Quantify analyst alert fatigue from queue depth, false-positive rate and shift utilisation, and estimate alerts left untouched.
The index blends three independent drivers of fatigue: whether the queue physically fits in the shift, how much of the work turns out to be pointless, and how frequently interruptions arrive. Load is halved before weighting so that 200% of capacity, not 100%, maxes out that component. Fatigue is measurable and it predicts missed intrusions: when the queue exceeds capacity, analysts triage by closing the cheapest alerts first, which is exactly the behaviour a low-and-slow attacker relies on.
Alert Fatigue
Queue load = alerts per analyst × minutes per alert ÷ (shift hours × 60 × utilisation). Fatigue index = 0.45 × (load ÷ 2) + 0.35 × false-positive rate + 0.2 × scaled hourly arrival rate.
Unworked backlog
Unworked alerts = (required minutes − available minutes) ÷ minutes per alert, floored at zero.
Queue load = alerts per analyst × minutes per alert ÷ (shift hours × 60 × utilisation). Fatigue index = 0.45 × (load ÷ 2) + 0.35 × false-positive rate + 0.2 × scaled hourly arrival rate. The index blends three independent drivers of fatigue: whether the queue physically fits in the shift, how much of the work turns out to be pointless, and how frequently interruptions arrive. Load is halved before weighting so that 200% of capacity, not 100%, maxes out that component.
Fatigue is measurable and it predicts missed intrusions: when the queue exceeds capacity, analysts triage by closing the cheapest alerts first, which is exactly the behaviour a low-and-slow attacker relies on.
This calculator takes 7 inputs: Alerts arriving per shift, Analysts on the shift, Shift length, Average minutes to triage an alert, False-positive rate of the alert stream, Alerts closed automatically by SOAR, Realistic triage utilisation of the shift. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.
No analyst triages for eight uninterrupted hours. Shift handover, case documentation, escalation calls, training and breaks reliably consume 25–35%, so a plan built on 100% utilisation is short-staffed by a third on day one.
Not always, but it is usually the cheapest thing to fix. If load is already above capacity, tuning alone will not save you — the arithmetic says you need automation or another seat as well.