September 17, 2026
Artificial intelligence is beginning to transform cybersecurity from a profession dominated by human-operated tools into one increasingly characterized by autonomous systems capable of monitoring, investigating, reasoning, and acting on behalf of security professionals. The emergence of increasingly capable AI agents represents a particularly important inflection point. Unlike conventional cybersecurity automation, which generally executes predefined workflows, agentic systems can pursue objectives, adapt their behavior, interact with multiple systems, and perform multistep tasks with comparatively limited to no human intervention.
This transformation promises to address persistent cybersecurity challenges, including alert overload, staffing shortages, increasingly sophisticated attacks, and the scale of modern digital infrastructure. It also presents a less discussed consequence: significant portions of the cybersecurity workforce may become economically unnecessary. Routine security operations, alert triage, vulnerability management, basic investigation, penetration testing, compliance evidence collection, and other highly repeatable activities are increasingly susceptible to automation.
Yet the likely outcome is not simply the disappearance of cybersecurity as a profession. Instead, the profession is likely to become smaller in some areas, larger in others, and substantially different in character. Human professionals may increasingly transition from operators to supervisors, architects, investigators, strategists, and governors of autonomous security systems. At the same time, the automation of entry-level work creates a potentially serious structural problem: the traditional apprenticeship pathway through which junior analysts become experienced cybersecurity professionals may weaken or disappear entirely.
The central challenge of the agentic era may therefore not be whether artificial intelligence can perform cybersecurity work. It is whether the cybersecurity profession can redesign itself when increasingly capable machines perform much of the work through which human professionals historically acquired their expertise.
From Cybersecurity Tools to Cybersecurity Agents
For most of the modern cybersecurity era, technology has been used primarily to augment human expertise.
Security information and event management systems collect and correlate events. Endpoint detection and response platforms identify suspicious behavior. Vulnerability scanners identify weaknesses. Firewalls block network traffic. Security orchestration and automation platforms execute predefined responses.
The underlying organizational model has remained remarkably consistent: Machines observe. Humans interpret. Humans decide. Machines execute.
Artificial intelligence is beginning to challenge that model.
The emergence of increasingly capable AI agents, as evidenced by the Hugging Face incident along with other similar incidents, introduces systems that can potentially observe an environment, formulate hypotheses, determine what additional information is required, execute actions, evaluate the results, and continue working toward an objective. In the Hugging Face incident in particular, the OpenAI cybersecurity experiment saw AI agents unexpectedly coordinate, sharing information and even debating self-sacrifice for collective success. Around 1,200 agents communicated through more than 70,000 messages and files, with roughly 700 ultimately participating in an attack on Hugging Face. The agents executed code on dozens of servers, gained root access to one and accessed limited private data, demonstrating unexpected collective behavior. The distinction between an AI-enabled security tool and an autonomous security agent is therefore significant.
A conventional automated system might be programmed to isolate a computer when a particular detection occurs.
An agentic system may be asked to investigate a suspected compromise and determine what actions are necessary to contain it.
That difference represents more than an improvement in software. It represents a potential transformation in the organization of cybersecurity labor.
Recent developments illustrate how quickly the underlying technology is progressing. Anthropic, for example, has developed specialized models under the Mythos name for cybersecurity and other advanced applications, while other AI developers are pursuing increasingly capable systems for vulnerability discovery, software analysis, threat detection, and automated security operations. The emergence of these systems suggests that cybersecurity is becoming one of the early fields in which AI is moving beyond content generation toward increasingly autonomous technical work.
The implications extend well beyond cybersecurity. If software can increasingly operate software, then the organization of IT itself begins to change.
From Human-Operated Security to Autonomous Security
The cybersecurity profession has historically been labor intensive because the digital environment is extraordinarily complex.
Organizations generate enormous volumes of logs, alerts, authentication events, network connections, endpoint telemetry, vulnerability findings, cloud events, and user activity. Human analysts have traditionally been responsible for determining which of these signals matter.
This produces one of the fundamental problems of modern security operations: scale.
An organization may have millions of events but only a limited number of analysts capable of examining them. Security teams consequently prioritize alerts, establish rules, automate repetitive actions, and attempt to focus scarce human attention on the most consequential events.
