SOC Health Score Calculator
Roll MTTD, MTTR, false-positive rate, ATT&CK coverage, staffing and automation into one weighted SOC health score.
Inputs
SOC Health Score
64.4/ 100
Grade
C — Fair
Detection Speed Score
73.0/ 100
Response Speed Score
63.3/ 100
Alert Quality Score
30.0/ 100
Capacity and Automation Score
73.1/ 100
Weakest Area
Alert quality — the queue is dominated by false positives
Improvement Priority
Tune the ten noisiest rules; quality gains free the capacity that fixes everything else
Step by step
Values used
Mean time to detect = 8 hours; Mean time to respond = 24 hours; False discovery rate of the alert queue = 70 %; In-scope ATT&CK technique coverage = 55 %; Staffed FTE against the required rota = 85 %; Triage workflow automated = 35 %; Case backlog age at the median = 3 days; Critical assets sending required telemetry = 88 %
SOC Health Score
Health = 0.24 × coverage + 0.22 × detection speed + 0.18 × response speed + 0.18 × alert quality + 0.18 × capacity, each normalised to 0–100.
Capacity component
Capacity = 0.5 × staffing% + 0.25 × scaled automation% + 0.25 × backlog score, where backlog score = 100 − 10 × median backlog days.
SOC Health Score
= 64.4 / 100
Grade
= C — Fair
Detection Speed Score
= 73.0 / 100
Response Speed Score
= 63.3 / 100
Alert Quality Score
= 30.0 / 100
Capacity and Automation Score
= 73.1 / 100
How it works
Timing metrics are scored logarithmically because the improvement from 48 hours to 24 matters far more than from two hours to one, and a linear scale would make already-fast SOCs chase meaningless gains. Coverage carries the largest single weight, since speed on a technique you cannot see is worth nothing. SOC reporting tends to be a wall of unweighted metrics that hides the actual constraint; one weighted score with a named weakest area turns a monthly report into a decision about where the next pound goes.
Formulas
SOC Health Score
Health = 0.24 × coverage + 0.22 × detection speed + 0.18 × response speed + 0.18 × alert quality + 0.18 × capacity, each normalised to 0–100.
- detection speed
- 100 − 9 × log₂(MTTD hours), so each halving of MTTD adds 9 points
- response speed
- 100 − 8 × log₂(MTTR hours)
- alert quality
- 100 − false discovery rate
- coverage
- 60% ATT&CK coverage, 40% telemetry completeness
Capacity component
Capacity = 0.5 × staffing% + 0.25 × scaled automation% + 0.25 × backlog score, where backlog score = 100 − 10 × median backlog days.
- staffing%
- Staffed FTE against the required rota
- backlog score
- Penalty of 10 points per day of median case age
Frequently Asked Questions
How is SOC Health Score calculated?
Health = 0.24 × coverage + 0.22 × detection speed + 0.18 × response speed + 0.18 × alert quality + 0.18 × capacity, each normalised to 0–100. Timing metrics are scored logarithmically because the improvement from 48 hours to 24 matters far more than from two hours to one, and a linear scale would make already-fast SOCs chase meaningless gains. Coverage carries the largest single weight, since speed on a technique you cannot see is worth nothing.
Why does SOC Health Score matter?
SOC reporting tends to be a wall of unweighted metrics that hides the actual constraint; one weighted score with a named weakest area turns a monthly report into a decision about where the next pound goes.
What values do I need to enter?
This calculator takes 8 inputs: Mean time to detect, Mean time to respond, False discovery rate of the alert queue, In-scope ATT&CK technique coverage, Staffed FTE against the required rota, Triage workflow automated, Case backlog age at the median, Critical assets sending required telemetry. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.
Why is coverage weighted above speed?
Because undetected activity has no MTTD at all. A SOC that responds in twenty minutes to 40% of techniques is more exposed than one responding in two hours to 85%, and averaging unweighted metrics hides exactly that trade.
Should I use this score as a KPI?
Use it as a diagnostic that points at the weakest component, not as a target in itself. Any single number becomes gameable once bonuses depend on it — usually by suppressing noisy detections, which improves the score and worsens the security.