Analyst Capacity Calculator
Work out how many alerts one analyst and one shift can genuinely handle from shift hours, utilisation and handling time.
About Analyst Capacity Calculator
The three levers are visible in the formula and cost very different amounts: hours are fixed, utilisation moves only a few points with better process, and handling time is where automated enrichment produces the large gains — cutting seven minutes to five raises throughput by 40%. Capacity is the number that decides whether a detection actually gets looked at, and it is the honest counterweight when someone proposes enabling another two hundred rules.
Formulas
Analyst Capacity
Alerts per analyst per shift = shift hours × 60 × utilisation ÷ effective handling minutes, where effective handling time = raw handling time × (1 − enrichment saving).
- utilisation
- Share of the shift genuinely spent triaging, 65–75% in practice
- handling time
- Mean minutes from opening an alert to closing or escalating it
- enrichment saving
- Reduction from pre-attached context
Staffing gap
Extra analysts = (arriving alerts − shift capacity) ÷ alerts per analyst, floored at zero.
- shift capacity
- Alerts the whole shift can handle
- arriving alerts
- Alerts presented to that shift
Worked example
With the default values below, Analyst Capacity Calculator returns Alerts per Analyst per Shift of 68.6. Change any input above and every figure here is recalculated in your browser.
Inputs used
- Shift lengthaccepts 4–24 hours
- 8 hours
- Utilisation available for triageaccepts 10–100 %
- 70 %
- Handling time per alertaccepts 0.5–240 minutes
- 7 minutes
- Handling time saved by automated enrichmentaccepts 0–90 %
- 30 %
- Analysts per shiftaccepts 1–200 analysts
- 3 analysts
- Alerts arriving per shiftaccepts 0–100,000 alerts
- 240 alerts
Results
- Alerts per Analyst per Shift
- 68.6 alerts
- Effective Handling Time
- 4.90 minutes/alert
- Shift Capacity
- 205.7 alerts/shift
- Daily Capacity Across All Shifts
- 617 alerts/day
- Capacity HeadroomNegative means the queue outruns the team.
- -16.7%
- Extra Analysts Needed
- 0.50 analysts
Step by step
- 1Values used
- 2Analyst Capacity
- 3Staffing gap
- 4Alerts per Analyst per Shift= 68.6 alerts
- 5Effective Handling Time= 4.90 minutes/alert
- 6Shift Capacity= 205.7 alerts/shift
- 7Daily Capacity Across All Shifts= 617 alerts/day
- 8Capacity Headroom= -16.7
- 9Extra Analysts Needed= 0.50 analysts
Assumptions and limits
- The result is derived only from the 6 inputs listed above. Anything not among them is not part of the calculation.
- In particular, this calculator does not take inflation, tax, fees or charges or compounding frequency into account.
- Figures are rounded for display to 2 decimal places, so totals built from several rounded parts can differ slightly from the unrounded arithmetic.
How these calculators are built and tested is described on the Methodology page. If a figure looks wrong, please report it.
Frequently Asked Questions
How is Analyst Capacity calculated?
Alerts per analyst per shift = shift hours × 60 × utilisation ÷ effective handling minutes, where effective handling time = raw handling time × (1 − enrichment saving). The three levers are visible in the formula and cost very different amounts: hours are fixed, utilisation moves only a few points with better process, and handling time is where automated enrichment produces the large gains — cutting seven minutes to five raises throughput by 40%.
Why does Analyst Capacity matter?
Capacity is the number that decides whether a detection actually gets looked at, and it is the honest counterweight when someone proposes enabling another two hundred rules.
What values do I need to enter?
This calculator takes 6 inputs: Shift length, Utilisation available for triage, Handling time per alert, Handling time saved by automated enrichment, Analysts per shift, Alerts arriving per shift. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.
Why does enrichment beat hiring?
Because it multiplies rather than adds. Removing two minutes of manual lookup from every alert raises the whole team's throughput at once, whereas a new analyst adds one shift's worth of capacity and costs six figures a year.
Is a fixed handling time realistic?
It is an average over a skewed distribution — most alerts close in two minutes and a few consume an hour. Use it for planning, and if the tail matters to you, run the calculation separately per alert class.