Why does 24x7 coverage need about 4.2 FTE per seat?

A 24x7 seat must be staffed every hour of the week — 168 hours. One full-time analyst is contracted for about 40 hours a week, so 168 ÷ 40 = 4.2 FTE just to keep one chair filled, before you account for annual leave, public holidays, sickness and training. Subtract those and the real figure rises above 4.2. This tool shows both numbers so you can audit them.

Where do the default numbers come from?

Only the calendar is fixed (52 weeks, 7 days, 24 hours, 60 minutes). Everything else — minutes per alert, utilisation, salaries, the overhead multiplier, the tier ratios — is an editable planning placeholder, clearly labelled, that you should replace with your own measured figures. Nothing is presented as an industry benchmark.

What is “analyst handling capacity”?

Alerts one analyst can work per productive hour = (60 ÷ minutes-per-alert) × utilisation. Utilisation is the fraction of paid time actually spent on alerts (the rest is breaks, meetings, training and admin). Measure your own mean-time-to-triage and utilisation; the defaults are placeholders.

Does this size my SIEM or storage?

No. This tool sizes PEOPLE and their cost. For log volume, EPS and storage, that is a separate exercise. Keep the two apart so each figure stays auditable.

← All Tools

SOC Sizing & Cost Calculator

Turn alert volume and analyst capacity into analysts per shift, FTE headcount and an annual budget — with every formula shown so you can audit it.

100% client-side — your inputs never leave the browser. No cookies, no tracking, no server-side processing.

What you get in 10 seconds: enter your daily alert volume and a few editable assumptions, and see analysts per shift, total FTE, a recommended headcount and an annual cost — broken down line by line. Defaults are planning placeholders, not benchmarks: replace them with your own figures.

Workload

Alert volume (alerts / day) Actionable alerts reaching analysts per day, after tuning and auto-close. You supply this.

Minutes per alert Placeholder. Average minutes to triage one alert — measure your own mean-time-to-triage.

Utilisation (0–1) Placeholder. Fraction of paid time spent actually handling alerts (rest = breaks, meetings, admin).

Peak factor 1.0 = flat daily average. Set higher to size for the busy hour (e.g. 1.5 = 50% above average).

Coverage & shifts

Coverage model Hours one seat must be staffed per week.

Shift length (hours) 8 and 12 are common. Shifts are rounded up to cover the window; uneven lengths overlap.

Minimum analysts / shift Floor on concurrent analysts. Consider 2 for 24x7 so no analyst works alone.

FTE availability (coverage factor)

Contracted hours / week Per full-time analyst. Set to your contract/jurisdiction (e.g. 35, 37.5, 40).

Annual leave (days/yr) Paid annual leave in working days. Your HR / statutory figure.

Public holidays (days/yr) Working days. Your jurisdiction.

Sick + training (days/yr) Average days an FTE is unavailable. Your own figure.

Team tiers

T2 ratio (x T1 FTE) Planning ratio. T2 (investigation) FTE as a fraction of T1 — your escalation design, not a benchmark.

T3 ratio (x T1 FTE) Planning ratio. T3 (hunt / IR) FTE as a fraction of T1 — your org design, not a benchmark.

Lead / manager (FTE) SOC lead / manager headcount you plan to run.

Salaries & cost

Currency label A label only (e.g. EUR, USD, GBP). All salaries use it.

T1 salary (gross/yr)

T2 salary (gross/yr)

T3 salary (gross/yr)

Lead salary (gross/yr)

Placeholders — replace with your own market rates. Not survey data.

Overhead multiplier Employer on-costs on gross salary (taxes, benefits, equipment). 1.3 = 30% — use your finance team's factor.

Tooling (/yr) Optional annual SIEM / SOAR / EDR / TI licence cost. 0 to size people only.

How this is calculated — every formula and default

🏛 GRC Hub → · All Tools →

📊 SOC Sizing & Cost Calculator

SOC Sizing & Cost Calculator