Agentic AI changes this equation.
Instead of using AI merely to identify suspicious activity, an organization can increasingly envision agents capable of performing an investigation:
- Detect an anomaly.
- Gather additional telemetry.
- Examine the identity involved.
- Review historical activity.
- Determine whether similar events occurred elsewhere.
- Investigate potentially affected systems.
- Form a hypothesis about the incident.
- Recommend or execute containment.
- Monitor the consequences.
- Produce an incident report.
The significance lies in the fact that these activities previously represented the work of one or more human professionals. AI does not necessarily eliminate the underlying cybersecurity problem. Instead, it changes the amount of human labor required to address it.
That distinction is critical.
The Cybersecurity Labor Pyramid
The effect of autonomous agents is unlikely to be evenly distributed throughout the cybersecurity workforce. The greatest pressure is likely to occur at the lower and middle portions of the operational pyramid.
Entry-level security analysts frequently perform work such as alert triage, log analysis, ticket management, basic threat intelligence, vulnerability assessment, endpoint investigation, and execution of incident-response playbooks.
These activities have several characteristics that make them particularly vulnerable to AI automation:
- They are repetitive.
- They involve large quantities of structured data.
- They frequently follow recognizable patterns.
- They can be described through procedures.
- Their outcomes can often be measured.
- They require significant amounts of time but not always significant amounts of judgment.
The economics of automation therefore become compelling.
Consider a hypothetical security operations center employing twenty analysts to monitor an enterprise environment. If increasingly capable agents can perform much of the first-line monitoring, investigation, enrichment, and response, the organization may eventually need fewer analysts.
It might move from: 20 analysts + security software to 5 analysts + autonomous security agents
The five remaining professionals may supervise systems capable of handling substantially more infrastructure than the original twenty analysts could manage.
This is not science fiction. It is the logical economic consequence of increasing machine productivity. And it creates an uncomfortable question for the profession. What happens to the entry-level cybersecurity job?
The Apprenticeship Problem
For decades, cybersecurity has relied upon an implicit apprenticeship model.
A junior analyst learns by performing routine work.
That analyst gradually becomes more proficient at recognizing patterns, understanding systems, investigating incidents, communicating findings, and making decisions under pressure.
Over time, the junior analyst becomes a senior analyst, engineer, architect, incident commander, or security leader.
AI threatens to disrupt that progression. If machines perform the routine work, organizations may have less economic incentive to employ large numbers of junior professionals.
This produces a paradox –
The profession needs experienced cybersecurity professionals. But experienced professionals traditionally emerge from years of performing the routine work that AI is increasingly capable of performing. This could create what might be called the cybersecurity apprenticeship paradox: AI may eliminate many of the entry-level jobs through which future cybersecurity experts acquire the experience necessary to perform higher-level cybersecurity work.
This problem deserves substantially more attention than it currently receives.
The issue is not merely employment. It is institutional knowledge.
Cybersecurity expertise is not entirely contained in textbooks, certifications, or technical documentation. Experienced professionals develop intuition. They learn how systems fail, how organizations behave during crises, which signals are meaningful, which assumptions are dangerous, and how seemingly unrelated technical events can form a coherent attack.
If young professionals have fewer opportunities to develop that experience, the profession could eventually experience a shortage of precisely the expertise it considers most valuable.
The Evidence: A Profession in Transition
Current workforce data presents an important complication to any prediction of mass cybersecurity unemployment.
The U.S. Bureau of Labor Statistics projects employment for information security analysts to grow 28.5 percent between 2024 and 2034, adding approximately 52,100 positions. The BLS attributes this continued demand in part to the increasing frequency and sophistication of cyberattacks and the resulting need for security professionals. However, it doesn’t appear to take into consideration the impact that AI is starting to have – the cybersecurity workforce is already experiencing a substantial shift in the skills organizations require.
There is no reliable number yet for cybersecurity jobs converted to AI agents. That distinction is important. Organizations generally report AI adoption, headcount changes, or task automation—not a count of jobs that have literally been replaced by agents.
