COMMENTARY: For more than a decade, the cybersecurity industry has told itself the same story: there aren't enough skilled people to do the work, and to fix it we need more hiring, more training programs, more pipeline investment.Every year the workforce gap gets cited again, slightly larger than the year before, as proof the strategy isn't working fast enough. Maybe it's time to consider a less comfortable explanation: the strategy was never going to work, because hiring was never the actual constraint.[SC Media Perspectives columns are written by a trusted community of SC Media cybersecurity subject matter experts. Read more Perspectives here.]Security operations centers (SOCs) don't have a people problem. They have a throughput problem, and the two look identical on a staffing report while being completely different in cause. Alert volume scales with attack surface — more cloud services, more endpoints, more third-party integrations, more identities to track — and attack surface has been growing exponentially for years. Headcount, even in a generous hiring environment, grows linearly at best. We cannot out-hire an exponential curve. No SOC has ever closed this gap by adding analysts faster than the alert volume grew, and none ever will, because the two are growing on different curves entirely.What that means in practice: the "shortage" isn't a shortage of qualified people. It's a mismatch between a triage workload that scales with infrastructure and a workforce that scales with budget cycles. Framing it as a hiring problem set the entire industry chasing a fix that was structurally incapable of closing the gap, no matter how much was spent on it.Where the actual bottleneck livesMost SOC analyst time doesn't go to the high-judgment work — the actual threat hunting, the incident response that requires real expertise. It goes to triage: Is this alert real? Does it matter? And, does it need escalation? That's high-volume, repetitive, pattern-based work, and it's exactly the layer where agentic systems now outperform tired humans on a four-alarm queue. It’s where the gap actually gets closed — not by hiring more people to do triage faster, but by removing triage as a task a human has to do at all.The evidence is no longer theoretical. Enterprises running agentic platforms purpose-built for this are already automating roughly 90% of frontline alert triage in production environments, with mean time to respond dropping by around 80%. That's not a productivity tweak. That's the actual bottleneck the industry spent a decade trying to hire its way out of, closed by removing the bottleneck instead of staffing around it.What this frees analysts to actually doMany CISOs fear deskilling — that automating triage means a less capable security workforce. But it’s just the opposite: analysts freed from alert babysitting get to spend their time on the work that actually needed their judgment in the first place – threat hunting and incident response – instead of burning out on a queue that was never going to get solved by adding headcount to it.Stop measuring the cybersecurity talent gap in unfilled job postings. Start measuring it in unprocessed alerts. The first number was always going to make a better fundraising pitch for training programs. The second one represents the problem that was actually costing companies money.Anurag Gurtu, co-Founder and CEO, AirrivedSC Media Perspectives columns are written by a trusted community of SC Media cybersecurity subject matter experts. Each contribution has a goal of bringing a unique voice to important cybersecurity topics. Content strives to be of the highest quality, objective and non-commercial.
Get daily email updates
SC Media's daily must-read of the most current and pressing daily news
Related Terms
Bring Your Own Device (BYOD)You can skip this ad in 5 seconds