The Analyst at Work: Fatigue, On-Call and Being Managed by Metrics

This chapter describes the person at the console, in the queue, on the night rota and in the dashboard. It asks what the research has measured about fatigue, stress and attrition in security operations, whether AI relieves or intensifies the load, how analysts are themselves managed by metrics and monitored by the tools they use, and what a lead can do. It concerns B3 Investigate, where the analyst's attention is the scarce resource, B4 Respond, where the night and the incident put the heaviest demands on people, and B5 Learn, where the review of how the team worked is also a review of how it was measured. It applies to the SOC the conclusions of AI Boss (Chapters 11, 13, 14 and 23) on the effects of algorithmic management on autonomy, pace, health and voice (67, Nordqvist, 2026).

Figure 21.1: The analyst's load before and after AI: the queue, the review volume, the night and the monitoring of the analyst.

A word on method. The bibliography of this book contains no primary study of analyst burnout published between 2023 and 2026 and none that measures the effect of AI on a SOC's analysts. The primary studies it does contain are older, qualitative and small. The book's two organisations are worked examples. They show a mechanism and are never evidence of how common it is.

The analyst's day

An analyst's day is organised by the queue. Alerts arrive from the SIEM, the endpoint tooling and the email gateway, and the first task is to decide which deserve attention. Between alerts come the interruptions: a service desk request, a question from a system owner, a page from the managed provider. An incident changes the day entirely: the work becomes continuous, the decisions carry consequences that a person must answer for, and the analyst must write as well as act, because the record is part of the response (Chapter 10).

Four features of this work matter to the rest of the chapter.

1. The pace is set elsewhere. The analyst does not choose when alerts arrive or how many. The detections, the estate and the adversary set the pace, and in a transformed team so do the agents that propose and the thresholds that route work to people.
2. Most items are benign and each still needs a check. This is the structure of the work that the research describes, and AI review of machine conclusions shares it (Chapter 14).
3. The consequence of a miss is large and delayed. A closed alert that was an intrusion is found weeks later, if at all, so the feedback on a day's work is slow.
4. Everything the analyst does is logged. Queries, tickets and approvals are recorded for evidence, audit and the reconstruction of an incident. The same record can describe the analyst.

On-call and the night

At Hansa Mutual the group SOC runs a follow-the-sun rota with a UK late shift, and the night is staffed from two countries; the shift lead at the Polish service centre carries the handover of the containment ledger (Chapter 10). At Nordvik Region the six analysts work office hours and the managed provider monitors out of hours, so the analysts' night is a call-out: when the provider escalates, or when an action touches a citizen-facing service, the duty analyst is paged. The load is small in hours and large in readiness, because a person who may be called cannot fully rest.

Working-time law bears on this. Directive 2003/88/EC sets limits on night work and requires rest, and whether time on call counts as working time depends on national law and on the case law of the Court of Justice, so the rota is drawn up with counsel and the works agreement and not by default. At night the machine's role is largest: the provider's AI closes low-severity alerts out of hours at Nordvik, and at Hansa the triage agent and the investigation agent work through the night with one reviewer on the shift. AI changes who is awake and what they are asked to review. It does not remove the need for a person to be awake.

What studies measured

Alahmadi, Axon and Martinovic (2022). The study had two phases: an online survey of 20 SOC practitioners and a qualitative investigation with 21 practitioners on the limits of security tools, especially alarm quality. The practitioners confirmed high false-positive rates and the need for manual validation. Most false positives were benign triggers: alarms that are technically true but reflect legitimate behaviour. The authors report that validating alarms is tedious and can lead to alarm burnout and desensitisation, and they propose five properties for better alarms: reliable, explainable, analytical, contextual and transferable (69, Alahmadi et al., 2022). The study is qualitative and measures neither burnout nor its prevalence.

Sundaramurthy and colleagues (2015). Researchers studied one corporate SOC anthropologically for six months, analysed the fieldwork with grounded theory and validated the model against fieldnotes from a SOC at a higher education institution. They describe burnout as a human capital management problem produced by the cyclic interaction of human, technical and managerial factors, report that it leads to poor analytical judgement and frequent turnover, and say that strategies such as career progression address only the symptoms (70, Sundaramurthy et al., 2015). Two SOCs were studied, one closely, and the study is twelve years old.