But the available evidence gives us a useful picture, and it is significant.
The 2025 ISC2 Cybersecurity Workforce Study, based on responses from 16,029 cybersecurity professionals and decision-makers worldwide, found that skills shortages are increasingly more important than simple shortages of personnel. AI was identified as the most pressing skills need by 41 percent of respondents, ahead of cloud security at 36 percent.
The study also found that 28 percent of respondents had already integrated AI tools into cybersecurity operations, with another 19 percent actively testing them and 22 percent evaluating them. In other words, nearly seven in ten respondents were somewhere along the path toward regular AI-security-tool use. Most importantly, 52% said AI would somewhat or significantly reduce the need for entry-level cybersecurity staff. 44% said their organizations were reconsidering the roles and skills they need because of AI.
That’s not the same as saying 52% of jobs have disappeared. It means the profession itself expects entry-level labor demand to decline.
The 2026 SANS/GIAC workforce research provides an even more interesting data point. Among organizations surveyed:
- 16% reported reducing cybersecurity headcount because of AI
- 19% were shifting toward AI-orchestration roles
- Organizations were simultaneously creating AI/ML security specialist, AI security engineer, AI governance, security data scientist, AI red-team and AI ethics positions.
So, we don’t yet know how many cybersecurity jobs have been replaced by AI agents, but roughly one-third of organizations have begun deploying AI security tools, more than half of cybersecurity professionals surveyed expect AI to reduce entry-level staffing needs, and 16% of organizations in a 2026 SANS study already reported reducing cybersecurity headcount because of AI.
These findings suggest that the near-term future is unlikely to be characterized simply by mass elimination. Instead, the profession is entering a period of task substitution and occupational restructuring.
From Operators to Orchestrators
The cybersecurity professional of the future may spend less time performing individual security operations and more time managing the systems that perform them.
The transition can be conceptualized as follows:
Yesterday
Human → Tool → Result
Today
Human → Multiple Tools → Human Analysis → Decision → Action
Tomorrow
Human → Objective → AI Agents → Investigation → Decision Support → Action
The human remains important, but the location of human effort moves upward.
Instead of investigating every alert, the professional establishes the parameters within which agents investigate alerts. Instead of manually executing every remediation action, the professional determines which actions an agent is authorized to take. Instead of writing every detection rule, the professional may supervise agents that continuously generate and test detection strategies. Instead of manually examining every vulnerability, the professional may direct agents to discover, prioritize, validate, and remediate weaknesses.
The cybersecurity professional increasingly becomes an orchestrator of machine intelligence. This changes the skill profile of the profession.
Technical expertise remains essential, but it increasingly must be combined with:
- AI system management
- Agent architecture
- Security automation
- AI governance
- Risk assessment
- Systems thinking
- Strategic decision-making
- Communication
- Human-machine collaboration
- Model evaluation
- Adversarial testing
ISC2’s research already reflects this transition. Its 2025 study found that 73 percent of respondents believe AI will create demand for more specialized cybersecurity skills, while 72 percent believe it will create a need for more strategic cybersecurity mindsets.
The profession is therefore not simply becoming more automated. It is becoming more strategic.
The Emergence of the Autonomous SOC
The Security Operations Center provides perhaps the clearest illustration of what is coming.
The traditional SOC is essentially a human attention-management system. It collects enormous amounts of information and attempts to direct human attention toward the events most likely to matter.
An autonomous SOC would reverse the relationship.
Instead of machines bringing events to humans, machines would investigate events themselves and bring humans only those situations requiring judgment, authorization, or escalation.
The resulting structure might resemble:
AI agents
- Continuous monitoring
- Detection
- Enrichment
- Investigation
- Threat hunting
- Vulnerability analysis
- Routine remediation
Human specialists
- Complex investigations
- Strategic decisions
- Novel attacks
- High-impact incidents
- Agent supervision
- Security architecture
- Governance
Leadership
- Risk tolerance
- Policy
- Resource allocation
- Regulatory responsibility
- Organizational strategy
Such a structure could dramatically reduce the amount of routine human labor required to operate a security program. But it could simultaneously increase the importance of the humans who remain.
