Reshaping cyber security roles: How AI enhances teams without replacing humans

IN CYBER security, the narrative around artificial intelligence (AI) is shifting from job replacement to job redefinition. Industry leaders believe that AI’s true value lies not in replacing analysts, but in augmenting them, handling data-intensive tasks at a scale no human team can match.

Mandy Andress, chief information security officer (CISO) at Elastic argues that AI will create new AI-enabled roles. At the same time, seasoned professionals could manage the AI-enhanced teams to strengthen an organisation’s cyber security posture amid a persistent talent shortage.

Agents as a force multiplier

Today, cyber security teams are moving towards real-time cyber defence – monitoring their systems round the clock to spot and respond to threats as they happen.

To do this effectively, many organisations are using what is called micro threat modelling. In essence, this means keeping a close watch on their digital infrastructure for the smallest change, whether in the program code or server configuration.

Because modern IT systems run on many layers of hardware and software, it can be difficult to tell whether an event or a sudden change is a genuine threat or just a harmless glitch. This leads to alert fatigue among cyber security teams, eventually allowing hackers to slip in.

That is where “agentic AI becomes a game changer”, explains Andress. 

“Organisations can take it a step further with agentic AI, where a collection of agents autonomously fulfil specific roles like parsing large data sets and log files. This enables junior analysts to move up the value chain faster,” says Andress.  

An AI agent can sift through thousands of logs, where perhaps only 10 might signal a real attack, and aggregate critical alerts on a single dashboard. This reduces alert fatigue and frees analysts from the tedious tasks of retrieving information from disparate systems.

Unlike older systems that stop at detection, the new wave of agentic AI can understand the context of an attack, make decisions and take action instantly to contain it.

Instead of a team of senior experts constantly monitoring every system change, as in the past, a junior analyst can now work alongside an AI agent to spot, investigate and escalate potential threats early. 

Junior analysts can spend this freed-up time learning from AI analysis insights, spotting patterns from vast amounts of data, and finding possible loopholes or hacker footprints. As the technology can manage time-consuming tasks, newcomers can take on roles that previously might have required more experienced analysts.

Context is key

For AI agents to act autonomously and reliably, they need the right information at the right time, a practice known as context engineering. 

Relevance is at the heart of context engineering, and this requires a search platform capable of finding relevance across an organisation’s private data – data that is often messy, multi-faceted and fragmented across systems. 

A unified search platform, such as Elasticsearch, is essential for context engineering. It provides the core functionality of retrieval, orchestration and governance, needed for relevance at scale.

This foundation ensures that “security agents” can deliver security insights and execute reliable actions. 

Would AI take away jobs?

As these AI systems grow smarter and take on more complex work, some cannot help but wonder – where does that leave the human expert?

Andress remains optimistic that cyber security will continue to grow with more experts needed to join the field, especially given the rising number of threats, including AI-generated ones.

“When I first came into the security space in the late 1990s, CISOs didn’t exist,” she recalls. “Look how big the industry got.”

With the disruption caused by AI, there is much for everyone – both experienced and new junior cyber security professionals – to learn so that they can add value to whatever AI is already automating.

“Go with a beginner’s mindset, recognising you are not always going to be the expert,” she emphasises. “Be the change leader and help others along, and you will be the most successful in making the transition.”

Learn how Elastic can help manage your organisation’s cyber security needs.