Skip to content
AI Cyber Compare

LESSON 4 OF 10 · SIZING · 3 MIN READ

Measure your alert queue before you choose a model

The short answer

Five numbers from your own data narrow the choice: alerts per day, the share closed without a human look, time per investigated alert, alerts that arrive outside working hours, and the share covered by an existing playbook. Take them from two normal weeks, not from a quiet month. Each points toward a different model.

By The Triage Desk · AI Cyber Compare · Published 2026-10-08

Why measure first?

Vendors will show you their own numbers. Yours matter more, and they are already in your SIEM and ticketing system. Two normal weeks are enough. Avoid a holiday period or the week of a major incident, which distort every figure.

What should you measure?

  1. Alerts per day, by source. Count what reaches the queue, not raw events. Note which sources produce the most.
  2. The share closed without a human look. Many queues have auto-closed or bulk-closed alerts. This number shows how much is going unread today.
  3. Time per investigated alert. Take a sample of alerts that a person did investigate and record the time from opening to verdict.
  4. Alerts outside working hours. Count what arrives at night and on weekends, and how long it waits.
  5. Playbook coverage. If you run SOAR, count the alerts that a playbook handled end to end.

How do the numbers point to a model?

  • A high share closed unread points to something that reads every alert on its own: an AI SOC analyst platform or a provider. A copilot will not change this number.
  • Long time per alert with a manageable count points to speed per alert: a copilot, or better enrichment in playbooks.
  • Many alerts outside hours with long waits points to either an agent that works at night with clear limits, or a provider.
  • High playbook coverage is an asset. Keep those playbooks working, whatever you add for the rest.

What about the sources?

Your top sources by volume are the first thing to check against any vendor. A product that does not support your noisiest source by name will not reduce your queue, however good its demo. Ask for the source list in writing.

What not to measure

Do not compare your numbers with a vendor's headline figure. A vendor's reduction in response time or alert volume comes from its own customers' environments. Use it as a question ("on what data?"), not as a target.

Where to put the numbers

Bring the five numbers to the fit finder: the volume question is about the second number, and the sourcing and team questions are about the fourth.

How often should you measure again?

Take the same five numbers a month after any change, whether you add a product, a provider or new playbooks. If the share closed unread does not fall, the change did not reach the alerts that mattered. If time per alert falls but the queue grows, you bought speed when you needed coverage. Keep the measurement method fixed so the comparison is fair.

Words in this lesson: Alert, Playbook, SIEM, Verdict, SOAR

Next lessonWho owns decisions at 3 a.m.? Staffing and coverage for each modelEach SOC operating model needs a different kind of staffing. Who must be awake, who approves actions and who maintains the system, model by model.

Read next

Fit finderFive questions that order the models by your answers.Staffing and coverageEach SOC operating model needs a different kind of staffing. Who must be awake, who approves actions and who maintains the system, model by model.Which modelThe decision guide for all four models.