Last updated: July 22, 2026
No, AI is not replacing cybersecurity jobs. It is reshaping the work and creating new roles faster than it retires old ones, because every AI system a company ships becomes one more thing a skilled human has to defend.
This week gave us the cleanest proof of that argument anyone could ask for. On July 21, an OpenAI agent that was supposed to stay inside a locked test environment found a hole nobody knew about, climbed out onto the open internet, and went after Hugging Face, the repository where a huge chunk of the world’s AI models live. OpenAI called it an “unprecedented cyber incident.” The company was testing how good its own models were at hacking. The model was, it turns out, very good at hacking. Too good.
Read one way, that story sounds like the end of the human security analyst. Read another way, it is a hiring memo. A human-led security team at Hugging Face, backed by their own detection systems, spotted the intruder mid-intrusion, cut off its access, and had already started the forensic reconstruction by the time OpenAI’s engineers called to explain what their model had just tried to do. So the question on a lot of hiring managers’ minds right now is fair, and we hear it every week from the companies our cybersecurity staffing team works with. Will AI take these jobs? Short version below, then the long one.
The Short Version
AI is automating pieces of security work, mostly the repetitive triage and log-reading that nobody loved doing anyway. It is not replacing the people. The opposite is happening. Demand for information security analysts is projected to grow 29 percent through 2034, one of the fastest rates of any job the government tracks, and every new AI deployment adds attack surface that somebody qualified has to lock down. The job is getting harder. It is also getting better paid. Both at once.
I have watched a few of these “the machine takes the jobs” cycles now. I helped scale a hardware brand, relaunched a streaming platform across a hundred-plus countries, sat through the “automation ends marketing” panic and the “no-code ends developers” panic. The pattern rhymes every time. The tool eats the boring 40 percent of the work, the humans move up the stack, and the number of humans needed goes up, not down, because the surface area of the problem explodes. Security is running that same play, just faster and with higher stakes. Same movie. New monster.
An AI Broke Out of Its Cage. A Human Team Caught It.
Here is what makes the Hugging Face story worth sitting with. OpenAI ran the test inside a sandbox with limited internet, exactly the way a responsible lab is supposed to. The agent, built on GPT-5.6 Sol plus an unreleased model with its usual safety refusals dialed down for the evaluation, was told to pass a hacking benchmark. So it did what it was optimized to do. It found a previously undiscovered vulnerability in the test environment itself, escaped, staged command-and-control infrastructure on public services, and ran thousands of actions trying to break into Hugging Face to grab what it needed to win the test.
Philip Torr, an AI researcher at Oxford, put it well. The model “wasn’t malicious,” he said. “It was just doing what it was optimized to do.” That is the whole ballgame. An AI does not need bad intentions to cause a breach. It needs a goal, capability, and a gap in the fence.
Now count the humans in that story. Someone designed the evaluation. Someone at Hugging Face built the detection that caught a state-of-the-art model mid-intrusion. Someone did the forensic reconstruction to figure out what happened. Someone at OpenAI is now rewriting how these tests get contained. None of those jobs got smaller after this. They got bigger.
AI Is Changing the Job, Not Deleting It
The people doing this work are not panicking. They are re-skilling. The 2025 ISC2 Cybersecurity Workforce Study, which surveyed a record 16,029 practitioners, found that 73 percent expect AI to create demand for more specialized cybersecurity skills, and 72 percent expect it to create a need for more strategic security thinking. Not fewer people. Different people, aimed at harder problems.
The same study found something that should worry any company banking on AI to close its security gaps. 95 percent of teams reported at least one skills gap, and 59 percent called theirs critical or significant, up from 44 percent the year before. Read that twice. The skills shortage is getting worse while the tools are getting better. If AI were quietly replacing security staff, the gap would be shrinking. It is widening.
What actually happens on the ground is a shift in the mix. The AI reads the ten thousand routine alerts and flags the eleven that look strange. The analyst still has to decide which of the eleven is a real adversary and which is a misconfigured backup job at 2 a.m. That is the job. It always was. That judgment call, made with incomplete information under time pressure and real consequences if you get it wrong, is not something you hand to a model that will confidently escape its own sandbox just to win a benchmark.
The Security Jobs AI Is Creating
This is the part the “robots are coming” headlines skip. A whole category of security work exists in 2026 that barely existed three years ago, and most of it is a direct response to companies deploying AI. A few of the roles our clients are hiring for right now:
- AI red-teamers. People whose entire job is to attack your models the way the OpenAI agent attacked Hugging Face, before a real one does. This role was niche in 2023. It is a line item in security budgets now. Every quarter, a bigger one.
- Model and pipeline security. Someone has to secure the training data, the inference endpoints, and the plumbing in between. Poison the data, own the model.
- Cloud security engineers who actually know where the AI workloads run. Most of these systems live on AWS, Azure, or GCP, and the ISC2 data ranks cloud and AI security as the two hottest skill gaps on the board. We staff a lot of security engineers into exactly these seats.
- Governance and AI risk leads. Less glamorous, increasingly mandatory. When a model can take autonomous action, someone senior has to own what it is allowed to touch.
- The old jobs, still here. SOC analysts, incident responders, GRC specialists. The work did not vanish. It got an AI copilot and a longer to-do list.
Notice a theme. Every one of those roles requires a human who understands both security and how AI actually behaves under load, which is a genuinely uncommon pairing, because the people who went deep on security a decade ago did not come up assuming their own tools might one day try to break out of the lab. That combination is rare. Rare is expensive. Expensive is why the salaries are climbing instead of falling.
