How can AI-enabled tools impact retention on security teams, whether for better or worse?

At Microsoft, we view AI as providing significant opportunities for upskilling and using human talent for higher-level tasks. By automating repetitive work, such as ticketing, we reduce burnout and enable our analysts to focus on threat hunting, purple teaming, and content engineering. This approach supports career growth and helps retain senior talent. However, automation does bring challenges, including anxiety over job erosion and trust issues. Change management is crucial, and we emphasize that humans are irreplaceable and remain at the center of this transformation. Security professionals are the editors-in-chief, shaping how AI tools are used to elevate the team to the next level.

This is an important question, especially for those of us in leadership roles. There is increasing pressure from the business to drive greater efficiency and effectiveness, sometimes with expectations to reduce staff as AI capabilities are introduced. These conversations are happening across the industry. While AI can enable teams to operate with fewer people, those remaining can focus on higher-value work. There is a constant tension between the drive for efficiency and the need to retain skilled staff. Ultimately, freeing up team members to contribute in more meaningful ways can be a positive outcome, but the pressure to reduce headcount is real.

To me, AI is just another security tool that must be learned, understood, and matured. It should be used to enhance efficiency, not to replace individuals. Leadership needs to recognize that AI is about creating efficiencies rather than eliminating roles. With proper adoption, human capital and knowledge are leveraged, and employees can take ownership of simpler tasks. AI should be seen as a tool for empowerment and efficiency, not as a threat to job security.

In our small team, we rely heavily on managed products that incorporate AI, which has been beneficial. However, I’ve observed that teams using these managed products are shrinking, and retention is affected as some roles, particularly first-tier SOC analysts, are being replaced by AI-driven processes. For us, being small and nimble, this hasn’t posed a problem, but I do see that as AI takes on more of the initial triage, traditional tier-one positions are being phased out.

The impact of AI-enabled tools on retention depends significantly on the leadership behind the security and data protection teams. AI tools can add great value by taking over repetitive work and reducing alert fatigue. However, without a clear course of action and proper safeguards, these tools can actually create more noise and worsen the situation. AI should never be seen as a silver bullet; it’s a tool that requires human intervention and thoughtful deployment. Without the right human involvement, the introduction of AI could have a negative effect rather than improving retention.