Kokulu and colleagues (2019) and Tariq and colleagues (2025). The first is a qualitative study of problems in SOC operations, relevant here because it concerns the gap between those who run a SOC and those who work in it (71, Kokulu et al., 2019). The second is a survey of research on alert fatigue in SOCs (72, Tariq et al., 2025). It tells the reader what has been tried and proposed. This book relies on neither for a figure.

ISC2 (2025). The workforce study is an online survey of 16,029 practitioners and decision-makers worldwide, conducted in May and June 2025. Of the respondents, 48 per cent said they feel exhausted from trying to keep up with threats and emerging technologies and 47 per cent said they feel overwhelmed by their workload. In the same survey 28 per cent had integrated AI tools into their operations and 69 per cent were engaged in adoption activities. On skills, 95 per cent reported at least one skill need, 88 per cent at least one significant consequence of a skills shortage and 41 per cent named AI as a top needed skill; 73 per cent believed AI will create more specialised skills, 33 per cent said their organisation lacked the resources to staff teams adequately and 29 per cent said they could not afford to hire the skills they need. The announcement also reports that AI is perceived as less of a threat to the workforce than anticipated (73, ISC2, 2025). The respondents are cybersecurity practitioners in general, not SOC analysts, the figures are self-reported and the survey does not separate those who work with AI from those who do not. Chapters 22 to 24 refer back to these figures and do not restate them.

Three conclusions follow, and they are the book's own. The qualitative evidence on why analysts burn out is consistent across a decade. No study the book relies on measures whether AI review of machine conclusions raises or lowers fatigue. And the field-wide survey is enough to treat the load as a design concern, not to quantify it for any one team; a team that wants a number must measure its own (the practical guide below).

Beside the agent

Before AI, the satisfying work was the investigation, and the first pass was the dull part. AI changes the proportions. The triage agent closes defined classes under policy (Chapter 7), the investigation agent drafts a timeline and a conclusion (Chapter 8), and the human holds the review. Three experiences follow from the design of the work. They are my interpretation, not findings.

Review has the structure of the alarm queue. A queue of machine conclusions that are nearly always right resembles the alarm queue the studies describe: many items, mostly benign, each needing a check that feels unnecessary. AI Threat, Chapters 6 and 14, concluded that relying on AI reduces effort, recall and, among those who trust the tool, checking (65, Nordqvist, 2026). Research on human use of automation points the same way (76, Parasuraman & Manzey, 2010). The risk to design against is that the analyst is asked to be vigilant at the task in which vigilance is hardest to keep.

The analyst can be overruled, or can overrule, without a conversation. A reviewer who is overruled because a class closes under a policy the reviewer did not write experiences a decision about their case that they were not part of. This is the autonomy question of AI Boss in miniature: who decided, who can contest it, and whether the analyst's judgement counts. The design answer is that every class has a named owner (Chapter 7) and that the analyst has a route to challenge a class.

The satisfying work shrinks unless it is protected. If the machine takes the triage and the investigation draft, review may be all that is left, and the route by which experts are made is removed (Chapter 23).

Across the usage modes

The mode decides whose identity the AI uses and what the analyst can see of it.

Usage mode	What it does to the analyst's load	What the analyst can see
Mode 0 Ambient AI	Closes or ranks alerts inside products, so volume falls silently or rises silently	Little: the product decides, and monitoring of the analyst can sit inside the same product
Mode 1 Conversational assistants	Helps with queries, explanation and drafting; the analyst sets the pace	The prompts the analyst writes are logged under the acceptable-use policy
Mode 2 Embedded workplace assistants	Summaries and suggestions in the console; small time savings, small extra checks	Console telemetry may record what was accepted or ignored
Mode 3 Agentic work tools	Executes steps for the analyst; the analyst reviews results	The tool's action log and the analyst's approvals are both records
Mode 4 Built AI applications	Ranks and clusters at volume, so the queue arrives ordered by a score	The score and its inputs, if the platform exposes them
Mode 5 Autonomous production agents	Adds pace the analyst did not set: proposals arrive at machine speed, around the clock	The oversight dashboard, the caps and the stop path, if the team built them

Mode 0 hides both load and monitoring inside products, so the contract with a provider is a workplace matter as well as a security matter (Chapter 16).

