Information security analysts: AI exposure and career outlook
Information security analysts (SOC 15-1212) sit at the 89th percentile for measured AI exposure among the 342 occupations tracked here, measured from a composite of Microsoft Research and Anthropic Economic Index telemetry. An estimated 59% of tasks are already automated and 77% are being reshaped rather than replaced — both modelled figures, not direct measurements. Of the Claude usage observed in this occupation, 76% follows an automation pattern and 24% an augmentation pattern, which places it in the Displacement risk group: the routine layer of this work is being automated outright. The judgment layer is not, so the move is to own more of it. In Canada the role maps to NOC 21222 (Information systems specialists), and ESDC's COPS 2024–2033 outlook for that unit group is balance.
Figures last updated 2026-06. Every number on this page is labelled measured or modelled; where a source has no coverage for this occupation, it says so rather than showing a zero.
Key facts
- SOC code
- 15-1212
- Canada NOC 2021
- 21222
- TEER level
- Not available
- COPS outlook
- Balance
What the measurements actually say
Two of three independent studies measure AI exposure for this occupation directly; the other reports no coverage for it. The two percentages below them are ours, modelled from those measurements.
| Metric | Value | Provenance |
|---|---|---|
| AI applicability | 22% | Measured — Microsoft Research, from 200,000 Copilot conversations classified against O*NET work activities. |
| Observed AI usage | 49% | Measured — Anthropic Economic Index, share of tasks observed being performed with Claude (CC-BY 4.0). |
| Academic AI exposure | Not available | Not covered by the Felten AIOE table. |
| Automation-pattern usage | 76% | Measured — the share of observed Claude usage in this occupation where the task is handed over rather than iterated on (Anthropic Economic Index). |
| Augmentation-pattern usage | 24% | Measured — the complement of the row above; the two sum to 100% by construction. This is the pattern where the person stays in the loop. |
| Estimated task automation (modelled) | 59% | Modelled from this occupation's measured telemetry composite, mapped through anchors calibrated to Anthropic's published aggregate findings. Our estimate, not per-occupation telemetry. |
| Estimated task reshaping (modelled) | 77% | Share of tasks where AI acts as co-pilot rather than replacement. Modelled from the measured telemetry composite, calibrated to BCG's published aggregate reshaping rates. Our estimate. |
This skill domain faces significant AI substitution. The opportunity is in pivoting to AI orchestration and higher-order human judgment within the domain.
In Canada: NOC 21222
Information security analysts map to NOC 21222 — Information systems specialists. ESDC's COPS 2024–2033 projection for this unit group is Balance.
Mapped via Statistics Canada's official SOC 2018 → NOC 2016 → NOC 2021 correspondence tables (closest match of several correspondence candidates). TEER is the second digit of the NOC code, so it is only as certain as the code is. Several correspondence candidates were available here and we took the closest by title, so we do not report a TEER level for it.
What this job actually involves
These are the O*NET task statements for Information security analysts— the work itself, as reported by people doing the job — grouped by the work activity each task belongs to. Showing 11 of 11, core tasks first.
The exposure figures above are for the occupation as a whole. We do not have a per-task measurement: no published dataset tells us which of these specific tasks AI is doing. Read this as what the job is made of, not as a ranking of what is at risk.
3 of these 11statements do carry one measured signal: Anthropic publishes, per O*NET task, how much of the observed Claude usage on it looked like automation rather than iteration. Those are marked below. It still says how people use AI on that task, not how much of it AI can do — and the unmarked statements carry nothing rather than inheriting the occupation's figure.
Microsoft's applicability score was itself produced by classifying Copilot conversations against the O*NET work-activity catalogue — the same catalogue these groups come from. The published file gives one number per occupation, not one per activity, so we can tell you that 22% of this occupation's work activities are covered by observed AI usage, but not which ones.
Working with Computers · 4 tasks
Encrypt data transmissions and erect firewalls to conceal confidential information as it is being transmitted and to keep out tainted digital transfers.
Core task · Importance 4.2/5 (O*NET) · 87% of observed AI use on this task is automation-pattern
Modify computer security files to incorporate new software, correct errors, or change individual access status.
Core task · Importance 4.1/5 (O*NET) · 90% of observed AI use on this task is automation-pattern
Review violations of computer security procedures and discuss procedures with violators to ensure violations are not repeated.
