Why Incident Response Demand Will Grow Faster than Expected 

This article is part of an ongoing series from Sophos frontline security operations specialists, sharing the expertise they use to strengthen our industry-leading Managed Detection and Response (MDR) service and defend customers against evolving AI-era threats.

A 20% growth forecast for cybersecurity talent sounds significant. I believe it understates what we are going to see in Incident Response. 

The U.S. Bureau of Labor Statistics projects 21% employment growth for information security analysts between 2025 and 2035. That projection applies to the broader information security profession, not specifically to Incident Response. Still, it gives us a useful benchmark. 

Based on what I am seeing and hearing across the industry, Incident Response demand could grow much faster. 

I attend security conferences where leaders from other firms openly say they are hiring Incident Response analysts. Our partners tell us they are hiring. DFIR firms we know are asking whether they can use Sophos to provide overflow support when their teams reach capacity. 

These are not isolated conversations. They are consistent signals from across the security ecosystem. 

Everyone is looking for more Incident Response capacity.

AI is giving attackers greater scale 

AI has changed what threat actors can accomplish with the people and resources they already have. 

Attackers still rely on many of the same techniques. They steal credentials, exploit vulnerabilities, use social engineering, move laterally, and target critical systems. What is changing is the speed and scale at which they can do it. 

The Sophos AI Security 2026 Report found that AI is compressing attack timelines rather than creating entirely new categories of attacks. It is enabling both attackers and defenders to move faster through familiar operations. 

That distinction is important. 

We do not need to wait for a fully autonomous AI attacker before treating this as a serious capacity problem. If AI helps an attacker research more targets, create more convincing lures, analyze more code, or identify more opportunities, the attacker has already become more productive. 

The 2026 Sophos Active Adversary Report describes the effect as more speed, volume, and noise in the threat landscape, even while attackers continue to use many of the same tools and techniques. 

Attackers have found a way to scale their operations. Most defenders have not. 

Organizations cannot patch at attacker speed 

This is especially visible in vulnerability management. 

The advice to “patch faster” is correct, but it does not reflect the full operational challenge. A security team cannot simply install every update as soon as it becomes available. 

Organizations need to know which systems are affected. They need to understand business criticality, test changes, coordinate maintenance windows, manage legacy technology, and confirm that remediation has worked. In some environments, a rushed update can create a significant operational outage. 

AI is accelerating vulnerability discovery and shortening the path between disclosure and exploitation. This raises the pressure on security teams that are already managing complex environments with limited resources. 

Many organizations simply do not have enough people to patch every system as quickly as the current threat environment requires. 

That does not necessarily mean they have a bad security program. It means their available capacity has not grown at the same rate as the problem. 

The gap between attacker speed and defender capacity is getting wider.

The challenge goes beyond patching

Patching is only part of the issue. 

Analysis of 661 incidents in the 2026 Sophos Active Adversary Report found that 67% of intrusions began with compromised credentials or other identity-related tactics. Attackers reached Active Directory in an average of three hours and 24 minutes. 

That leaves very little room for delay. 

Organizations need to patch vulnerable systems, strengthen identity controls, retain the right telemetry, monitor suspicious behavior, and provide coverage outside normal business hours. They also need a tested plan for what happens when those controls fail. 

At some point, almost every organization will need help answering four basic questions: 

• What happened?
• How far did the attacker get?
• What do we need to contain?
• What do we need to do next?

Those questions require experienced Incident Response professionals. 

Technology helps, but experience still matters 

AI and automation will make Incident Response teams more productive. 

They can help responders collect evidence, correlate information, summarize activity, identify patterns, and focus their attention on the areas that matter most. We should embrace those capabilities. 

But a serious security incident is not simply a technical investigation. 

It requires judgment. Responders must make decisions with incomplete information while coordinating with security, IT, legal teams, insurers, executives, and sometimes regulators or law enforcement. 

They also need to communicate clearly under pressure. They must separate what is known from what is suspected, explain the business risk, and help leaders make decisions that may have significant operational consequences. 

Technology can support that work. It does not eliminate the need for experienced people. 

Those people take time to develop.

Twenty percent may not be enough 

No one can forecast the exact number of Incident Response professionals the industry will need. 

But workforce plans should account for the signals we can already see. 

Security providers are hiring. Partners are expanding their teams. DFIR firms are looking for overflow capacity. Organizations are facing shorter attack timelines while struggling to patch and protect increasingly complex environments. 

At the same time, AI is helping threat actors do more with the resources they already have. 

Taken together, I believe these indicators point to Incident Response demand growing faster than the commonly cited 20% range. 

The industry needs to prepare for that now. 

We need to develop new analysts, create stronger career paths, retain experienced responders, and build better partnerships between internal security teams and external providers. We also need to use AI and automation to amplify the expertise we have, rather than assuming technology will remove the need for it.

Attackers are increasing their capacity.
Defenders must do the same. 

Sources

• U.S. Bureau of Labor Statistics, “Information Security Analysts,” Occupational Outlook Handbook (2025–2035 outlook). View source
• Sophos, “Sophos AI Security 2026 Report.” View source
• Sophos, “Nowhere, man: The 2026 Active Adversary Report.” View source
• Sophos, “Stopping real-world attacks: Lessons for business leaders from the 2026 cyber frontline.” View source