Security tools generate alerts. Cybersecurity analysts decide which of those alerts are real, how serious they are, and what to do about them, often in minutes and usually without anyone outside the security team noticing. When that judgment is good, an intrusion becomes a contained incident. When it is missing or overwhelmed, the same intrusion becomes a breach.
That is why analysts sit on the front line of digital defense. They protect systems, but more importantly they protect trust: the confidence of customers, partners and regulators that data is handled properly. This article looks at what analysts actually do day to day, why the role is hard to staff, and how businesses of every size can make sure someone is watching.
The scale of the problem, measured properly
You may have seen the claim that a cyberattack happens every 39 seconds. It comes from a 2007 University of Maryland study led by Michel Cukier, which recorded automated attempts to break into a small set of internet-connected computers with weak passwords. It is a useful reminder that anything exposed to the internet is probed constantly, but it measures automated login attempts, not breaches, and it is nearly two decades old.
The more important point for businesses is volume. Firewalls, endpoint tools, email filters, cloud platforms and identity systems all produce events, and most of them are harmless. The analyst’s job is to find the few that matter among the many that do not, before an attacker has time to spread.
What an analyst actually does
Most analysts work in or alongside a security operations center (SOC), whether in-house or provided by a managed service. The core workflow looks like this:
- Triage. An alert arrives from a security information and event management (SIEM) platform or an endpoint detection and response (EDR) tool. The analyst decides quickly whether it is noise, a known benign pattern, or worth investigating.
- Investigation. For real leads, the analyst gathers context: which user and device, what happened before and after, whether the same indicator appears elsewhere, and what threat intelligence says about it.
- Containment. If the activity is malicious, the analyst isolates the device, disables the account or blocks the address, following a predefined playbook where one exists.
- Escalation and communication. Serious incidents go to incident responders and leadership, with a clear summary of what is known and what is not.
- Tuning and learning. After each case, the analyst adjusts detection rules to reduce false positives and closes the gap that allowed the activity.
Senior analysts also do proactive threat hunting: searching for signs of compromise that no rule has flagged yet, based on how known attacker groups operate. That habit of looking for the small deviation that does not fit is what separates a strong analyst from a queue processor.
The role also demands continuous learning. Attack techniques change month to month, so good analysts keep current through certifications such as CompTIA Security+ or GIAC credentials, hands-on practice in simulated environments and capture-the-flag exercises, and frameworks such as MITRE ATT&CK that describe how real attackers operate. Just as important is knowing the business: which systems hold sensitive data, which accounts are privileged, and what normal activity looks like.
Speed is now the deciding factor
Attackers have become much faster at moving from initial access to the rest of a network. We covered this in ultra-fast network intrusions. When the window between a first alert and serious damage is measured in minutes, an alert that sits unread overnight is effectively no alert at all.
This has two consequences. First, coverage matters: someone has to be able to act outside business hours, on weekends and during holidays, which is when many intrusions are timed. Second, automation matters: analysts increasingly rely on security orchestration and automated containment for high-confidence alerts, so that a compromised account is disabled immediately and a person reviews the decision afterward. AI assistants are also helping analysts summarize incidents and query logs in plain language, but the judgment calls, especially on ambiguous alerts and business impact, remain human.
Why analysts are hard to find
ISC2’s 2024 Cybersecurity Workforce Study estimated the global cybersecurity workforce at about 5.5 million people and the workforce gap, the difference between the number of professionals organizations need and the number available, at about 4.8 million, a 19% increase over the prior year. Budget pressure, not just a lack of candidates, was a significant factor.
Analyst roles are also prone to burnout. High alert volumes, false positives and round-the-clock shifts wear people down. Organizations that keep good analysts invest in tuning to reduce noise, automation to remove repetitive work, clear escalation paths and time for training and hunting rather than pure queue work. For people considering the field, our post on why cybersecurity is a future-proof career covers the career path.
In-house, outsourced or hybrid coverage
A full in-house SOC with 24/7 coverage requires several analysts plus tooling, which is out of reach for most small and mid-sized businesses. The practical options are:
- Managed detection and response (MDR). A provider monitors your endpoints and other sources around the clock and takes agreed containment actions. This gives small teams access to experienced analysts without hiring them.
- Hybrid. An internal security lead owns priorities, business context and communication, while a provider handles overnight monitoring and first-line triage.
- In-house SOC. Best for larger or highly regulated organizations that need deep knowledge of their environment and full control of the process.
Whichever model you choose, ask the same questions: who responds at 2 a.m. on a Sunday, what they are authorized to do without calling you, how quickly they must act on a critical alert, and how you will know what they did.
Frequently asked questions
What tools do cybersecurity analysts use?
The core set is a SIEM for collecting and correlating logs, EDR on endpoints, identity and email security consoles, threat intelligence feeds, and a case management or ticketing system. Many teams add orchestration tools to automate routine response steps.
Can AI replace SOC analysts?
AI can speed up triage, summarize incidents and handle routine enrichment, which lets analysts cover more ground. It does not replace judgment on ambiguous cases, business context or accountability for containment decisions that can disrupt operations.
How do we measure whether our monitoring is working?
Track how long it takes to detect and to contain confirmed incidents, the share of alerts that are false positives, and whether coverage includes all critical systems. Periodic tabletop exercises and controlled attack simulations test the whole process.
Make sure someone is watching
Delana Technologies helps businesses build detection and response that fits their size, from selecting and overseeing an MDR provider to incident playbooks, logging strategy and compliance evidence. Learn about our cybersecurity and compliance services, call 239.414.5126 or contact us.
Sources: ISC2 2024 Cybersecurity Workforce Study (October 2024); University of Maryland A. James Clark School of Engineering, “Study: Hackers Attack Every 39 Seconds” (February 2007).