it examined. That sample tells us what researchers observed in those accounts, not what every attacker in the world is doing.

Good threat intelligence is the ability to recognize what is known and which parts of the story remain uncertain. That skill becomes more valuable when generating a confident summary takes almost no effort.

Finding More Flaws Doesn’t Mean Fixing More Flaws

AI can help identify possible weaknesses in software. That’s useful when security teams have more code and systems to examine than people available to review them.

There is a catch. Discovering a possible flaw is the beginning of the work. Somebody must check whether it really exists and whether it could affect the system in question. A serious weakness in a publicly accessible application may need urgent attention, while a similar report about a retired test system has a different importance.

ISC2’s 2026 research discusses the growing volume of possible issues identified with AI. The emerging challenge is deciding which findings deserve attention and how to repair them safely. A longer list of warnings can overwhelm a team if it has no better way to decide what matters.

AI Creates New Things for Security Teams to Protect

There is another twist in this career story. The AI tools that help investigate attacks can become targets themselves. A chatbot connected to private documents, for example, needs rules about who can see those documents. If it can change records, somebody must control what changes it can make.

That creates opportunities for people who understand security fundamentals. Someone familiar with access permissions and the movement of data through software can help protect AI applications, even when the models themselves change.

ISC2’s 2025 workforce research identified AI and cloud security among the most commonly reported skills needs. A person who understands account permissions and where sensitive information travels can help secure AI tools without needing to build the models themselves.

A Webpage Can Try to Trick a Security Assistant

A webpage may contain exactly the facts a security assistant needs to investigate an incident. It can also contain instructions telling the assistant to abandon the investigation or send data elsewhere. The page is evidence to examine. Whoever wrote it doesn’t get to decide what the assistant does next.

This is called prompt injection. It becomes dangerous if the assistant can access sensitive information or take actions outside the chat. The OWASP GenAI Security Project publishes guidance on such risks. Our AI agent architecture article explains the technical boundaries in more detail.

Security professionals need to understand where instructions come from and which actions a system is allowed to perform. Those are familiar security questions, even when the software answering them looks entirely new.

Who Is Accountable When an AI Recommendation Goes Wrong?

An AI system can behave exactly as designed and still create a governance problem. The organization might not have decided who can approve an automated action or which data the tool is allowed to retain. Those decisions become urgent after a mistake, when people need a clear account of what happened.

ISC2’s 2026 respondents placed high importance on knowing when to trust AI outputs and when to override them. They also emphasized clear governance expectations. The finding is relevant to governance, risk and compliance (GRC) professionals, but it reaches into engineering too. An approval rule is difficult to enforce if nobody has designed the technical boundary around it.

Security leaders need the evidence behind automated decisions to remain reviewable. Engineers need to understand who has authority to approve an action. When those responsibilities are written down and reflected in the workflow, the business is better placed to investigate errors without guessing who was in charge.

The Job You Used to Learn From Is Changing

Security teams face an awkward training problem. The routine investigations they most want to automate are often the ones that taught beginners how to think. A false alarm can be valuable practice when someone has to find the original record, follow the activity and explain why it was harmless.

Someone who sees only the AI summary may be asked to recognize a mistake without having learned how the conclusion was reached. That leaves employers with a decision about where new analysts will get the experience they need, especially when a serious incident offers no time to learn the basics.

The Skills That Matter When AI Does the First Draft

People who understand how computers and networks behave can ask better questions of AI security tools. They recognize when a summary skips something important or when a proposed fix might disrupt the very service they’re supposed to protect.

In its 2025 workforce research, ISC2 found that hiring managers valued problem solving and communication alongside technical skills. For someone starting out, that means learning enough to investigate a problem and then explain the findings in language other people understand.

• Learn where evidence comes from. A security log is a record of activity on a computer or network. Understand what it captures and what it might miss.
• Understand how systems work. Learn the basics of networks and how accounts are protected so you can recognize unusual behavior.
• Practice checking AI output. Compare an automated explanation with the original records. Find out when the two disagree.
• Learn a little automation. Simple scripts can help you repeat useful checks without trusting every result blindly.
• Explain what you found. A security warning only helps if people understand its importance and what to do next.

