How many SOC analysts do you need? A queueing model of alert triage

#The SOC as an M/M/c queue

Model alerts arriving as a Poisson process with rate $\lambda$ per hour, $c$ analysts on shift, and each investigation taking an exponential time with mean $1/\mu$. The offered load is $a=\lambda /\mu$ Erlangs and utilization is $\rho =a/c$. The probability an alert has to wait at all is Erlang's C formula [1]:

the mean wait in queue is

and the wait-time tail is exponential: $\mathrm{Pr}(W_q>t)=C(c,a)e^{-(c\mu -\lambda )t}$.

Our scenario: 1,200 alerts per day ($\lambda =50$/hour), 12 minutes per manual investigation ($\mu =5$/hour per analyst). Offered load is 10 Erlangs, so you need more than 10 analysts on shift simply for the queue to be finite.

#The utilization cliff

Going from 11 to 12 analysts — one more person on a shift of eleven — cuts mean wait from 8.2 to 2.7 minutes. Removing one from eleven makes the queue infinite. This non-linearity is the most important fact about SOC staffing: at high utilization, small changes in volume or headcount produce huge changes in response time, and alert volume is never constant.

The simulation column comes from a discrete-event simulation of 60 days of alerts with exponential handling times. It agrees with Erlang C to within simulation noise, which validates the simulator for the next step.

#Variance doubles the wait

Real investigations are not exponential. Most alerts take a couple of minutes; a few take hours. We re-ran the simulation with lognormal handling times of the same 12-minute mean and a coefficient of variation $C_s=1.5$. The Allen–Cunneen approximation predicts the M/G/c wait from the M/M/c one:

With 11 analysts, 14% of alerts wait more than 30 minutes before anyone opens them — longer than the 48-minute average eCrime breakout time CrowdStrike reported for 2024 [2], once you add the investigation itself. The practical lesson: a handful of long investigations can starve the whole queue. Splitting work by expected duration (fast lane for quick closes, a separate lane for deep investigations) reduces waits more than adding a generalist.

#What AI pre-triage changes

Model an AI triage layer that closes a fraction $f$ of alerts with evidence before a human sees them, and attaches an investigation summary to the rest that shortens human handling time by a factor $g$. The human queue then sees $\lambda (1-f)$ arrivals with service rate $\mu /g$. We computed the minimum analysts on shift that keep mean wait at or under 5 minutes:

Two findings are worth stating precisely:

• Summaries matter almost as much as closures at low f. With no autonomous closures, cutting human handling time by 40% reduces required analysts from 12 to 7.
• Returns flatten above 90%. From $f=0.9$ to $0.95$ the requirement stays at two analysts per shift for a 5-minute wait. Past that point, staffing is set by coverage and resilience (someone must be able to respond while someone else is on a call), not throughput. Spend the remaining effort on the accuracy of what is closed — see our base-rate analysis.

#Turning this into a staffing plan

1. Measure hourly alert arrival rates for a month; plan for the 90th-percentile hour, not the daily average.
2. Measure handling-time distribution (mean and spread). Your $C_s$ is probably above 1.
3. Pick a wait target tied to threat speed — e.g. 95% of alerts opened within 10 minutes.
4. Solve for $c$ per shift with Erlang C, then multiply by the Allen–Cunneen factor or simulate.
5. Remember that one 24/7 seat needs roughly five full-time people once you account for shifts, leave and training.

#From seats to headcount

Queueing results are in analysts on shift. A 24/7 seat is 168 hours a week; a full-time analyst delivers roughly 35 productive hours a week after leave, training and meetings. That makes each 24/7 seat about $168/34.6\approx 4.9$ FTE.

The first row is why most mid-size organizations don't run a 24/7 internal SOC and why MDR exists. The third row is a staffing level a mid-size company can actually hire — but notice it is set by the 5-minute wait target and by having two people per shift, not by alert volume. Nobody should be the only person on shift during an incident.

Computing Erlang C yourself

from math import factorial

def erlang_c(lam, mu, c):
    a = lam / mu
    top = a**c / factorial(c) * c / (c - a)
    p_wait = top / (sum(a**k / factorial(k) for k in range(c)) + top)
    return p_wait, p_wait / (c * mu - lam)   # P(wait), mean wait in hours

print(erlang_c(50, 5, 12))   # (0.449, 0.045) -> 2.7 minutes

#Staff for the peak hour, not the day

Alert volume is not flat. If the busiest hour carries twice the average rate, the same Erlang C calculation gives very different answers:

A team sized for the daily average is overloaded every peak hour, and a queue that grows for an hour takes hours more to drain. This is where an automated first pass earns its keep: it absorbs peaks without a staffing plan, because its capacity scales with compute rather than shifts.

#Limitations

Alert arrivals are bursty and correlated (one incident triggers many alerts), which Poisson arrivals understate; burstiness makes waits worse. Analysts are not interchangeable servers, and they don't work alerts strictly first-in-first-out. The AI layer is modeled as perfectly accurate on what it closes, which it is not; the base-rate post quantifies that trade-off. All scenario parameters are illustrative.

#Frequently asked questions

#Sources

1. [1] L. Kleinrock, Queueing Systems, Volume 1: Theory. Wiley, 1975
2. [2] CrowdStrike, 2025 Global Threat Report (average eCrime breakout time 48 minutes in 2024; fastest 51 seconds)