The New Attack Surface: The Security Agent
Autonomous cybersecurity creates another problem that conventional automation does not fully solve. The agent itself becomes part of the attack surface.
A powerful security agent may possess access to:
- Sensitive logs
- Identity systems
- Cloud infrastructure
- Endpoint controls
- Security tools
- Credentials
- APIs
- Network controls
- Configuration systems
- Incident-response capabilities
An attacker who compromises such an agent may not merely obtain information.
The attacker may gain access to a system capable of making decisions and taking actions. This produces a new security question.
Traditional cybersecurity asks: How do we prevent attackers from compromising our systems?
Agentic cybersecurity must increasingly ask: How do we prevent attackers from manipulating the systems that make decisions about our security?
This distinction is profound.
An autonomous agent can become simultaneously a defender, a privileged user, a software system, and a potential attack vector.
The profession will therefore need to develop an entirely new body of expertise around agent security.
Automation Versus Automation
The attacker is also gaining access to AI. Cybersecurity is therefore becoming an environment in which automation increasingly confronts automation.
An attacker can use AI to accelerate reconnaissance, vulnerability discovery, code development, social engineering, and adaptation.
A defender can use AI to accelerate detection, investigation, threat hunting, remediation, and recovery.
The resulting contest may occur at a speed beyond ordinary human cognition. This changes the economics of cybersecurity.
If an attacker can generate thousands of attack attempts at machine speed, a human-only defense model becomes increasingly impractical. The defender therefore needs automation simply to remain economically viable.
This creates a paradox: The technology that reduces the need for cybersecurity labor may simultaneously create the conditions that make cybersecurity automation indispensable.
In other words, AI may reduce the number of people required to defend an organization while increasing the total amount of cybersecurity activity taking place.
The Rise of Cybersecurity Governance
As agents become more autonomous, cybersecurity professionals will increasingly have to answer questions that are fundamentally about authority rather than technology.
Should an agent be allowed to disable a user account?
Can it shut down a production server?
Can it rotate credentials?
Can it isolate a hospital device?
Can it modify a firewall?
Can it deploy a patch without human approval?
Can it determine that an employee is malicious?
Can it delete data?
These are not merely technical questions.
They are questions of organizational authority and risk.
Consequently, one of the most important emerging cybersecurity disciplines may be the governance of autonomous systems.
The cybersecurity professional becomes responsible not simply for securing the organization, but for determining what autonomous systems are permitted to do in the name of security.
That responsibility may ultimately prove more important than the ability to execute individual security tasks.
This responsibility was spelled out recently by Andrew Bailey, chair of the Financial Stability Board and governor of the Bank of England. He warned G20 finance ministers and central bank governors that frontier AI’s impact on cyber risk had become the most immediate AI-related concern for the financial system.
The FSB warned that increasingly capable models could materially alter the speed, scale and economics of cyber risk, potentially undermining confidence across the financial system.
The Human Advantage
Despite the extraordinary capabilities of AI agents, humans retain advantages that are particularly important in cybersecurity.
The most important is judgment under uncertainty.
Cybersecurity incidents rarely occur in perfectly structured environments. Attackers behave unpredictably. Business priorities conflict with security priorities. Evidence is incomplete. Systems contain legacy dependencies. Regulatory requirements vary. Executives may make decisions that contradict technical recommendations.
A machine may determine that a server should be isolated.
A human must sometimes determine whether isolating that server could disrupt a hospital, shut down a manufacturing line, or interrupt a critical business process.
The future therefore isn’t necessarily human versus machine.
It is increasingly likely to be human judgment combined with machine-scale analysis.
The question is whether organizations can build systems that preserve meaningful human oversight without eliminating the productivity advantages of autonomy.
A Smaller Profession?
It is probable that the cybersecurity profession becomes smaller overall. Some traditional operational roles could shrink substantially. AI is beginning to compress cybersecurity employment by replacing tasks, reducing the need for entry-level labor, and allowing smaller teams to operate at dramatically greater scale. At the same time, demand could grow for:
- AI security engineers
- Security architects
- Agent-security specialists
- AI red-team professionals
- Security automation engineers
- Cybersecurity researchers
- AI governance professionals
- Incident commanders
- Security strategists
- Human-machine systems designers.