Managed by metrics

AI Boss divided management into five functions: M1 Direction, M2 Evaluation, M3 Consequence, M4 Development and M5 Care (67, Nordqvist, 2026). A SOC exercises all five on its analysts, with or without AI. The queue and its routing direct the work (M1). Dashboards of closure rates and time to close evaluate it (M2). Appraisal, pay and, in the worst case, dismissal follow from the scores (M3). Training and progression are M4, and the lead's attention to workload, health and the night rota is M5. The conclusion of AI Boss is that AI may direct work but may not, on its own, decide about people, and that monitoring has a chilling effect and pace has a cost in health. Applied to the SOC, three things follow.

Queue pace is a direction decision. The cap on open proposals, the routing thresholds and the share of work that goes to a person are M1 applied to the analyst. They are set in a policy, and the policy is a design decision about the analyst's pace, not a tuning parameter. Chapter 14's caps (12 open proposals by default and 8 at night) are the first-order response.

Individual scores pull behaviour toward the score. Closure rate and time to close reward closing alerts quickly, the wrong direction for judgement (Chapter 20 treats the measures themselves). A ranked analyst has an incentive to close, to reject nothing that takes time and to hide doubt. AI Boss found short-run gains for less experienced workers, limits for experts and a payoff from targeted monitoring in one well-designed study, with outcomes that depend on institutions and on whether workers took part in the design (67, Nordqvist, 2026). I found no evidence for the SOC that individual scoring justifies its costs.

Monitoring of the analyst's activity is a different thing from the logging of a system. SOC tooling records queries, approvals and time to approval for the case and for audit. The same data, joined to a name, becomes a profile of the person. An analyst who fears that a query will be read as a sign of incompetence may not ask the question that finds the intrusion. The design rule is the one stated in Chapters 7 and 14: measures are about the system, reported by team, class and quarter, never by name, and not used in appraisal or discipline. Chapter 22 treats the assessment of competence, the one place where individual results are legitimate, by practical demonstration and with the representatives' agreement (62, Nordqvist, 2026).

Co-determination in the SOC

The statements below are organisational and architectural implications, not legal advice, and they are limited to the regimes of the two example organisations.

In Germany, co-determination under BetrVG §87(1) no. 6 reaches technical equipment objectively suited to monitor employees' behaviour or performance; Swedish law obliges the employer to negotiate important changes; and GDPR Article 88 leaves room for national rules on employee data (8, European Union, 2016). AI Boss, Chapters 13 and 23, supplied the starting point (67, Nordqvist, 2026). The result for a SOC is direct: the SIEM, the case management system, the SOAR layer and the oversight dashboard are all suited to monitor analysts, so they fall within co-determination at Hansa Mutual whether or not anyone intends to use them that way. Whether the Konzernbetriebsrat or the local bodies hold the right depends on whether the matter can be settled at entity level, which counsel confirms. The AI Act adds a point to check: if queue routing or an oversight dashboard allocates tasks to staff or monitors and evaluates them, the rules for high-risk systems at work, including informing workers' representatives before use (Article 26), may apply (1, European Union, 2024). The data protection officer checks retention and access.

Two consequences are worth stating because teams get them wrong.

1. A tool for the SOC is a tool about the SOC. The agreement covers the platform that analysts use, not only software bought for monitoring people. It governs change classes (a new log source, a new agent, a new dashboard) so that each new tool does not need a new negotiation, and a new class that adds analyst-level fields returns to the table.
2. Monitoring is disclosed and bounded. The agreement says what is logged, who may read it, for what purpose and for how long. Covert monitoring of staff is out of scope for this book and for any lawful programme.

Worked example: Works agreement clause for SOC tooling

The clause below is illustrative: the shape of an annex term that Hansa Mutual's Konzernbetriebsrat and the Polish service centre's employee representatives could agree, kept in version control with the dashboard configuration it governs. The numbers are defaults to adapt. The UK late shift is outside German and Polish representation; its arrangement is left to the UK entity under UK law.

