SOAR Automation Coverage Calculator
Measure how much of the triage workflow SOAR really automates, the hours it returns and the payback on the platform.
Inputs
A user-supplied assumption.
A user-supplied assumption — licence plus the engineer who maintains the playbooks.
Workflow Automation Coverage
30.0%
Analyst Hours Saved per Month
528.0hours/month
FTE Equivalent Returned
3.52FTE
Annualised Labour Saving
$411,840
Net Annual Benefit
$291,840
Return on Investment
243.2%
Automation Verdict
Strong return — automation is paying for itself several times over
Step by step
Values used
Alerts per month = 7,200 alerts/month; Alerts entering an automated playbook = 45 %; Manual steps in the triage workflow = 6 steps; Steps the playbook performs = 4 steps; Minutes per manual step = 2 minutes; Alerts closed with no human review = 20 %; Fully loaded analyst cost per hour = 65 $/hour; Annual platform and engineering cost = 120,000 $/year
SOAR Automation Coverage
Automation coverage = (automated steps ÷ total workflow steps) × (share of alerts entering a playbook).
Labour returned
Hours saved = (alerts × alert share × automated steps × minutes per step + auto-closed alerts × remaining steps × minutes per step) ÷ 60.
Workflow Automation Coverage
= 30.0
Analyst Hours Saved per Month
= 528.0 hours/month
FTE Equivalent Returned
= 3.52 FTE
Annualised Labour Saving
= 411,840
Net Annual Benefit
= 291,840
Return on Investment
= 243.2
How it works
Coverage multiplies the two dimensions people conflate: how many alerts touch a playbook, and how much of each alert's work the playbook actually does. Automating four of six steps on 45% of alerts is 30% coverage, not 45%, and auto-closure is counted separately because it removes the remaining steps too. SOAR is usually bought on a headcount-avoidance argument, and the arithmetic decides whether that argument survives contact with reality — coverage below about 20% rarely returns its licence and engineering cost.
Formulas
SOAR Automation Coverage
Automation coverage = (automated steps ÷ total workflow steps) × (share of alerts entering a playbook).
- automated steps
- Enrichment, lookups and containment actions the playbook performs
- total steps
- Manual steps the workflow would otherwise need
- alert share
- Proportion of alerts a playbook actually handles
Labour returned
Hours saved = (alerts × alert share × automated steps × minutes per step + auto-closed alerts × remaining steps × minutes per step) ÷ 60.
- auto-closed alerts
- Alerts closed with no human review at all
- 1,800
- Productive analyst hours per FTE-year
Frequently Asked Questions
How is SOAR Automation Coverage calculated?
Automation coverage = (automated steps ÷ total workflow steps) × (share of alerts entering a playbook). Coverage multiplies the two dimensions people conflate: how many alerts touch a playbook, and how much of each alert's work the playbook actually does. Automating four of six steps on 45% of alerts is 30% coverage, not 45%, and auto-closure is counted separately because it removes the remaining steps too.
Why does SOAR Automation Coverage matter?
SOAR is usually bought on a headcount-avoidance argument, and the arithmetic decides whether that argument survives contact with reality — coverage below about 20% rarely returns its licence and engineering cost.
What values do I need to enter?
This calculator takes 8 inputs: Alerts per month, Alerts entering an automated playbook, Manual steps in the triage workflow, Steps the playbook performs, Minutes per manual step, Alerts closed with no human review, Fully loaded analyst cost per hour, Annual platform and engineering cost. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.
Is FTE avoidance the right way to justify SOAR?
Only partly. The durable benefits are consistency and speed: every alert gets the same enrichment, containment happens in seconds at 03:00, and the audit trail is complete. Labour saving is the easiest number to defend, but it usually understates the value.
What should I automate first?
The highest-volume, lowest-judgement alert class you have — phishing report triage, commodity malware quarantine, impossible-travel enrichment. Never automate a containment action you would not be comfortable explaining after it isolated a production host at month end.