Dwi Wanna
This article is part of an ongoing series from Sophos frontline security operations specialists, sharing the expertise they use to strengthen our industry-leading Managed Detection and Response (MDR) service and defend customers against evolving AI-era threats.
In the world of labor economics, a 20% growth forecast for a specific sector is typically cause for celebration—a sign of a booming, healthy industry. However, when applied to the specialized field of Incident Response (IR), that number feels dangerously modest. The U.S. Bureau of Labor Statistics projects a 21% employment growth for information security analysts between 2025 and 2035. While this serves as a helpful baseline for the broader information security profession, industry veterans suggest that the actual demand for frontline Incident Responders is accelerating at a much more aggressive velocity.
The signals are unmistakable. From the halls of major security conferences to the private inquiries of digital forensics and incident response (DFIR) firms, the message is uniform: the industry is facing a massive, structural capacity shortfall.
The Evidence of an Industry-Wide Squeeze
The evidence of this impending crunch is not found in abstract models, but in real-world operational realities. Leaders from top-tier security firms are openly discussing their hiring surges. Our partners—the managed service providers and IT integrators who sit on the front lines of small-to-mid-sized business security—are reporting that they cannot hire talent fast enough to keep up with client needs.
Perhaps most telling is the trend among specialized DFIR boutique firms. These organizations, which traditionally handle the most complex breaches, are increasingly reaching out to providers like Sophos, asking for "overflow support" when their internal teams hit maximum capacity. When the experts are calling for backup, it is a clear indicator that the industry’s current human capital is stretched to the breaking point. These are not isolated anecdotes; they are consistent, echoing signals from across the entire security ecosystem.
AI: The Force Multiplier for Adversaries
The core of this crisis lies in a fundamental shift in how threat actors operate. Artificial Intelligence has not necessarily created entirely new categories of attacks, but it has fundamentally altered the economics of cybercrime. By compressing attack timelines, AI allows threat actors to do significantly more with the resources they already possess.
According to the Sophos AI Security 2026 Report, attackers are using AI to streamline their workflows—researching targets, crafting more convincing phishing lures, analyzing code for vulnerabilities, and identifying entry points with unprecedented speed. While defenders often wait for the "fully autonomous AI attacker" to emerge, the reality is that the threat is already here: attackers have successfully weaponized AI to increase their operational tempo.
The 2026 Sophos Active Adversary Report confirms this trend, describing a landscape defined by increased speed, volume, and noise. The attackers have found a way to scale their operations; unfortunately, most defenders have not. The result is a widening chasm between the speed at which a threat actor can move through a network and the speed at which a security team can detect and contain them.
The Patching Paradox: Speed vs. Operational Reality
Nowhere is this capacity gap more visible than in the realm of vulnerability management. The industry standard advice—"patch faster"—is technically correct but operationally naive. Security teams cannot simply flip a switch and deploy every update the moment it drops.
Patch management is a complex, high-stakes operational task. Security teams must first identify which systems are vulnerable, assess the business criticality of those systems, conduct testing to ensure the patch doesn’t break legacy software, coordinate maintenance windows with department heads, and verify the remediation’s success. In many environments, a rushed update is just as likely to cause an operational outage as a cyberattack is to cause a data breach.
AI is accelerating the discovery of vulnerabilities and significantly shortening the window between disclosure and exploitation. This places immense pressure on security teams that are already managing complex, heterogeneous environments with finite resources. When an organization fails to patch at "attacker speed," it is rarely due to negligence; it is almost always due to a lack of sufficient human capacity to navigate the technical and operational overhead.
The Identity Crisis: Seconds Matter
The challenge, however, extends far beyond patching. The 2026 Sophos Active Adversary Report provides a sobering look at how modern intrusions unfold. An analysis of 661 incidents revealed that 67% of all intrusions began with compromised credentials or other identity-related tactics. Even more concerning: attackers reached Active Directory—the keys to the kingdom—in an average of three hours and 24 minutes.
When an adversary has less than four hours to go from initial access to privilege escalation, the margin for human error or delay is zero. Organizations are required to maintain a constant state of readiness: strengthening identity controls, retaining high-fidelity telemetry, monitoring for subtle behavioral anomalies, and maintaining 24/7 coverage.
When those controls fail, the organization enters the "Four Basic Questions" phase of an incident:
- What happened?
- How did it happen?
- What is the extent of the damage?
- How do we stop it and recover?
Answering these questions under duress requires seasoned professionals who can distinguish between "suspected" and "known" activity, effectively manage technical investigations, and communicate risk to stakeholders—including legal teams, insurers, and executives.
The Human Element: Why Technology Isn’t a Silver Bullet
It is tempting to look at AI and automation as the panacea for the talent shortage. While these technologies are essential for modernizing security operations—automating evidence collection, correlating disparate data points, and summarizing complex activity—they cannot replace human judgment.
A security incident is a high-pressure crisis, not a technical puzzle. Responders must make critical decisions with incomplete information, balancing the need for containment against the need for business continuity. They must coordinate with cross-functional teams and translate technical risk into business consequences for executive leadership.
Communication under pressure is a human skill. Strategic decision-making in the face of ambiguity is a human skill. While technology can provide the tools to perform these tasks, the demand for the people who possess the experience to wield them is only going to grow.
Implications for the Future
If the current indicators are accurate, the 20% growth forecast for information security professionals will fall short of the market’s actual requirements. We are seeing a structural shift where the speed of attack has outpaced the growth of the defender workforce.
To bridge this gap, the industry must pivot from a purely growth-based strategy to an amplification-based strategy:
- Career Pathways: We must formalize and accelerate the training of new analysts, moving away from "entry-level" barriers that prevent talented individuals from entering the field.
- Operational Synergy: Internal security teams must foster stronger, more integrated partnerships with external MDR and IR providers. Outsourcing the "overflow" capacity is no longer a luxury; it is a necessity for resilience.
- Human-Centric AI: We must utilize AI to amplify the expertise of our existing staff rather than viewing it as a replacement for them. The goal should be to automate the "noise" so that human experts can focus on the "signal."
The threat landscape is no longer a static field of play; it is a dynamic, AI-accelerated race. Attackers have already scaled their capacity to conduct operations at a rate that would have been impossible a decade ago. It is time for the defense industry to acknowledge that the "20% growth" model is an underestimate. Defenders must prepare to scale—both in technology and in human expertise—or risk being left permanently in the wake of the adversary.
Reynand Wu
Lina Irawan
Pevita Pearce
Suro Senen
Muslim
Ammar Sabilarrohman
Raul Delapena Setiawan