A mid-market security team of 8 people managing roughly 400 hours of weekly work has only 320 hours available, leaving an 80+ hour gap each week. Germany had 149,000 unfilled IT positions in 2025.
The Weekly Task Map
| Role | Hours/Week |
|---|---|
| CISO | 36 |
| GRC Manager | 42 |
| Security Architect | 42 |
| SOC Analyst Senior (L2/L3) | 45 |
| SOC Analyst Junior (L1/L2) | 48 |
| AppSec Engineer | 42 |
| IT Security Admin | 46 |
| Compliance Officer | 41 |
| Total + 25% overhead | 422 |
The AI Agent Mapping
Fully automatable
AI-assisted (saved)
Human required
Fully Automatable (76h/week)
- Alert triage & classification (15h)
- Risk register updates (5h)
- Dashboard monitoring (8h)
- IOC lookup & enrichment (5h)
- SAST/DAST scan management (5h)
- Certificate & secret management (4h)
- Regulatory change monitoring (4h)
- Asset inventory maintenance (4h)
- KPI/KRI reporting (4h)
- Compliance evidence collection (4h)
- Vulnerability scan execution (4h)
- Phishing email analysis (4h)
- Log source health checks (3h)
- Exception & waiver tracking (3h)
- Vendor questionnaire distribution (2h)
- Policy review scheduling (2h)
Human Required (131h/week)
- Security strategy & roadmap
- Stakeholder meetings & negotiations
- Threat modeling for new projects
- Forensic analysis (chain of custody)
- Proactive threat hunting
- Developer training & support
- GDPR/DSGVO coordination
- Crisis leadership & incident command
The Numbers That Matter
| Scenario | Demand/Capacity | Load |
|---|---|---|
| Before AI agents | 422 / 320 | 132% |
| After AI agents | 286 / 320 | 89% |
Implementation: 4 Phases
Phase 1 (Weeks 1–2): GRC & Compliance Agents
45h/week recovered. Risk register, evidence collection, KPI reporting, regulatory monitoring. GRC Manager recovers 15+ hours/week.
Phase 2 (Months 1–2): Vendor Risk & AI Governance
25h/week recovered. Questionnaire distribution, third-party scoring, compliance monitoring.
Phase 3 (Months 3–4): Vulnerability & Incident Response
40h/week recovered. Alert triage, IOC enrichment, phishing analysis, patch prioritisation.
Phase 4 (Month 6+): Full Agent Factory
26h/week recovered. All automatable tasks operational. Continuous improvement cycle running.
Need help implementing this?
First strategy session is complimentary. We typically respond within 4 hours.