Compare incoming SOC case volume with investigative capacity, and see how fast the backlog grows or clears.
The calculation is deliberately a queueing sanity check rather than a full model: if arrivals exceed service capacity, the backlog grows without limit, and no amount of process improvement changes that. Utilisation above roughly 90% also means normal variation alone will produce a permanent queue. A SOC running at 100% utilisation has no capacity for the one incident that matters, and the backlog figure is what turns 'we are busy' into a staffing decision a finance team can act on.
Case Load
Capacity (cases/week) = analysts × investigative hours per week ÷ hours per case. Utilisation = cases opened ÷ capacity.
Backlog burn-down
Weeks to clear backlog = open cases ÷ spare weekly capacity; when demand exceeds capacity the backlog never clears.
Capacity (cases/week) = analysts × investigative hours per week ÷ hours per case. Utilisation = cases opened ÷ capacity. The calculation is deliberately a queueing sanity check rather than a full model: if arrivals exceed service capacity, the backlog grows without limit, and no amount of process improvement changes that. Utilisation above roughly 90% also means normal variation alone will produce a permanent queue.
A SOC running at 100% utilisation has no capacity for the one incident that matters, and the backlog figure is what turns 'we are busy' into a staffing decision a finance team can act on.
This calculator takes 6 inputs: Cases opened per week, Investigating analysts, Mean investigation hours per case, Investigative hours per analyst per week, Cases already open, Cases escalated to tier 2 or IR. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.
Because arrivals are bursty. Queueing behaviour means waiting time rises steeply as utilisation approaches capacity, so a team planned at 95% will have a persistent backlog even though the weekly averages balance. Target 70–85%.
Then the fix is not process. Either reduce arrivals (tune detections, automate closure of benign categories) or add capacity. Deferring the decision converts the backlog into a permanent, silent detection gap.