Skip to content
ENExplore Calculators

Alert Triage Capacity Calculator

Work out alert triage capacity instantly with clear inputs, formula shown and shareable results.

About Alert Triage Capacity Calculator

Triage demand is alert volume times handling time, and capacity is analysts times genuinely productive hours across the shifts covering a day. Utilisation above roughly 80 percent means queueing, and above 100 percent means alerts are silently dropped or closed without investigation — the failure mode that turns a SOC into a compliance exercise.

Formula

Triage capacity

demand hours = alerts x minutes / 60; capacity = analysts x productive hours x shifts per day; utilisation = demand / capacity

Worked example

With the default values below, Alert Triage Capacity Calculator returns Triage capacity utilisation of 222.2%. Change any input above and every figure here is recalculated in your browser.

Inputs used

Alerts per dayminimum 1
1,200
Average triage time per alertminimum 0.1 min
8 min
Analysts on shiftminimum 1
4
Productive hours per analyst per shiftaccepts 0.5–12 h
6 h

Results

Triage capacity utilisation
222.2%
Analyst hours of demand per day
160.0 h
Analyst hours available per day
72.0 h
Alerts left untriaged per day
660

Step by step

  1. 1Values used
  2. 2Triage capacity
  3. 3Triage capacity utilisation= 222.2
  4. 4Analyst hours of demand per day= 160.0 h
  5. 5Analyst hours available per day= 72.0 h
  6. 6Alerts left untriaged per day= 660

Assumptions and limits

  • The result is derived only from the 4 inputs listed above. Anything not among them is not part of the calculation.
  • In particular, this calculator does not take inflation, tax, fees or charges or compounding frequency into account.
  • Figures are rounded for display to 1 decimal place, so totals built from several rounded parts can differ slightly from the unrounded arithmetic.

How these calculators are built and tested is described on the Methodology page. If a figure looks wrong, please report it.

Frequently Asked Questions

What utilisation should a SOC target?

Around 60 to 70 percent for triage, leaving room for incident surges and for proactive work such as threat hunting and detection tuning.

Is reducing alert volume better than adding analysts?

Almost always. Tuning out false positives and grouping related alerts into incidents reduces demand permanently, while headcount scales cost linearly.

Related Calculators

Alert Triage Capacity Calculator | Calcrivo