Work out how many alerts one analyst and one shift can genuinely handle from shift hours, utilisation and handling time.
The three levers are visible in the formula and cost very different amounts: hours are fixed, utilisation moves only a few points with better process, and handling time is where automated enrichment produces the large gains — cutting seven minutes to five raises throughput by 40%. Capacity is the number that decides whether a detection actually gets looked at, and it is the honest counterweight when someone proposes enabling another two hundred rules.
Analyst Capacity
Alerts per analyst per shift = shift hours × 60 × utilisation ÷ effective handling minutes, where effective handling time = raw handling time × (1 − enrichment saving).
Staffing gap
Extra analysts = (arriving alerts − shift capacity) ÷ alerts per analyst, floored at zero.
Alerts per analyst per shift = shift hours × 60 × utilisation ÷ effective handling minutes, where effective handling time = raw handling time × (1 − enrichment saving). The three levers are visible in the formula and cost very different amounts: hours are fixed, utilisation moves only a few points with better process, and handling time is where automated enrichment produces the large gains — cutting seven minutes to five raises throughput by 40%.
Capacity is the number that decides whether a detection actually gets looked at, and it is the honest counterweight when someone proposes enabling another two hundred rules.
This calculator takes 6 inputs: Shift length, Utilisation available for triage, Handling time per alert, Handling time saved by automated enrichment, Analysts per shift, Alerts arriving per shift. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.
Because it multiplies rather than adds. Removing two minutes of manual lookup from every alert raises the whole team's throughput at once, whereas a new analyst adds one shift's worth of capacity and costs six figures a year.
It is an average over a skewed distribution — most alerts close in two minutes and a few consume an hour. Use it for planning, and if the tail matters to you, run the calculation separately per alert class.