Core task · Importance 4.0/5 (O*NET)
Confer with users to discuss issues such as computer data access needs, security violations, and programming changes.
Core task · Importance 3.9/5 (O*NET) · 79% of observed AI use on this task is automation-pattern
Monitoring Processes, Materials, or Surroundings · 1 task
Monitor use of data files and regulate access to safeguard information in computer files.
Core task · Importance 3.9/5 (O*NET)
Inspecting Equipment, Structures, or Materials · 1 task
Perform risk assessments and execute tests of data processing system to ensure functioning of data processing activities and security measures.
Core task · Importance 4.1/5 (O*NET)
Updating and Using Relevant Knowledge · 1 task
Monitor current reports of computer viruses to determine when to update virus protection systems.
Core task · Importance 4.2/5 (O*NET)
Drafting, Laying Out, and Specifying Technical Devices, Parts, and Equipment · 1 task
Develop plans to safeguard computer files against accidental or unauthorized modification, destruction, or disclosure and to meet emergency data processing needs.
Core task · Importance 4.4/5 (O*NET)
Documenting/Recording Information · 1 task
Document computer security and emergency measures policies, procedures, and tests.
Core task · Importance 3.9/5 (O*NET)
Training and Teaching Others · 1 task
Train users and promote security awareness to ensure system security and to improve server and network efficiency.
Core task · Importance 3.8/5 (O*NET)
Guiding, Directing, and Motivating Subordinates · 1 task
Coordinate implementation of computer system plan with establishment personnel and outside vendors.
Core task · Importance 3.9/5 (O*NET)
Task statements and work activities from the O*NET Database by the U.S. Department of Labor, Employment and Training Administration (USDOL/ETA), used under CC BY 4.0. O*NET® is a trademark of USDOL/ETA. USDOL/ETA has not reviewed or approved this material.
That's the average. Is this you?
Everything above describes Information security analysts as a whole. Three questions, and nothing is stored or sent.
Where are you in your career?
What does your week mostly look like?
Is your employer deploying AI?
Where the leverage is
Transition to high-value advisory, complex case analysis, or AI system oversight. The pivot is to move from routine execution to AI orchestration and quality assurance.
Cognitive, information-based tasks are highly exposed. Entry-level displacement pressure is high, necessitating transition to advisory and governance roles.
Upskill in AI prompt engineering, model validation, and governance. Focus on transition playbooks to pivot toward high-value advisory services.
This guidance is written per exposure band — three texts across all 342 occupations, framed on the ILO's transformation-versus-displacement distinction. It is editorial guidance for the high risk band, not an occupation-specific research finding about information security analysts.
Sources for this occupation
Only the sources that hold data for information security analysts are listed. A study that does not cover this occupation is not cited here.
- Microsoft Research — Working with AI (Tomlinson et al., arXiv:2507.07935): Measured AI applicability, from 200,000 anonymised Copilot conversations classified against O*NET work activities.
- Anthropic Economic Index: Measured observed AI usage per occupation, from Anthropic's open per-SOC dataset (CC-BY 4.0).
- O*NET Database 31.0 (USDOL/ETA), CC BY 4.0: The occupation's task statements and work activities, verbatim. Joined on SOC 2018 with no crosswalk — O*NET-SOC is built on SOC — and carrying no claim about which tasks AI touches.
- Anthropic Economic Index — collaboration split (release 2026-06-26, CC-BY 4.0): Measured share of observed Claude usage following an automation rather than an augmentation pattern. This is the second axis of the grouping above.
- Statistics Canada NOC 2021 concordance: Official SOC 2018 → NOC 2016 V1.3 → NOC 2021 V1.0 correspondence tables. TEER is the second digit of the resolved code, so we report it only where the concordance gave a single candidate.
- ESDC COPS 2024–2033: Projected labour-market assessment per NOC 2021 unit group, from the Canadian Occupational Projection System open dataset.
- BCG — AI Will Reshape More Jobs Than It Replaces (April 3, 2026): Published aggregate reshaping rates, used to calibrate our modelled percentages. The per-occupation figures here are our estimates, not BCG's data.
Related occupations
Other roles in Technology.
This is the picture for the role. What about your skills?
These numbers describe an occupation, not a person. Map your own skills against them, see which pathways stay open, and plan the transition you actually want.