SOAR Automation Coverage Calculator
Measure how much of the triage workflow SOAR really automates, the hours it returns and the payback on the platform.
About SOAR Automation Coverage Calculator
Coverage multiplies the two dimensions people conflate: how many alerts touch a playbook, and how much of each alert's work the playbook actually does. Automating four of six steps on 45% of alerts is 30% coverage, not 45%, and auto-closure is counted separately because it removes the remaining steps too. SOAR is usually bought on a headcount-avoidance argument, and the arithmetic decides whether that argument survives contact with reality — coverage below about 20% rarely returns its licence and engineering cost.
Formulas
SOAR Automation Coverage
Automation coverage = (automated steps ÷ total workflow steps) × (share of alerts entering a playbook).
- automated steps
- Enrichment, lookups and containment actions the playbook performs
- total steps
- Manual steps the workflow would otherwise need
- alert share
- Proportion of alerts a playbook actually handles
Labour returned
Hours saved = (alerts × alert share × automated steps × minutes per step + auto-closed alerts × remaining steps × minutes per step) ÷ 60.
- auto-closed alerts
- Alerts closed with no human review at all
- 1,800
- Productive analyst hours per FTE-year
Worked example
With the default values below, SOAR Automation Coverage Calculator returns Workflow Automation Coverage of 30.0%. Change any input above and every figure here is recalculated in your browser.
Inputs used
- Alerts per monthaccepts 0–10,000,000 alerts/month
- 7,200 alerts/month
- Alerts entering an automated playbookaccepts 0–100 %
- 45 %
- Manual steps in the triage workflowaccepts 1–100 steps
- 6 steps
- Steps the playbook performsaccepts 0–100 steps
- 4 steps
- Minutes per manual stepaccepts 0.1–120 minutes
- 2 minutes
- Alerts closed with no human reviewaccepts 0–100 %
- 20 %
- Fully loaded analyst cost per houraccepts 0–1,000 $/hour
- 65 $/hour
- Annual platform and engineering costaccepts 0–10,000,000 $/year
- 120,000 $/year
Results
- Workflow Automation Coverage
- 30.0%
- Analyst Hours Saved per Month
- 528.0 hours/month
- FTE Equivalent Returned
- 3.52 FTE
- Annualised Labour Saving
- $411,840
- Net Annual Benefit
- $291,840
- Return on Investment
- 243.2%
- Automation Verdict
- Strong return — automation is paying for itself several times over
Step by step
- 1Values used
- 2SOAR Automation Coverage
- 3Labour returned
- 4Workflow Automation Coverage= 30.0
- 5Analyst Hours Saved per Month= 528.0 hours/month
- 6FTE Equivalent Returned= 3.52 FTE
- 7Annualised Labour Saving= 411,840
- 8Net Annual Benefit= 291,840
- 9Return on Investment= 243.2
Assumptions and limits
- The result is derived only from the 8 inputs listed above. Anything not among them is not part of the calculation.
- In particular, this calculator does not take inflation or tax into account.
- Figures are rounded for display to 2 decimal places, so totals built from several rounded parts can differ slightly from the unrounded arithmetic.
How these calculators are built and tested is described on the Methodology page. If a figure looks wrong, please report it.
Frequently Asked Questions
How is SOAR Automation Coverage calculated?
Automation coverage = (automated steps ÷ total workflow steps) × (share of alerts entering a playbook). Coverage multiplies the two dimensions people conflate: how many alerts touch a playbook, and how much of each alert's work the playbook actually does. Automating four of six steps on 45% of alerts is 30% coverage, not 45%, and auto-closure is counted separately because it removes the remaining steps too.
Why does SOAR Automation Coverage matter?
SOAR is usually bought on a headcount-avoidance argument, and the arithmetic decides whether that argument survives contact with reality — coverage below about 20% rarely returns its licence and engineering cost.
What values do I need to enter?
This calculator takes 8 inputs: Alerts per month, Alerts entering an automated playbook, Manual steps in the triage workflow, Steps the playbook performs, Minutes per manual step, Alerts closed with no human review, Fully loaded analyst cost per hour, Annual platform and engineering cost. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.
Is FTE avoidance the right way to justify SOAR?
Only partly. The durable benefits are consistency and speed: every alert gets the same enrichment, containment happens in seconds at 03:00, and the audit trail is complete. Labour saving is the easiest number to defend, but it usually understates the value.
What should I automate first?
The highest-volume, lowest-judgement alert class you have — phishing report triage, commodity malware quarantine, impossible-travel enrichment. Never automate a containment action you would not be comfortable explaining after it isolated a production host at month end.