The Analyst at Work: Fatigue, On-Call and Being Managed by Metrics

All courses / AI Blue / Module 5 / Chapter 21

Learning objectives

After the lesson the participant can:

• Describe what the cited studies of SOC analysts measured, in whom and by what method, and name the gaps in the evidence
• Explain how queue pace, individual scores and activity logging manage the analyst
• Evaluate the case for concern and the case for calm on AI and the analyst's load
• Design a quarterly fatigue and on-call review with aggregate figures and five questions

Key concepts

Review as the new queue

A queue of machine conclusions that are nearly always right resembles the alarm queue the studies describe: many items, mostly benign, each needing a check that feels unnecessary.

Queue pace as a direction decision

The cap on open proposals, the routing thresholds and the share of work that goes to a person are set in a policy. That policy is a design decision about the analyst's pace, not a tuning parameter.

A SOC tool is a tool about the SOC

An agreement with employee representatives covers the platform analysts use, not only software bought to monitor people, because SOC tooling logs queries, approvals and time to approval.

Right to stop for reviewers

Any reviewer may pause agent proposals for their shift when the cap is reached or the queue outruns attention, and the pause is not counted against them.

Protected time

A fixed block each week, half a day by default, for engineering, hunting or practice. The SOC lead cancels it only by recording the reason in the quarterly review.

Interactive exercises

Do them here and get feedback at once. Choose a card and then where it belongs, or drag it.

Teaching plan

Discussion

1. The book's two organisations are worked examples that show a mechanism and never how common it is. How should a teacher or a manager use such examples without turning them into evidence?
2. Karin Lund at Nordvik Region carried seven duties until her time budget was written down. Where in your team does one person silently hold several of the roles this book describes?
3. Both sides of the debate agree that review volume must be capped so the system gives way before the person does. What would the cap cost your organisation, and who would have to accept that cost?

Written exercise

Self-test

Choose an answer to see whether it is right, or open the answer below each question.

1. What does the chapter say about evidence on the effect of AI on SOC analysts' fatigue?

   1. A large survey from 2025 shows that AI halves analyst burnout
   2. Two controlled studies show that AI review increases fatigue
   3. The works councils have published measurements of fatigue from Hansa Mutual's group SOC
   4. No study the book relies on measures whether reviewing AI conclusions raises or lowers fatigue
   Show the answer

   D. No study the book relies on measures whether reviewing AI conclusions raises or lowers fatigue
   The bibliography holds no recent primary study of analyst burnout and none measuring the effect of AI on a SOC's load. The effect is labelled expected to vary with team design.

2. Why can Nordvik Region not apply the group size of five to subteams when reporting figures?

   1. Because its union has refused all measurement of the team
   2. Because with six analysts any subteam would be small enough to identify a person
   3. Because the provider owns all the data about the analysts
   4. Because national law forbids aggregate reporting about staff in public authorities
   Show the answer

   B. Because with six analysts any subteam would be small enough to identify a person
   With six people, the group size of five cannot be applied to subteams, so the Region reports figures for the team as a whole only.

3. Which label does the verdict give to the claim that AI will end alert fatigue?

   1. Speculation, like the opposite claim that it makes the work unbearable
   2. Observable, on the evidence of the qualitative studies of alarm validation
   3. Expected, on the trend of closure by class
   4. A design assumption that the team tests by drill
   Show the answer

   A. Speculation, like the opposite claim that it makes the work unbearable
   The verdict labels present fatigue observable, variation by team design expected, and both the claim that AI ends alert fatigue and its opposite speculation.