# Illustrative. Hansa Mutual, SOC annex to KBV-IT-2024 (AIDR-0779).
clause_id: KBV-IT-2024-SOC-04
title: Analyst-activity data in SOC tooling
parties:
  - Konzernbetriebsrat
  - Polish service centre employee representatives
  - Group SOC lead
out_of_scope: [UK late shift, to be settled locally under UK law]
systems_in_scope:
  - group SIEM
  - SOAR layer
  - case management
  - oversight dashboard OQM-HM-SOC-01
change_classes_requiring_notice:
  - new log source that records analyst actions
  - new agent that writes to the review queue
  - new dashboard field that includes a user identifier
reporting:
  level: team_class_quarter
  minimum_group_size: 5
  prohibited:
    - ranking of analysts
    - per-person closure rate
    - per-person approval time
    - missed seeds attributed to a person
use_in_appraisal_or_discipline: forbidden
raw_activity_data:
  purpose: [audit, evidence, incident reconstruction]
  retention_days: 180
  readers: [SOC lead, data protection officer]
  access_log: every read recorded; summary sent monthly to both employee bodies
night_work:
  max_consecutive_night_shifts: 4
  open_proposals_cap_at_night: 8
  stop_right: any reviewer may pause agent proposals for their shift
participation:
  analyst_panel: two analysts per site review dashboards before release
review:
  date: 2027-12-16
  reviewers: [SOC lead, Konzernbetriebsrat chair, Polish representative]

The clause makes three things checkable: the aggregate rule has a number, so a dashboard showing a group of three is in breach; the prohibited list names the measures that tools produce most easily; and the access log makes reading of raw data itself a record. The stop right at night is the analyst's counterpart of the stop path for agents in Chapter 10.

The debate

The question is whether AI relieves or intensifies the analyst's load. Each position is stated at its strongest, before a verdict. The sources report studies of the load before AI and of the research agenda; neither side can cite a study that measures the effect.

The case for concern

The strongest version starts from the structure of the work. The studies of SOC practice describe a job dominated by mostly benign alarms that each need a check, which is tedious and can lead to alarm burnout and desensitisation (69, Alahmadi et al., 2022). A six-month ethnography found burnout leading to poor judgement and turnover, in vicious cycles in which human, technical and managerial factors feed one another (70, Sundaramurthy et al., 2015). Now add AI that produces conclusions at volume. In the book's worked example at Hansa Mutual, proposals reaching reviewers triple and the median time to approval falls sharply. Those who hold this position read that as a mechanism and not as efficiency: a reviewer who approves in seconds is not reviewing, and AI Threat concluded that reliance on AI reduces effort and checking among those who trust the tool (65, Nordqvist, 2026). The satisfying work, the investigation, goes to the agent, and what remains is review. Monitoring is added on top: the tools that make review possible also record every approval, and ranking analysts by approval time is one query away. The night is unchanged, since a person must still be awake, and about half of the survey respondents already report exhaustion and an overwhelming workload (73, ISC2, 2025). AI, on this view, adds a new kind of load to a heavy one.

The case for calm

The strongest sceptical version starts from the same studies and reads them the other way. What practitioners said wears them down is repeated validation of alarms that are mostly benign, and the cycles Sundaramurthy and colleagues describe begin with that work. A triage agent that closes a defined class under policy, with sampling, removes the item that was tedious and leaves the analyst the ones that need a person. That is an argument from the structure of the work, and the survey of research on alert fatigue shows that the field has pursued automation, augmentation and human-AI collaboration as the way to address it, without measuring the result (72, Tariq et al., 2025). The workforce evidence adds two points. Respondents report that the shortage is of skills and of money to staff teams, not of work for AI to take: a third lacked the resources to staff adequately and 29 per cent could not afford the skills they needed, and the same survey reports AI perceived as less of a threat to the workforce than anticipated and a majority expecting new specialised skills (73, ISC2, 2025). For a team that cannot hire its way to night coverage, the choice is between AI-supported coverage and none. And the sceptic answers concern's central datum, the approval that takes seconds. A proposal in a low-risk tier is meant to be approved quickly when the checks around it are sound, and the test of review is the seeded-error catch and the reproduction rate, not speed. In the worked example the median time recovered to 4.2 minutes in the 2027-Q3 report once caps and seeding applied. That is an illustration of the mechanism and not evidence of prevalence. Last, the monitoring concern belongs to logging, which exists with or without AI, and class accuracy and sampled outcomes let a team measure the system instead of the person.

