AI-Driven Attacks Will Bury Security Teams in Noise, and Entry-Level Analysts Are the Filter

Security operations centers are built to ingest telemetry from tools. That leaves them blind to an employee who gets a suspicious call or text message and mentions it in a chat channel, one of the earliest warnings of an attack. As attackers use AI to produce more c

onvincing lures at higher volume, those human reports will grow in number and in value. Teams that can't route them will lose the first signal that something is wrong. The sorting work is landing on the entry-level analyst, which changes what security leaders should hire for and how their SOC treats the employees who report.

Rockwell Scott, Senior Vice President of IT and Chief Digital Transformation Officer at NORC at the University of Chicago, oversees cybersecurity and digital transformation at a nonpartisan research organization that holds sensitive data behind job reports and CDC information. Before NORC, he advised CISA and military clients as an Executive Partner at Forrester Research and served as CIO and CSO of a Fortune 500 oil and gas company. He recently published a forward-looking job description for a junior SOC analyst that sets out how the role will change.

"These roles are going to be super important to adding an evidence layer and a filter and some context to keep from overwhelming our SOC and our engineers," Scott says. How well analysts do that depends on technical skill, and Scott spends nearly as much time on whether employees keep sending reports at all.

Employee reports bypass the SOC

Scott expects security operations centers to start taking in signals unlike anything they've handled, at volumes well above today's. Reports of vishing and smishing attempts, which employees send to a mailbox or a Teams channel, currently sidestep the security controls that feed the SOC. "Our SOC doesn't see those, our humans see them, but we're going to have to start getting those in because AI deception is going to be getting better and better," he explains.

AI also makes it easier for attackers to launch those campaigns, and Scott expects the result to be a SOC that's harder to read. "This is going to raise the noise level a lot higher than it is today," he says. The same volume problem is showing up in remediation, where Bank of America hired 1,000 contractors for about six months to patch flaws that AI models helped find.

The scale of email attacks is already visible in Microsoft's own telemetry. In its Q2 2026 email threat report, the company describes a single actor that reached more than 67,000 users across more than 42,000 organizations in under three hours. The messages were scripted and impersonated sales executives and the CEO. Microsoft's account doesn't attribute that campaign to AI, but it shows how little time an operator needs to reach tens of thousands of inboxes. Each inbox belongs to an employee who has to decide what to do with a suspicious message.

When employees report, the messages arrive without the structured data a security tool produces, so an analyst has to add context, check each one against what the SOC already sees, and decide which deserve an engineer's time.

Junior analysts tune models and add context

Scott wrote his junior analyst job description for a SOC that receives far more employee reports than it does today. He expects entry-level analysts to tune the models that process incoming data, interpret the context behind each data element, and receive the human signals described above.

The traditional foundation stays in place. New analysts still need operating system and networking basics, an understanding of NIST and other security frameworks, and certifications, Scott says, and a certification in AI security is in development at ISC2, a year or two from release. "By the time it's out, it'll probably be outdated," he notes, so the AI skills have to come from somewhere faster.

He points new hires to free AI training from Google and Amazon that covers language models, small language models, and how to maintain and tune them. "That's not something that most cybersecurity people have done," he says. Scripting and automation fill the remaining gap, because Scott expects SIEM and SOAR vendors to add automated response features that lag behind what teams need. In his view, help desk and desktop engineering staff, who already work close to users, can make the transition fairly easily.

He makes the case to his own security staff with an analogy from cloud migration. "It was a lot easier to run an application in the cloud if it were born in the cloud, than it was to migrate it to the cloud," he says, and he wants new analysts who are born in AI. Existing staff get a warning. "If you're not careful, the entry level person in a few years is going to be trying to take your job because they're native with these tools."

The pressure on junior roles reaches beyond security. On Wall Street, banks are automating the analyst work that once trained their future leaders, and UBS now requires proof of AI fluency for its 2027 junior hires.

Keeping up is a permanent cost. Scott describes cybersecurity and most IT jobs as "trying to walk up the down escalator at the mall," where "if you stop for just a few minutes, you lose pace and start going backwards very quickly." By his estimate, staying current takes 20 to 30 hours of education a year depending on the role, which gives security leaders a number to budget against.

Employees keep reporting when analysts respond well

Scott studied psychology because of where breaches originate. He cites Stanford research attributing 88% of breaches to human mistakes and Verizon's 2025 Data Breach Investigations Report puts human involvement at 60%. Scott's conclusion is that organizations need to move users and security staff from awareness to readiness. "It's kind of like understanding that tornadoes are dangerous, but then knowing what to do when you are threatened by one is something totally different," he explains.

Scott has interviewed dozens of people whose credentials were stolen. "90% of them say right after they did it, they felt in the pit of their stomach that maybe something was wrong, but they had already done it," he says. That moment of doubt is the window a SOC needs. When employees tell an approachable security team they may have been phished, he explains, the SOC can "make that determination pretty quick and stop it before it becomes a full blown incident."

The analyst's response decides whether that message gets sent a second time. "The way you communicate to them is going to be extremely influential on whether they report anything next time," Scott notes. Silence from the SOC discourages the next report, and so does a curt reprimand. His published job description left that feedback loop out, and he says the people side of the role matters even at the junior level.

Influence also decides how far an analyst goes, and that includes translating findings for the business. "Don't rely upon the business to translate your technical jargon into something that they can understand," Scott says. A job description built on his account has two halves, one technical and one about people. He wants SOCs to treat a reported mistake as a result worth recognizing. "Learn to celebrate the near misses because those are extremely important," he says. "They're gifts, they're learning moments."