If AI closes the repetitive alerts, the work through which many analysts have learned their craft goes first, and the experts who remain do less of the work that made them experts. This chapter treats that double problem: where the next analysts come from, and how the present ones keep their skill. It concerns B3 Investigate, where the entry rung of the ladder used to be, B2 Detect, which offers a new first rung, and B5 Learn, whose reviews and exercises are a school for the team; the degraded-mode drills reach B4 Respond. It applies AI Threat, Chapter 14, and the craft-keeping design of The Transformed Security Architect, Chapter 15, to the security operations centre (SOC), stages a debate on whether the junior route is needed, and ends with a plan a team can run.
A tier 1 analyst is the person who first reads an alert, decides whether it is noise or the start of something, and escalates to tier 2 or tier 3 when it is the latter. In many SOCs that post has been the route into the craft, and for most holders a poor way to spend a working day. The bibliography does not show how common the route is, and it does not show whether entry posts are disappearing: the ISC2 study reports skill needs and not entry-level hiring (Chapter 21) (73, ISC2, 2025). The chapter therefore treats the loss of the entry rung as a risk to design against and not as an established trend.
What the old route taught was real: an analyst who reads alerts day after day learns what the estate's ordinary days look like and when a question is worth an escalation, the hunter's sense of Chapter 9, and learns it by repetition with consequences. What it cost was also real. Qualitative studies of SOC analysts report that validating alarms is tedious and can lead to desensitisation and burnout (69, Alahmadi et al., 2022), and a six-month study of a corporate SOC found burnout leading to poor judgement and turnover, with career progression treating symptoms and not causes (70, Sundaramurthy et al., 2015). Both concern few sites and neither measured AI. They support a limited conclusion: the old tier 1 produced analysts, but also turnover and fatigue, and nobody should aim to restore it unchanged.
Primary topics explored
- The ladder and the missing rung
- What the evidence shows
- Unassisted practice
- Apprenticeship routes
- Degraded mode
- The debate
About AI Blue
AI Blue is Book 8 of The Transformed Architecture. It examines how the blue team, the people and functions that defend an organisation, is transformed when artificial intelligence takes part in their work: anticipating, detecting, investigating, responding and learning, the team's own AI and how to verify and protect it, operating models, roles, decision rights, regulation and measurement, and the careers and wellbeing of the people involved, for European enterprises and public authorities.
It builds on the conclusions of Architecture as Code, AI Governance, AI Platform and Security, AI Red Team, AI Threat, The Transformed Security Architect and AI Boss.
Chief information security officers, heads of security operations, SOC managers, analysts, detection engineers and incident commanders, security and AI architects, boards and management bodies, procurement leads, works councils and unions, data protection and audit functions, and public-sector leaders.
Gunnar Nordqvist
Conceived, directed and published the books of The Transformed Architecture.
Continue with the full chapter
Chapter 23: Keeping the Craft and Making New Analysts: The Apprenticeship Problem in AI Blue gives the detailed explanations, practical examples and implementation patterns behind this summary.
This whitepaper belongs to “People and Career” and is one of 32 drawn from the manuscript.