Where the positions meet

• The effect depends on team design. The same agent produces a lighter load where classes are chosen with care, review is capped and rotated and engineering time is protected, and a heavier one where volume is allowed to rise to what the agent can propose.
• No study measures the effect. The two organisations show how the mechanisms could work. They are worked examples, not data.
• Review volume must be capped, so that the system gives way before the person does, and a person stays awake at night in both views.
• Measures about people are agreed with representatives first, with aggregate reporting, no use in appraisal and a review date as the minimum.

What can be done

• Analysts keep the unassisted share of cases, use the stop right when the queue has outrun them and take part in designing the dashboards they are measured by.
• Leads cap open proposals, rotate reviewers, protect an engineering block, hold a debrief after every incident night and run the quarterly load review below.
• The CISO ties the agent's level to oversight capacity, so that the agent proposes less when review cannot keep up.
• The board asks for the load review beside speed and coverage figures and approves no targets for individuals.
• Representatives agree the metrics before collection, ask for the access log and use the review date.

Verdict

Observable. Practitioners report fatigue, exhaustion and workload now. The qualitative studies describe validation of mostly benign alarms as tedious and as a route to desensitisation and burnout, and the field-wide survey found 48 per cent of respondents exhausted and 47 per cent overwhelmed (69, Alahmadi et al., 2022) (70, Sundaramurthy et al., 2015) (73, ISC2, 2025). Tools that log analyst activity exist and can produce individual rankings.

Expected. The effect of AI on the analyst's load is expected to vary with team design and is not yet measured. The expectation rests on the structure of the work and on the research survey's treatment of AI as a means that has been proposed and not demonstrated (72, Tariq et al., 2025). Teams that cap review, rotate work and agree measures with representatives are expected to be better placed, because those measures address the mechanisms the studies describe.

Speculation. That wellbeing becomes a competitive factor in recruiting analysts is plausible and unsupported by present evidence. So is the claim that AI will end alert fatigue, and the opposite claim that it will make analyst work unbearable.

The caps, rotas, protected time, the agreement and its review date are in the team's hands. The volume of alarms the estate and the adversary produce is not, which is why the load must be measured and not assumed.

What leads can do

The AI Boss conclusion that the manager's role is transformed, from supervisor of tasks to accountable leader of people and conductor of agents, applies to the SOC lead: the lead conducts the agents (Shift 4 of The Transformed Security Architect) and is responsible for the analysts' load (M5 Care) (66, Nordqvist, 2026) (67, Nordqvist, 2026).

Practical guide: A fatigue and on-call review every quarter

Purpose. Look at the team's load as a team, with figures the representatives have agreed, and agree responses before the next quarter.

Roles. The SOC lead chairs. The senior analysts and a shift representative attend. The data protection officer attends when analyst-activity data is on the agenda. The employee representatives receive the aggregate report and may attend. The CISO receives the outcome.

Steps.

1. Collect the aggregates two weeks before. Take the figures from the oversight dashboard and the rota, by team, class and shift, never by person: proposals per reviewer-shift against the cap, share of shifts where the cap was reached, median time in review by tier, night shifts and call-outs per team, share of cases worked unassisted, and hours of protected engineering time actually taken.
2. Ask the analysts. Run a short voluntary questionnaire, agreed with the representatives, on workload, sleep after night shifts and whether the respondent could stop the queue if needed. Report it only for groups of five or more.
3. Ask the five questions.
4. Did any shift run above its cap, and why?
5. Did the share of cases worked unassisted fall below the target (one case in five at Hansa, one case in ten at Nordvik)?
6. Did anyone work more than the agreed number of consecutive nights or take a call-out within the rest period?
7. Did the engineering block happen, and what did it produce?
8. Did a class, a metric or a tool change this quarter without passing through the agreement?
9. Agree responses. For each question answered badly, record an owner, an action and a date. Typical responses: lower the cap, pause or cap new proposals for the class (the back-pressure of Chapter 14), add a reviewer to a shift, rebalance the rota, or reduce the managed provider's escalations. Moving a class from Level 3 Bounded to Level 2 Supervised is a response to a quality failure, not to load, because at Level 2 a person approves each action and the reviewer's work rises.
10. Record the review. Write it as a decision record, report the aggregate figures and actions to the representatives and fix the date of the next review.