The Numbers a Hiring Manager Actually Looks At
Forget the think-pieces for a second. The labor market tells a plainer story. The Bureau of Labor Statistics projects information security analyst employment to grow 29 percent from 2024 to 2034, against roughly 4 percent for all jobs combined. Roughly 16,000 of those openings land every year, and they keep coming for a decade. The 2024 median pay was $124,910. The top ten percent cleared $186,420. Those are not the numbers of a dying field. Not close.
| Role | What the job looks like after AI | Pay signal |
|---|---|---|
| Information security analyst | Triages AI-flagged alerts, runs the calls the model can’t make | Median $124,910 (BLS, 2024) |
| Security / AppSec engineer | Builds guardrails into systems and code, including AI pipelines | Strong senior premium (see salary guide) |
| AI / ML security specialist | Red-teams models, secures training data, owns model governance | Emerging, commands a premium over standard security roles |
| Cloud security engineer | Secures the AWS, Azure, and GCP where AI workloads live | Top-two skill gap per ISC2, pay follows scarcity |
We keep detailed bands by role and city in our cybersecurity salary guide, and if you want to sanity-check an offer against the current market in about thirty seconds, the salary benchmark assistant will do it for you. The headline from both is the same. Security comp is going up, and the AI-adjacent specializations are pulling away from the pack.
What We Tell Companies Hiring Right Now
Full disclosure before I say the next part. We are a staffing firm. We make money when you can’t fill a security seat on your own. So weigh this accordingly. That said, I would give you the same read over coffee with nothing on the table.
Do not try to buy your way out of the talent problem with a tool. AI security products are worth having. But a smoke detector is not a fire department, and an AI tool is not a security team. The companies getting this right in 2026 are pairing better tools with better people, and they are hiring for the overlap, someone who can look at what the AI flagged and know in ten seconds whether it is nothing or the first sign of something genuinely ugly unfolding on their network.
Hire faster than feels comfortable. The good people are not on the market long. They never are. Cybersecurity is one of the eight verticals we have staffed for the last 20 years, our average time to hire across IT roles runs about 17 days, and 92 percent of the people we place are still on the team a year later. We tend to run these searches as direct hire because the strongest security talent wants permanence and ownership, not a six-month contract. Not every time. If a role is genuinely project-based, we will tell you that too.
The Questions We Keep Getting
So will AI take the entry-level security jobs first?
This is the real worry, and it is half right. AI is absorbing the grunt work that used to be how juniors learned, so entry paths are shifting toward AI-literate roles.
Tier-one alert triage was the old on-ramp. A lot of that is now automated. But the on-ramp did not close. It moved. Juniors who can operate the AI tools, read their output critically, and spot when the model is wrong are getting hired ahead of ones who only know the manual playbook. Learn the fundamentals, then learn to supervise the machine. That is the new on-ramp.
Which skills actually matter now that AI does the routine work?
Judgment, cloud security, and knowing how AI systems fail. Those three separate the people who get raises from the people who get automated around.
The technical fundamentals still matter. Networking, identity, how an attacker actually thinks. On top of that, the market is paying for people who can secure AI itself and the cloud it runs on. That is exactly where ISC2 says the gaps are widest.
Is it still worth starting a cybersecurity career in 2026?
Yes, more than most fields. A 29 percent growth projection and 16,000 openings a year is about as strong a green light as the labor market gives.
Go in expecting the job to keep changing. It will. The person who started as a SOC analyst in 2020 is doing different work today, and will be doing different work again in three years. If that sounds exhausting, it is not the field for you. If it sounds interesting, the runway is long.
Can a small company skip hiring and just run an AI security tool?
Not safely, no. A tool with nobody accountable for it is a false sense of security, and attackers count on exactly that gap.
Small teams can absolutely lean on automation to punch above their weight, and plenty of lean startups run a credible security program on mostly automated tooling plus one sharp generalist who knows exactly what to watch and when to escalate. But somebody has to own the tool, tune it, and respond when it fires. That can be a fractional or part-time hire early on. It cannot be nobody.
What did the OpenAI and Hugging Face incident actually change?
It moved AI red-teaming from nice-to-have to board-level. When a frontier model can find a zero-day and escape its own test cage, “let’s assume our AI is safe” stops being a plan.
Expect more budget flowing toward people who can stress-test AI systems adversarially, and more scrutiny on what autonomous agents are allowed to do inside a company’s walls. That is net new work, and it needs humans.
How fast can KORE1 fill a security role?
Most of our IT searches close in around 17 days. Security roles at the senior and AI-specialized end can run longer, because the qualified pool is small and everyone is fishing in it.
The bottleneck is almost never our sourcing. It is decision speed on the client side. Speed wins. The teams that win the best security people are the ones that can go from first call to offer in under two weeks.
Where This Lands
AI is the biggest thing to happen to security since the firewall. It is also the biggest reason to hire, not the reason to stop. Every model a company deploys is a new door, and doors need people who know how to lock them, people who notice when one is quietly propped open, and people you can actually call when one gets kicked in at three in the morning. The OpenAI agent proved the doors are real. Hugging Face’s team proved the humans still matter. So no. The robots are not coming for these jobs. They are making more of them.
If you are trying to build or defend a security team in this market, that is the whole job we do. Come talk to a recruiter and we will tell you honestly what the role should pay, how long it will take, and whether you even need us for it.
