This chapter describes the person at the console, in the queue, on the night rota and in the dashboard. It asks what the research has measured about fatigue, stress and attrition in security operations, whether AI relieves or intensifies the load, how analysts are themselves managed by metrics and monitored by the tools they use, and what a lead can do. It concerns B3 Investigate, where the analyst's attention is the scarce resource, B4 Respond, where the night and the incident put the heaviest demands on people, and B5 Learn, where the review of how the team worked is also a review of how it was measured. It applies to the SOC the conclusions of AI Boss (Chapters 11, 13, 14 and 23) on the effects of algorithmic management on autonomy, pace, health and voice (67, Nordqvist, 2026).
A word on method. The bibliography of this book contains no primary study of analyst burnout published between 2023 and 2026 and none that measures the effect of AI on a SOC's analysts. The primary studies it does contain are older, qualitative and small. The book's two organisations are worked examples. They show a mechanism and are never evidence of how common it is.
An analyst's day is organised by the queue. Alerts arrive from the SIEM, the endpoint tooling and the email gateway, and the first task is to decide which deserve attention. Between alerts come the interruptions: a service desk request, a question from a system owner, a page from the managed provider. An incident changes the day entirely: the work becomes continuous, the decisions carry consequences that a person must answer for, and the analyst must write as well as act, because the record is part of the response (Chapter 10).
Primary topics explored
- The analyst's day
- What studies measured
- Beside the agent
- Managed by metrics
- Co-determination in the SOC
- The debate
About AI Blue
AI Blue is Book 8 of The Transformed Architecture. It examines how the blue team, the people and functions that defend an organisation, is transformed when artificial intelligence takes part in their work: anticipating, detecting, investigating, responding and learning, the team's own AI and how to verify and protect it, operating models, roles, decision rights, regulation and measurement, and the careers and wellbeing of the people involved, for European enterprises and public authorities.
It builds on the conclusions of Architecture as Code, AI Governance, AI Platform and Security, AI Red Team, AI Threat, The Transformed Security Architect and AI Boss.
Chief information security officers, heads of security operations, SOC managers, analysts, detection engineers and incident commanders, security and AI architects, boards and management bodies, procurement leads, works councils and unions, data protection and audit functions, and public-sector leaders.
Gunnar Nordqvist
Conceived, directed and published the books of The Transformed Architecture.
Continue with the full chapter
Chapter 21: The Analyst at Work: Fatigue, On-Call and Being Managed by Metrics in AI Blue gives the detailed explanations, practical examples and implementation patterns behind this summary.
This whitepaper belongs to “People and Career” and is one of 32 drawn from the manuscript.