What does a manual SOC cost?
Jan 29th, 2025 by Jesper Kråkhede
Following my post on automation, a business question: what does it cost to do everything by hand?
Let´s do a simple calculation. Say your SOC handles 50 incidents a day. Each one takes an analyst on average 30 minutes of repetitive work: looking things up, isolating, resetting, documenting. That is 25 hours a day, every day. With around the clock coverage and a realistic number of working hours per analyst, that is roughly five to six full time positions doing nothing but routine tasks.
If automation takes away even half of that work, you free up two or three experienced people. At the cost of a security analyst in Sweden, that is a lot of money every year. More importantly, those people can spend their time hunting, improving detections and fixing the root causes.
But the biggest cost isn´t salaries. It is time. An attacker who gets domain admin can encrypt a whole environment in a few hours. If your process from alert to action takes four hours because a human has to do every step, you lose. Automation that isolates a machine in two minutes changes the outcome.
So for management: ask your security team how long it takes from an alert to the first action. Ask how much of that time is waiting for a human. Then ask what it would cost to automate the first steps.
In security, minutes are money.