Incident Response Time Calculator
Model time-to-respond from paging, acknowledgement and escalation hops, and test it against your severity SLA.
About Incident Response Time Calculator
Escalation hops are the dominant, most fixable term: each handoff to the next rota, platform team or vendor adds its own acknowledgement wait, so two hops at fifteen minutes cost more than the entire paging chain. The coverage model then adds a fixed penalty representing the wait to get a human engaged out of hours. Severity SLAs are usually written before anyone checks the arithmetic, and a P1 with a sixty-minute response target is unachievable with two escalation hops and a pager rota — that gap is best found on a spreadsheet, not during a ransomware event.
Formulas
Incident Response Time
Response time = alert-to-page + acknowledgement + out-of-hours penalty + (escalation hops × delay per hop) + first containment action.
- out-of-hours penalty
- 0 min for 24×7, ~5 min follow-the-sun, ~20 min pager, ~480 min next-day
- escalation hops
- Handoffs before reaching someone able to act
- first action
- Time to the first change that limits the attacker
SLA margin
SLA margin = severity SLA − response time; a negative margin is a breach, not a near miss.
- severity SLA
- Contractual or policy response target for this severity
Worked example
With the default values below, Incident Response Time Calculator returns Mean Time to Respond of 93.0. Change any input above and every figure here is recalculated in your browser.
Inputs used
- Alert confirmed to page raisedaccepts 0–1,440 minutes
- 10 minutes
- Mean acknowledgement timeaccepts 0–1,440 minutes
- 8 minutes
- Escalation hops before the right responderaccepts 0–10 hops
- 2 hops
- Delay per escalation hopaccepts 0–480 minutes
- 15 minutes
- Coverage modelone of 24×7 staffed SOC — no out-of-hours penalty, Follow-the-sun across two regions, Business hours plus on-call pager, Business hours only, next-day response
- Business hours plus on-call pager
- First containment action after engagementaccepts 0–1,440 minutes
- 25 minutes
- Severity SLA for responseaccepts 1–10,080 minutes
- 60 minutes
Results
- Mean Time to Respond
- 93.0 minutes
- Response Time as a Duration
- 1h 33m
- Out-of-Hours Penalty Applied
- 20 minutes
- Delay From Escalation Hops
- 30 minutes
- Margin Against SLAPositive means you meet the SLA with time to spare.
- -33.0 minutes
- SLA Verdict
- Breaches SLA badly — the coverage model cannot support this severity
Step by step
- 1Values used
- 2Incident Response Time
- 3SLA margin
- 4Mean Time to Respond= 93.0 minutes
- 5Response Time as a Duration= 93
- 6Out-of-Hours Penalty Applied= 20 minutes
- 7Delay From Escalation Hops= 30 minutes
- 8Margin Against SLA= -33.0 minutes
- 9SLA Verdict= Breaches SLA badly — the coverage model cannot support this severity
Assumptions and limits
- The result is derived only from the 7 inputs listed above. Anything not among them is not part of the calculation.
- In particular, this calculator does not take inflation, tax, fees or charges or compounding frequency into account.
- Figures are rounded for display to 1 decimal place, so totals built from several rounded parts can differ slightly from the unrounded arithmetic.
How these calculators are built and tested is described on the Methodology page. If a figure looks wrong, please report it.
Frequently Asked Questions
How is Incident Response Time calculated?
Response time = alert-to-page + acknowledgement + out-of-hours penalty + (escalation hops × delay per hop) + first containment action. Escalation hops are the dominant, most fixable term: each handoff to the next rota, platform team or vendor adds its own acknowledgement wait, so two hops at fifteen minutes cost more than the entire paging chain. The coverage model then adds a fixed penalty representing the wait to get a human engaged out of hours.
Why does Incident Response Time matter?
Severity SLAs are usually written before anyone checks the arithmetic, and a P1 with a sixty-minute response target is unachievable with two escalation hops and a pager rota — that gap is best found on a spreadsheet, not during a ransomware event.
What values do I need to enter?
This calculator takes 7 inputs: Alert confirmed to page raised, Mean acknowledgement time, Escalation hops before the right responder, Delay per escalation hop, Coverage model, First containment action after engagement, Severity SLA for response. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.
How do I cut escalation hops?
Pre-authorise containment actions for the responders who receive the page — host isolation, account disable, token revocation — and page the owning team in parallel rather than in sequence. Most escalation delay is permission-seeking, not knowledge transfer.
Is a pager rota enough for P1 incidents?
It depends on the SLA. A pager reliably adds fifteen to thirty minutes before anyone is at a keyboard. If your P1 target is sixty minutes end-to-end, that penalty plus escalation usually consumes it, which is the standard business case for staffed 24×7 coverage.