When the triggers fire together. Three rules move a class downward: the load cap (Chapter 14), a quality failure such as a seeded-error catch below 0.80 (Chapter 14) and fewer than two evidenced holders of the competence (Chapter 22). The last two lower the level; the first limits the volume. When a class drops to Level 2 on quality or competence while the cap is also reached, the class stops proposing beyond the cap and the backlog waits for the day shift or is worked by hand. The level never rises to relieve the queue.

Definition of done. A record exists with the figures, the five answers, the actions with owners and dates, and the representatives' copy. No figure names a person. The defaults are one review each quarter and a debrief within three working days of any incident that involved a night call-out; adapt both to the works agreement and the size of the team.

Rotation, protected time, debriefs and the right to stop

Rotation. Rotate between review, investigation and engineering at least every two hours during a review shift.

Protected time. Reserve a fixed block each week, half a day by default, for engineering, hunting or practice. The SOC lead cancels it only by recording the reason in the quarterly review.

Debriefs. After an incident night, hold a debrief about the work and not the people. It feeds the post-incident review of B5 Learn (Chapter 11), and it is where the lead notices that someone is not coping.

The right to stop. Any reviewer may pause agent proposals for their shift when the cap is reached or the queue outruns attention, and the pause is not counted against them.

Analysts know where a dashboard misleads and which classes waste a night. Give them a seat in the review of classes, a say in dashboards before release and a route to contest a class or a metric.

Nordvik Region and Hansa Mutual

Nordvik Region. The six analysts share a duty-analyst call-out rota for escalations from the managed provider and for anything that touches a citizen-facing service, one week in six. The provider's AI closes a class of low-severity alerts under no stated rule, so the analysts cannot see the load they are spared (the Mode 0 blind spot). The union has negotiated that closure rates and similar measures are never reported by name. AIDR-0724 (illustrative, 2027-04-06; reviewers the HR lead, the union representative and the data protection officer) extends that rule to the AI-use log of AUS-NR-SOC-01 and the weekly sampling record of AIDR-0712, and adopts the quarterly load review. It also does what a six-person team must do when one person holds several duties. Karin Lund, as detection owner, already carries detection ownership, the weekly intelligence hour (AIDR-0705), the hunt programme (AIDR-0709), the weekly closure sample (AIDR-0712), the seeding of three of five monthly summaries (AIDR-0715), upkeep of DLG-NR-SEC-01 and the call-out rota. AIDR-0724 writes her time budget down: one protected engineering morning a week, the call-out rota waived, the intelligence hour, at most two hunts a year, closure-sample reviews shared with the second senior analyst in alternate weeks, and upkeep of DLG-NR-SEC-01. Investigating cases is the time that remains, and she does not mentor (Chapter 23 gives that to the second senior analyst). AIDR-0732 records that the unit cannot sustain all of these without the junior post funded for 2028. The CISO owns the budget and reviews it each quarter. With six people the group size of five cannot be applied to subteams, so the Region reports figures for the team as a whole only.

Hansa Mutual. The group SOC has about 38 people. AIDR-0779 (illustrative, 2027-06-16) records the terms of the SOC annex of the worked example, agreed in principle with the Konzernbetriebsrat and the Polish employee representatives: aggregate-only reporting, no appraisal use, an access log and a night-shift cap, with a review on 2027-12-16. The annex was signed on 2027-10-28 (AIDR-0791). The terms were agreed on the early data from the extension of HM-SEC-001 across the rota, in which proposals rose to about three times the baseline and approval times fell sharply. The first report under the agreed terms is the 2027-Q3 report OQM-HM-SOC-01 of 2027-10-04: 9,600 proposals at 3.0 times the 2026 baseline, a median of 4.2 minutes in review and a rejection rate of 0.12. The shift lead at the Polish service centre, Piotr Nowak, sits on the analyst panel that reviews dashboards before release.

