AI will not replace L1 SOC analysts
Every week the same debate comes back: will generative AI make junior security analysts obsolete? My answer is no. But an analyst who works with enterprise LLMs through the Model Context Protocol (MCP) will easily outpace three analysts who refuse to adapt.
What we actually built
Over the past few months I have been modernizing our SOC workflows by connecting AWS Bedrock, Google Vertex AI and Atlassian Rovo to our security tools through MCP servers. MCP gives a model a controlled, auditable way to call tools: query the SIEM, look up an IP's reputation, pull asset context from the CMDB, read a ticket's history.
The goal was never to let a model make decisions. It was to remove the repetitive work that sits between an alert firing and a human being able to judge it.
Before and after
An L1 analyst used to stitch together telemetry from several sources by hand, check reputations, look up who owns the asset and draft the ticket. Now an automated pipeline enriches the alert in seconds, before a person opens it.
| Step | Before | After |
|---|---|---|
| First-pass triage | Tab-switching across tools | Review of a pre-built summary |
| Time per alert | ~15 min | ~30 sec |
| False positives | Reach the main queue | Filtered out before the queue |
| Analyst energy | Spent clearing the queue | Spent on real threat hunting |
Why this protects analysts
Burnout in a SOC rarely comes from hard investigations. It comes from the hundredth identical alert of the shift. When that work is automated, junior analysts get to the interesting part of the job sooner: reasoning about intent, spotting what does not fit, and learning to hunt. That is how they become senior analysts.
What to keep in mind
- Keep a human on every decision. The model gathers and summarizes; an analyst decides and owns the outcome.
- Scope tool access tightly. An MCP server should expose only the read actions triage needs, with logging on every call.
- Measure it. Track time to first decision and false-positive rate so you know the pipeline is helping, not just adding noise in a new place.
The point
The future of cyber defense is not human against machine. It is analysts with real-time context at their fingertips. If your SOC still handles L1 triage exactly the way it did two years ago, you are not only behind on tooling. You are choosing analyst burnout.