AI impact · verified capabilities
How AI is changing the work of Information Security Analysts
Our reviewed registry links 8 verified AI capabilities to tasks that are part of this occupation. This shows where AI tools can already assist with specific tasks. It is not a forecast that the occupation will disappear, and it does not measure how widely any tool is used.
Last reviewed: 2026-09-27 · O*NET 15-1212.00 · Mapping confidence: high
Task areas where verified capabilities connect
- Incidents and security
- Testing and QA
- Legal and document research
- Coding and software engineering
- Compliance and controls
- Inspection and safety
Verified capabilities (up to 5)
- EmergingEvidence: Strong
Suspicious script analysis
What AI can assist with: Explains suspicious scripts and command lines to support analysts.
Practical meaning: this can speed up part of the task, but still needs human direction and review.
Human responsibility: you review every output and keep the final decision.
Source: Microsoft - EmergingEvidence: Strong
Natural-language threat hunting
What AI can assist with: Turns plain questions into security queries and helps interpret results.
Practical meaning: this can speed up part of the task, but still needs human direction and review.
Human responsibility: you review every output and keep the final decision.
Source: Microsoft - EmergingEvidence: Strong
Security incident triage
What AI can assist with: Summarizes incidents and suggests response steps using threat intelligence.
Practical meaning: this can speed up part of the task, but still needs human direction and review.
Human responsibility: you review every output and keep the final decision.
Source: Microsoft - EmergingEvidence: Strong
Coding agents for multi-file work
What AI can assist with: Handles longer implementation tasks across files, with review still required.
Practical meaning: this can execute a bounded workflow, but ownership, controls and edge cases remain with people.
Human responsibility: you set permissions and approval points and stay accountable for outcomes.
Source: OpenAI - NowEvidence: Strong
AI-assisted pull-request code review
What AI can assist with: AI inspects proposed code changes, flags possible issues, and suggests fixes before or alongside human pull-request review.
Practical meaning: this can speed up part of the task, but still needs human direction and review.
Human responsibility: you review every output and keep the final decision.
Source: GitHub
More source-verified AI capabilities
Additional reviewed research for this occupation. These do not replace the core capability list or prove real-world adoption.
Grounded enterprise knowledge retrieval and answer synthesis
Microsoft documents that Security Copilot can search Microsoft threat-intelligence content and vulnerability publications to surface relevant intelligence.
Evidence: Limited
Practical meaning: this can speed up part of the task, but still needs human direction and review.
Verified source
The AI tools entering the profession — and what’s coming next
Some are already available for work; others signal where the profession is heading. Inclusion does not imply broad adoption or proven outcomes.
CrowdStrike Charlotte AI
Available nowCrowdStrike
Agentic security assistant in Falcon for triage, investigation, malware analysis, case summaries, and response guidance.
Important: Vendor-reported performance and customer outcomes may not generalize across environments, and agentic actions require governance.
Source: CrowdStrikeMicrosoft Security Copilot
Available nowMicrosoft
AI security platform for incident investigation, threat hunting, intelligence, script analysis, and guided response.
Important: Output can be inaccurate or incomplete and depends on enabled plugins, available telemetry, permissions, and current data.
Source: Microsoft Learn
What remains human responsibility
Evidence shows a capability exists; it does not prove adoption in every workplace or full-task replacement.
Evidence limits
Each capability is verified from the cited source only. A source shows that a capability exists; it does not establish adoption, deployment depth or outcomes in any particular workplace.
Sources
- Microsoft — What is Microsoft Security Copilot?
- Microsoft — Script analysis with Microsoft Copilot in Microsoft Defender
- Microsoft — Security Copilot Threat Hunting Assistant
- OpenAI — Codex — AI coding partner
- OpenAI — New tools for building agents
- AWS — Amazon Bedrock agents
- OpenAI — Introducing the Codex app
- GitHub — About GitHub Copilot code review
- arXiv / Bilkent University authors — Evaluating Large Language Models for Code Review
- Microsoft Learn — Grounded enterprise knowledge retrieval and answer synthesis
See what this means for your own week
The free assessment looks at the tasks you actually do and your own AI habits.
Start the free assessment