The specific AI product you learn first may be replaced. Understanding how to test a claim stays useful much longer.

If you already work in security, compare one investigation you know well with an AI-assisted version. Keep the original records, note what the tool missed and explain how you checked the result. That is more useful in an interview than a list of AI products you have tried.

A Practical 90 Day Plan for a Security Professional Adapting to AI

First 30 days. Learn where the evidence comes from

Choose one area of investigation and learn its evidence sources before leaning on generated explanations. Identity logs are a useful option because they let you connect account activity to real security decisions. Use a training lab or a dataset you’re authorized to inspect.

• Follow a single event through its relevant records and write down what happened.
• Identify where the evidence is missing or ambiguous.
• Ask an AI assistant to interpret the same records. Compare its answer with your own and explain any difference.

Days 31 to 60. Automate one small task

Automate one modest task whose result you can verify. A report draft or a query suggestion may be more useful for learning than an autonomous workflow that changes live systems.

• Define the expected output using examples with known answers.
• Test the automation on those examples and record where it fails.
• Require review before accepting uncertain findings or consequential actions.

Compare the time saved with the checking the tool adds. A workflow that creates faster output but requires hours of correction may need redesign.

Days 61 to 90. Learn to secure the AI tools

Study an established security resource such as the NIST Cyber AI Profile or the OWASP GenAI Security Project. Then examine a lab application that uses a model and has access to some external tool or dataset.

Identify what information enters the model and what actions the application can perform. Trace who authorizes those actions. Look at how the system logs decisions and what a reviewer would need to investigate a mistake.

At the end of 90 days, produce a short technical report showing a tested investigation and the limits of your automation. It should demonstrate something you can explain, not merely list the tools you used.

What Security Teams Should Do for Newcomers

Managers can give junior analysts past incidents to investigate before revealing the automated summary. An experienced colleague can help them trace mistakes, learn from false alarms and understand why two plausible explanations lead to different decisions. That gives newcomers actual practice while automated systems take on more routine work.

Teams also need clear rules about who can approve a consequential action and how to reconstruct the evidence afterward. These responsibilities deserve attention as the workflow changes.

Frequently Asked Questions

Will AI replace cybersecurity jobs?

AI is changing tasks more quickly than the profession as a whole. The BLS still projects substantial U.S. demand for information security analysts, while ISC2’s workforce research finds pressure on traditional junior work. The strongest career preparation combines security fundamentals with the ability to assess AI-assisted investigations.

Which cybersecurity jobs are most affected by AI?

SOC analysis and threat intelligence contain repetitive information work that AI can accelerate. Incident response also benefits from faster evidence summaries, but actions affecting live systems need human oversight. The impact depends on how an organization uses its tools and trains staff.

Is cybersecurity still a good career in 2026?

U.S. employment projections remain favorable, with the Bureau of Labor Statistics expecting 21 percent growth for information security analysts from 2025 to 2035. Entry-level hiring can still be difficult, especially when employers expect candidates to review automated findings without extensive training. Learn the fundamentals and look for opportunities to demonstrate them through real or lab work.

What AI skills should cybersecurity professionals learn?

Start with the security fundamentals required to check a model’s answers. Learn how AI tools receive evidence and where their visibility stops. If the system can call other tools, understand its permissions and the approval process. Knowing how to detect an unsupported recommendation will remain useful when the AI product changes.

What Would You Want to Know Before Trusting the AI?

One useful question to bring into a cybersecurity job interview is simple. How does the team teach beginners to check the tools they use?

If you’re starting out, learn to examine the original evidence behind a warning. Practice on training material or in an authorized lab, and try explaining your conclusion before comparing it with an AI summary. Knowing what the tool overlooked makes a stronger demonstration of skill than listing the assistants you’ve tried.

If you already manage a team, think about where people gain that experience. The easy investigations may have been dull, but they gave beginners a chance to develop instincts that matter later. AI can make the work faster. The learning still has to happen somewhere.

If automated tools handle every easy alert, new analysts still need somewhere to make mistakes safely and learn from them. The teams that make room for that practice will be better prepared when a convincing AI explanation turns out to be wrong.