The 2025 ISC2 Workforce Study Says AI Is Reshaping Entry-Level SOC Hiring, Not Erasing It: What That Means for Your Pipeline

The 56 percent figure comes from ISC2 survey research on AI adoption and hiring, covered in ISC2's own reporting and in outlets including Infosecurity Magazine and PR Newswire's coverage of ISC2's findings on cautious AI adoption across security teams. The finding itself is specific: a majority of surveyed security professionals say AI has "somewhat or significantly" reduced the need for entry-level positions over the past year, and the mechanism they point to is concrete, AI tools taking over tasks that have historically been the on-ramp into a security career, particularly alert triaging and first-pass report writing.

That is a real and worth-taking-seriously finding. It is also not the whole picture from the same research. Alongside it: 44 percent of respondents report no impact on entry-level hiring from current or expected AI adoption, and 28 percent say AI is creating new opportunities for entry-level talent rather than eliminating them, most plausibly in AI oversight, prompt and output review, and the growing set of AI-security-specific tasks covered below. Those numbers do not average out to "AI is not a factor." They average out to a workforce whose own practitioners are genuinely divided on the direction and magnitude of the effect, which is a meaningfully different planning problem than a one-way contraction.

ISC2's flagship 2025 Cybersecurity Workforce Study, based on 16,029 respondents and published in December 2025, is the study most people mean when they say "the ISC2 workforce study," and its headline findings are about budget and skills, not primarily about AI displacement. The study found that 36 percent of organizations reported budget cuts (essentially flat versus 2024) and 24 percent experienced layoffs. At the same time, 95 percent of respondents report at least one unmet skill need, and 59 percent describe that need as critical or significant, up 15 percentage points from the prior year.

Read against the entry-level AI finding above, this context matters: a hiring manager who cut a junior req in 2025 was as likely to be responding to a flat or shrinking budget and a mandate to backfill hard-to-find senior or specialized skills as to any specific decision that "AI now does that job." ISC2's own leadership framing in the December 2025 study release leans toward this more mixed read as well, describing AI as "perceived as less of a threat to the workforce than anticipated," with many respondents viewing it as an opportunity for career advancement rather than a threat to their own role. Treating every 2025-2026 hiring slowdown as AI-caused risks misdiagnosing a problem that is at least partly budget and skills-gap driven, and building the wrong fix for it.

ISC2's 2025 Workforce Study also found that AI is now the single most cited skill need in the field: 41 percent of respondents name it as their most pressing skill gap, ahead of any other category. Within that, respondents ranked specific AI-related needs by importance: AI in threat detection and response (42 percent), defending AI models from attack (35 percent), securing AI integrations in cloud and edge deployments (31 percent), and AI governance and policy implementation (30 percent).

That pattern is hard to reconcile with a simple story of AI eliminating junior work outright. It reads more like a shift in what junior work consists of: fewer entry-level hours spent on manual first-pass alert triage that a tool now handles reasonably well, and a growing expectation that even junior hires understand how to review, validate, and act on AI-generated output rather than only human-generated ones. A junior analyst who can competently sanity-check an AI triage verdict, flag a wrong one, and explain why is doing work that is different from, not smaller than, the entry-level job of five years ago. This is the same logic covered in our comparison of AI-powered SOC tools and our review of autonomous AI SOC analyst agents from Dropzone AI, Radiant Security, and Prophet Security: these tools change what a human in the loop needs to know how to do, they do not remove the need for a human in the loop.

If AI adoption were simply closing off the entry-level tier, ISC2's own hiring-focused research would be expected to show hiring managers pulling back from junior investment. It does not. ISC2's June 2025 report on entry- and junior-level hiring, based on a survey of 929 hiring managers across Canada, Germany, India, Japan, the UK, and the US fielded in December 2024, found that 75 percent of hiring managers planned to hire more cybersecurity professionals in 2025, and nearly 90 percent had open positions at the time of the survey.

That same report shows hiring managers are still spending real money to develop junior talent rather than writing off entry-level hiring as obsolete: 45 percent reported spending between $1,000 and $4,999 to train an entry-level hire, with 31 percent spending under $1,000, figures that reflect a workforce still actively bringing junior analysts in and investing in their ramp-up rather than one that has stopped hiring at that level. Taken together with the AI-and-entry-level finding, the more defensible read is that hiring managers are adjusting what they expect a junior hire to already know and what they train them on, not abandoning the junior tier altogether.

Given what the actual data supports, three adjustments are more defensible than either ignoring the AI finding or treating it as proof the entry-level SOC job is disappearing.

First, redefine what an entry-level SOC role actually covers before you decide whether to cut it. If your Tier 1 job description is still built entirely around manual first-pass alert triage, you are hiring against a task an AI tool may already be doing reasonably well, and you risk both a bad hire (someone whose only skill is a task being automated) and a bad automation rollout (no human positioned to catch the tool's mistakes). Rewrite the role around AI-output review, escalation judgment, and the specific AI-security skills ISC2 respondents ranked highest (threat detection tuning, model defense awareness, cloud AI integration security) rather than the pre-AI version of the job. Our SOC staffing guide covering analyst tiers, headcount models, and shift coverage and our guide to building a SOC from scratch both work from the assumption that tier definitions need to be deliberately designed rather than inherited, which is exactly the exercise this data calls for.

Second, do not use the 56 percent figure to justify freezing junior hiring outright, since the same research shows 44 percent of your peers seeing no such effect and hiring managers overall still actively recruiting and training at that level. If your organization has a genuine budget or headcount constraint, name it as that, rather than backing into a junior hiring freeze under the banner of "AI made this role obsolete" when the broader data does not support that as a universal conclusion.

Third, treat mentoring and structured development as the differentiator ISC2's own leadership points to, not an afterthought. ISC2 CEO Clar Rosso's public framing of this research has emphasized using AI to remove repetitive work while deliberately preserving the learning and mentoring opportunities that used to come bundled with that repetitive work by default. If a junior hire is no longer learning triage fundamentals by doing hundreds of manual alerts, someone has to design a substitute path, whether that is structured shadowing of AI-assisted investigations, deliberate rotation through the AI-security skill areas the study flags as highest-demand, or a formal mentoring program that does not depend on volume-based repetition to build judgment.