SOC Health Score Calculator
Roll MTTD, MTTR, false-positive rate, ATT&CK coverage, staffing and automation into one weighted SOC health score.
About SOC Health Score Calculator
Timing metrics are scored logarithmically because the improvement from 48 hours to 24 matters far more than from two hours to one, and a linear scale would make already-fast SOCs chase meaningless gains. Coverage carries the largest single weight, since speed on a technique you cannot see is worth nothing. SOC reporting tends to be a wall of unweighted metrics that hides the actual constraint; one weighted score with a named weakest area turns a monthly report into a decision about where the next pound goes.
Formulas
SOC Health Score
Health = 0.24 × coverage + 0.22 × detection speed + 0.18 × response speed + 0.18 × alert quality + 0.18 × capacity, each normalised to 0–100.
- detection speed
- 100 − 9 × log₂(MTTD hours), so each halving of MTTD adds 9 points
- response speed
- 100 − 8 × log₂(MTTR hours)
- alert quality
- 100 − false discovery rate
- coverage
- 60% ATT&CK coverage, 40% telemetry completeness
Capacity component
Capacity = 0.5 × staffing% + 0.25 × scaled automation% + 0.25 × backlog score, where backlog score = 100 − 10 × median backlog days.
- staffing%
- Staffed FTE against the required rota
- backlog score
- Penalty of 10 points per day of median case age
Worked example
With the default values below, SOC Health Score Calculator returns SOC Health Score of 64.4. Change any input above and every figure here is recalculated in your browser.
Inputs used
- Mean time to detectaccepts 0–10,000 hours
- 8 hours
- Mean time to respondaccepts 0–10,000 hours
- 24 hours
- False discovery rate of the alert queueaccepts 0–100 %
- 70 %
- In-scope ATT&CK technique coverageaccepts 0–100 %
- 55 %
- Staffed FTE against the required rotaaccepts 0–200 %
- 85 %
- Triage workflow automatedaccepts 0–100 %
- 35 %
- Case backlog age at the medianaccepts 0–365 days
- 3 days
- Critical assets sending required telemetryaccepts 0–100 %
- 88 %
Results
- SOC Health Score
- 64.4 / 100
- Grade
- C — Fair
- Detection Speed Score
- 73.0 / 100
- Response Speed Score
- 63.3 / 100
- Alert Quality Score
- 30.0 / 100
- Capacity and Automation Score
- 73.1 / 100
- Weakest Area
- Alert quality — the queue is dominated by false positives
- Improvement Priority
- Tune the ten noisiest rules; quality gains free the capacity that fixes everything else
Step by step
- 1Values used
- 2SOC Health Score
- 3Capacity component
- 4SOC Health Score= 64.4 / 100
- 5Grade= C — Fair
- 6Detection Speed Score= 73.0 / 100
- 7Response Speed Score= 63.3 / 100
- 8Alert Quality Score= 30.0 / 100
- 9Capacity and Automation Score= 73.1 / 100
Assumptions and limits
- The result is derived only from the 8 inputs listed above. Anything not among them is not part of the calculation.
- In particular, this calculator does not take inflation, tax, fees or charges or compounding frequency into account.
- Figures are rounded for display to 1 decimal place, so totals built from several rounded parts can differ slightly from the unrounded arithmetic.
How these calculators are built and tested is described on the Methodology page. If a figure looks wrong, please report it.
Frequently Asked Questions
How is SOC Health Score calculated?
Health = 0.24 × coverage + 0.22 × detection speed + 0.18 × response speed + 0.18 × alert quality + 0.18 × capacity, each normalised to 0–100. Timing metrics are scored logarithmically because the improvement from 48 hours to 24 matters far more than from two hours to one, and a linear scale would make already-fast SOCs chase meaningless gains. Coverage carries the largest single weight, since speed on a technique you cannot see is worth nothing.
Why does SOC Health Score matter?
SOC reporting tends to be a wall of unweighted metrics that hides the actual constraint; one weighted score with a named weakest area turns a monthly report into a decision about where the next pound goes.
What values do I need to enter?
This calculator takes 8 inputs: Mean time to detect, Mean time to respond, False discovery rate of the alert queue, In-scope ATT&CK technique coverage, Staffed FTE against the required rota, Triage workflow automated, Case backlog age at the median, Critical assets sending required telemetry. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.
Why is coverage weighted above speed?
Because undetected activity has no MTTD at all. A SOC that responds in twenty minutes to 40% of techniques is more exposed than one responding in two hours to 85%, and averaging unweighted metrics hides exactly that trade.
Should I use this score as a KPI?
Use it as a diagnostic that points at the weakest component, not as a target in itself. Any single number becomes gameable once bonuses depend on it — usually by suppressing noisy detections, which improves the score and worsens the security.