The difference is one of leverage. Nordvik has few people, a strong union rule and a provider it must ask; its instruments are the rota, the time budget and the contract. Hansa has the platform, the dashboards and the works council; its instruments are the annex and the caps. Both reach the same rule: the system is measured and the person is not.

Summary

The analyst is a worker whose attention is the scarce resource of B3 Investigate, whose night is the heaviest part of B4 Respond, and whose review of the team's work is the substance of B5 Learn. The research is small and mostly qualitative. It describes a job dominated by mostly benign alarms, tedious validation, desensitisation and burnout, and a link between burnout, poor judgement and turnover (69, Alahmadi et al., 2022) (70, Sundaramurthy et al., 2015). The bibliography holds no recent primary study of analyst burnout and none that measures the effect of AI on a SOC's load.

Whether AI relieves or intensifies that load is open. The case for concern rests on review at volume, the loss of the satisfying work and the monitoring of the analyst; the case for calm rests on the removal of repetitive validation, a skills and resource shortage that AI-supported coverage addresses, and the point that speed of approval is not the test of review. The positions meet on team design: cap review volume, rotate the work, protect time and agree the measures with representatives first. The load reported now is observable, the variation by team design is expected, and wellbeing as a competitive factor is speculation.

The analyst is also managed. Queue pace is a direction decision, individual scores pull behaviour toward the score, and tools that log every query can profile the person. Measures are about the system, reported in aggregate, disclosed, kept out of appraisal and agreed with employee representatives. Leads can do the practical things: the quarterly load review, rotation, protected time, debriefs and the right to stop.

Chapter 22 turns from how analysts work to what they must be able to do, and how competence is built and shown by practical demonstration.

Sources

1. Nordqvist, G. (2026). AI Boss: When Artificial Intelligence Manages People in European Enterprises and Public Authorities. The Architecture as Code Series, Book 7. (67, Nordqvist, 2026)
2. Nordqvist, G. (2026). AI Threat: Are the Dystopias Coming True? Evidence, Risk and Response for European Enterprises and Public Authorities. The Architecture as Code Series, Book 5. (65, Nordqvist, 2026)
3. Nordqvist, G. (2026). The Transformed Security Architect: Role, Craft and Career in the Age of AI in European Enterprises and Public Authorities. The Architecture as Code Series, Book 6. (66, Nordqvist, 2026)
4. Nordqvist, G. (2026). AI Governance: Governing Artificial Intelligence in European Enterprises and Public Authorities. The Architecture as Code Series, Book 2. (62, Nordqvist, 2026)
5. European Parliament and Council of the European Union (2016). Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation). (8, European Union, 2016)
6. European Parliament and Council of the European Union (2024). Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act). (1, European Union, 2024)
7. Alahmadi, B. A., Axon, L. & Martinovic, I. (2022). 99% False Positives: A Qualitative Study of SOC Analysts' Perspectives on Security Alarms. 31st USENIX Security Symposium. (69, Alahmadi et al., 2022)
8. Sundaramurthy, S. C., Bardas, A. G., Case, J., Ou, X., Wesch, M., McHugh, J. & Rajagopalan, S. R. (2015). A Human Capital Model for Mitigating Security Analyst Burnout. SOUPS 2015. (70, Sundaramurthy et al., 2015)
9. Kokulu, F. B., Soneji, A., Bao, T., Shoshitaishvili, Y., Zhao, Z., Doupé, A. & Ahn, G.-J. (2019). Matched and Mismatched SOCs: A Qualitative Study on Security Operations Center Issues. ACM CCS 2019. (71, Kokulu et al., 2019)
10. Tariq, S., Baruwal Chhetri, M., Nepal, S. & Paris, C. (2025). Alert Fatigue in Security Operations Centres: Research Challenges and Opportunities. ACM Computing Surveys 57(9). (72, Tariq et al., 2025)
11. ISC2 (2025). 2025 Cybersecurity Workforce Study. (73, ISC2, 2025)
12. Parasuraman, R. & Manzey, D. H. (2010). Complacency and Bias in Human Use of Automation: An Attentional Integration. Human Factors 52(3). (76, Parasuraman & Manzey, 2010)