Work out alert triage capacity instantly with clear inputs, formula shown and shareable results.
Triage demand is alert volume times handling time, and capacity is analysts times genuinely productive hours across the shifts covering a day. Utilisation above roughly 80 percent means queueing, and above 100 percent means alerts are silently dropped or closed without investigation — the failure mode that turns a SOC into a compliance exercise.
Triage capacity
demand hours = alerts x minutes / 60; capacity = analysts x productive hours x shifts per day; utilisation = demand / capacity
Around 60 to 70 percent for triage, leaving room for incident surges and for proactive work such as threat hunting and detection tuning.
Almost always. Tuning out false positives and grouping related alerts into incidents reduces demand permanently, while headcount scales cost linearly.