Measure how much of the triage workflow SOAR really automates, the hours it returns and the payback on the platform.
Coverage multiplies the two dimensions people conflate: how many alerts touch a playbook, and how much of each alert's work the playbook actually does. Automating four of six steps on 45% of alerts is 30% coverage, not 45%, and auto-closure is counted separately because it removes the remaining steps too. SOAR is usually bought on a headcount-avoidance argument, and the arithmetic decides whether that argument survives contact with reality — coverage below about 20% rarely returns its licence and engineering cost.
SOAR Automation Coverage
Automation coverage = (automated steps ÷ total workflow steps) × (share of alerts entering a playbook).
Labour returned
Hours saved = (alerts × alert share × automated steps × minutes per step + auto-closed alerts × remaining steps × minutes per step) ÷ 60.
Automation coverage = (automated steps ÷ total workflow steps) × (share of alerts entering a playbook). Coverage multiplies the two dimensions people conflate: how many alerts touch a playbook, and how much of each alert's work the playbook actually does. Automating four of six steps on 45% of alerts is 30% coverage, not 45%, and auto-closure is counted separately because it removes the remaining steps too.
SOAR is usually bought on a headcount-avoidance argument, and the arithmetic decides whether that argument survives contact with reality — coverage below about 20% rarely returns its licence and engineering cost.
This calculator takes 8 inputs: Alerts per month, Alerts entering an automated playbook, Manual steps in the triage workflow, Steps the playbook performs, Minutes per manual step, Alerts closed with no human review, Fully loaded analyst cost per hour, Annual platform and engineering cost. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.
Only partly. The durable benefits are consistency and speed: every alert gets the same enrichment, containment happens in seconds at 03:00, and the audit trail is complete. Labour saving is the easiest number to defend, but it usually understates the value.
The highest-volume, lowest-judgement alert class you have — phishing report triage, commodity malware quarantine, impossible-travel enrichment. Never automate a containment action you would not be comfortable explaining after it isolated a production host at month end.