Heimdal says AI will handle nearly all SOC triage within a year

By AI, Created 5:30 PM UTC, May 18, 2026, /AGP/ – Heimdal says its managed SOC is on track to leave fewer than 500 of 3 million monthly alerts for human analysts in the next year. The company ties that forecast to AI Wingman SOC and new survey data showing most IT teams expect AI to cut manual security work.

Why it matters: - Heimdal is projecting a major shift in security operations, with AI taking over almost all routine triage work. - The change could reshape SOC staffing, analyst roles and how security vendors price high-volume alert handling. - Heimdal’s survey suggests the shift is not limited to one company. - 79% of 1,000 IT and security professionals in the US and UK expect AI to reduce manual workload. - 38% expect their work to move toward higher-value tasks within three years.

What happened: - Heimdal founder Morten Kjaersgaard said the company expects fewer than 500 of its 3 million monthly SOC alerts to require human review over the next year. - That would leave less than 0.02% of alerts for a human analyst. - The forecast is tied to AI Wingman SOC as it absorbs routine triage work. - Heimdal’s research surveyed 1,000 IT and security professionals across the US and UK. - The research focused on AI adoption, governance and risk management in IT and security environments.

The details: - Heimdal said attackers are using AI to scale high-volume, low-complexity activity such as phishing. - Heimdal said defenders need AI for the same reason: humans were never meant to process triage at that scale. - Kjaersgaard said low-complexity, high-volume work will move to AI, while sophisticated cases will remain with SOC responders. - 61% of IT professionals said sensitive data being uploaded to AI tools is their top AI-related concern. - 40% said their current security tools are fully equipped for AI-driven risk. - Heimdal said its SOC team will not shrink as AI takes on more triage. - Analysts will focus on cases that need real investigation and on improving the AI that handles routine work. - Heimdal said providers built around high-volume human triage face a structural challenge because AI will handle that work first and at lower cost. - AI Wingman SOC is the third tier in Heimdal’s rollout across 2026, alongside Assist and Triage. - The initial release covers 15 SOC-relevant protection features. - Heimdal expects the tool to reduce L1 triage time by around 25% as it matures.

Between the lines: - The forecast points to a broader redesign of SOC labor, not just a shift in tooling. - Human analysts are moving from alert processing toward judgment, escalation and AI training. - Compliance keeps humans involved because regulated environments still require accountable people behind security decisions. - The market implication is that value may move away from raw triage volume and toward oversight, investigation and platform improvement.

What’s next: - Heimdal said full findings from the survey will be published in the coming weeks. - AI Wingman SOC will continue rolling out across 2026. - As the platform matures, Heimdal expects more routine alert handling to be absorbed by AI. - The company expects human analysts to spend more time on complex cases and system improvement rather than ticket volume.

The bottom line: - Heimdal is betting that SOCs will keep the humans, but not the human workload they used to do at scale.