The result will be a cybersecurity profession with fewer people performing routine operational work and more people performing high-value strategic and technical work. The ultimate employment impact will depend on whether the new demand created by AI security, agent governance, AI-enabled attacks, and expanding digital infrastructure compensates for the labor displaced by automation.
And importantly, the evidence already supports the beginning of that argument. ISC2 reports that 69% of organizations in its 2025 workforce study were either already using AI security tools, testing them, or evaluating them, while SANS reports that 16% of surveyed organizations were already reducing cyber headcount because of AI.
This transformation may also challenge the traditional cybersecurity generalist. Historically, a capable security professional might understand networks, endpoints, identity, cloud systems, applications, threat intelligence, compliance, and incident response. Increasingly, cybersecurity professionals may need to understand another layer: How intelligent systems perform all of those functions.
The future security professional may therefore resemble a combination of cybersecurity engineer, systems architect, AI supervisor, and risk manager.
This is a fundamentally different profession.
The question is not simply: “Can you investigate an intrusion?”
It becomes: “Can you design an autonomous system that can investigate ten thousand intrusions—and know when it should stop and ask you for help?”
That is a much more demanding form of expertise.
Conclusion: The Profession After the Automation
The transformation of cybersecurity will not be measured solely by how many jobs AI eliminates. The deeper transformation will be measured by what humans are expected to do after machines take over increasing portions of operational security work.
The cybersecurity profession emerged in an era when computers were tools that humans operated. It is entering an era in which computers increasingly operate other computers. That changes the fundamental structure of the profession.
The junior analyst may become less important to the traditional SOC. The senior analyst may become an investigator of machine decisions. The engineer may become an architect of autonomous systems. The CISO may increasingly become a governor of machine-scale risk. And somewhere between these roles lies the central challenge of the next decade.
How do we train cybersecurity professionals when the machines are performing the work through which cybersecurity professionals traditionally learned their craft?
This may prove to be the profession’s greatest workforce challenge.
AI agents will almost certainly make cybersecurity more productive. They may make it faster, cheaper, and capable of defending vastly larger digital environments. They may also reduce the number of humans required to perform many traditional security functions.
But cybersecurity itself is unlikely to disappear.
The attack surface is expanding. AI is giving attackers new capabilities. Digital infrastructure is becoming more complex. Autonomous systems themselves are becoming targets. The likely result is therefore not the end of cybersecurity, but its transformation.
The cybersecurity professional of the future may not spend the day looking at a screen filled with alerts. Instead, that professional may supervise a digital workforce of autonomous agents—deciding what they can see, what they can do, when they can act, and when a human must take control.
That leads to perhaps the most important question of the agentic era:
If cybersecurity agents can increasingly do the work of cybersecurity professionals, who will be responsible for the agents?
This is a question that is being echoed across the chambers of government as well as the board rooms of Silicon Valley. Lawmakers in both parties agree more guardrails are needed, but even narrow attempts at regulation have fallen apart and a certain skepticism has set in. The answer will determine not only the future of cybersecurity employment, but the future architecture of AI and the cybersecurity profession itself.
Cybersecurity has been a fast-growing, high-paying profession for at least 2 decades. AI will undoubtedly slow and probably reverse this growth rate. It will be interesting to see how the profession is restructured during the next decade. Will training and universities adjust to the demands of the changing profession fast enough to ensure that new cyber professionals are ready? Will AI-based simulators train the new professionals fast enough? Let me know how your cyber workforce is changing due to AI. Give me your views. And thanks to my subscribers and visitors to my site for checking out ActiveCyber.net! Please give us your feedback because we’d love to know some topics you’d like to hear about in the area of active cyber defenses, artificial intelligence, authenticity, quantum cryptography, risk assessment and modeling, autonomous security, digital forensics, securing OT / IIoT and IoT systems, Augmented Reality, or other emerging technology topics. Also, email chrisdaly@activecyber.net if you’re interested in interviewing or advertising with us at Active Cyber™.
