{
  "slug": "soc-staffing-coverage",
  "title": "SOC Staffing Coverage Calculator",
  "heading": "SOC Staffing Coverage Calculator",
  "category": "financial",
  "url": "https://www.revenuelab.fyi/toolbox/soc-staffing-coverage",
  "summary": "Figure out how many analysts you need for 24/7 or business-hours coverage.",
  "description": "Security operations center staffing is a shift-math problem before it's a security problem. Continuous 24/7/365 coverage requires roughly 4.2-4.5 full-time equivalents per single seat once you account for weekends, holidays, vacation, sick time, and training days, not the naive 3 shifts x 1 person = 3 FTE that spreadsheets default to. This calculator applies a standard coverage factor to the number of concurrent analyst seats you need, then layers in tier distribution (Tier 1 triage, Tier 2 investigation, Tier 3 threat hunting) and shows fully loaded cost including the 20-30% overhead most companies underbudget for (benefits, tools, training, certification renewal). It also flags whether your current headcount can sustain true 24/7 coverage or whether you're actually running with unstaffed windows, which is the single most common gap auditors find in SOC maturity assessments.",
  "formula": "Required FTE = seats needed × coverage factor (≈4.3 for 24/7, ≈1.3 for extended business hours). Fully loaded cost = FTE × salary × (1 + overhead %).",
  "dateModified": "2026-09-30",
  "run_url": "https://www.revenuelab.fyi/api/public/calc?tool=soc-staffing-coverage",
  "inputs": [
    {
      "id": "seatsNeeded",
      "label": "Concurrent analyst seats required",
      "kind": "number",
      "hint": null,
      "default": 1,
      "unit": null,
      "min": 1,
      "max": 20
    },
    {
      "id": "coverageModel",
      "label": "Coverage model",
      "kind": "select",
      "hint": null,
      "default": "4.3",
      "options": [
        {
          "value": "4.3",
          "label": "24/7/365 continuous"
        },
        {
          "value": "2.1",
          "label": "16-hour extended coverage"
        },
        {
          "value": "1.3",
          "label": "Business hours + on-call"
        },
        {
          "value": "1.0",
          "label": "Business hours only, no on-call"
        }
      ]
    },
    {
      "id": "avgSalary",
      "label": "Average fully-loaded base salary",
      "kind": "number",
      "hint": null,
      "default": 105000,
      "unit": null,
      "min": 0,
      "max": null
    },
    {
      "id": "overhead",
      "label": "Overhead (benefits, tools, training)",
      "kind": "number",
      "hint": null,
      "default": 25,
      "unit": null,
      "min": 0,
      "max": 100
    },
    {
      "id": "currentFte",
      "label": "Current SOC FTE headcount",
      "kind": "number",
      "hint": null,
      "default": 3,
      "unit": null,
      "min": 0,
      "max": null
    }
  ],
  "outputs": [
    {
      "id": "requiredFte",
      "label": "Required FTE for full coverage",
      "format": "decimal",
      "hint": null,
      "primary": true
    },
    {
      "id": "totalCost",
      "label": "Fully loaded annual cost",
      "format": "currency",
      "hint": null,
      "primary": false
    },
    {
      "id": "gap",
      "label": "Staffing gap (FTE)",
      "format": "decimal",
      "hint": null,
      "primary": false
    },
    {
      "id": "coveragePct",
      "label": "Current coverage vs. requirement",
      "format": "percent",
      "hint": null,
      "primary": false
    },
    {
      "id": "costPerFte",
      "label": "Fully loaded cost per FTE",
      "format": "currency",
      "hint": null,
      "primary": false
    }
  ],
  "worked_example": {
    "inputs": [
      "Concurrent analyst seats required: 1",
      "Coverage model: 24/7/365 continuous",
      "Average fully-loaded base salary: 105000",
      "Overhead (benefits, tools, training): 25",
      "Current SOC FTE headcount: 3"
    ],
    "outputs": [
      "Required FTE for full coverage: 4.3",
      "Fully loaded annual cost: $564,375",
      "Staffing gap (FTE): 1.3",
      "Current coverage vs. requirement: 70%",
      "Fully loaded cost per FTE: $131,250"
    ]
  },
  "how_to": {
    "title": "How to use this",
    "steps": [
      "Enter concurrent analyst seats required.",
      "Enter coverage model.",
      "Enter average fully-loaded base salary.",
      "Enter overhead (benefits, tools, training).",
      "Enter current soc fte headcount.",
      "Read your required fte for full coverage on the right — it updates as you type.",
      "Hit Share to keep the scenario or send it to someone."
    ]
  },
  "scenarios": [
    {
      "name": "Conservative",
      "description": "Lower-end numbers — what if things land soft?",
      "values": {
        "seatsNeeded": 1,
        "coverageModel": "4.3",
        "avgSalary": 63000,
        "overhead": 15,
        "currentFte": 1.7999999999999998
      }
    },
    {
      "name": "Typical",
      "description": "Defaults — the most common real-world setup.",
      "values": {
        "seatsNeeded": 1,
        "coverageModel": "4.3",
        "avgSalary": 105000,
        "overhead": 25,
        "currentFte": 3
      }
    },
    {
      "name": "Ambitious",
      "description": "Higher-end numbers — what if things really pop?",
      "values": {
        "seatsNeeded": 2,
        "coverageModel": "4.3",
        "avgSalary": 168000,
        "overhead": 40,
        "currentFte": 4.800000000000001
      }
    }
  ],
  "limitations": [
    "Results are estimates before tax, fees, and inflation unless an input explicitly covers them.",
    "Rates are treated as fixed for the whole period — variable-rate products will drift from this projection.",
    "This is educational maths, not financial advice. Check anything contractual with the lender or your accountant."
  ],
  "faq": [
    {
      "q": "Why does 24/7 coverage need 4.3 FTE per seat instead of 3?",
      "a": "Three shifts of one person each only covers the calendar if nobody ever takes vacation, gets sick, or needs training time. Once you add roughly 15-20% for PTO and holidays and buffer for turnover and certification time, the realistic multiplier lands between 4.2 and 4.5 FTE per continuously staffed seat, which is standard workforce-planning math used across shift-based operations, not unique to security."
    },
    {
      "q": "Can a smaller company skip 24/7 and still be reasonably covered?",
      "a": "Yes, many mid-market companies run business-hours SOC staffing with a managed detection and response (MDR) provider or on-call rotation covering nights and weekends, which is far cheaper than in-house 24/7 and appropriate if your threat model doesn't require sub-hour response at 3 AM."
    },
    {
      "q": "How should Tier 1/2/3 split affect the FTE count?",
      "a": "This calculator gives you total seats needed; a typical mature SOC runs roughly 50-60% Tier 1 triage, 25-30% Tier 2 investigation, and 10-15% Tier 3 threat hunting and engineering. Apply that split to your total FTE result to build the actual org chart and salary bands, since Tier 3 analysts command 30-50% higher pay than Tier 1."
    },
    {
      "q": "What's a realistic gap before it becomes a real risk?",
      "a": "A gap under 0.5 FTE is usually absorbable through overtime or a temporary MDR overlay. A gap over 1.5 FTE typically means real unstaffed windows exist, which is exactly the finding that shows up in SOC 2 and cyber insurance audits when incident response logs show delayed acknowledgment during off-hours."
    }
  ],
  "related": [
    "https://www.revenuelab.fyi/toolbox/mttd-mttr-cost-impact",
    "https://www.revenuelab.fyi/toolbox/siem-log-ingestion-cost",
    "https://www.revenuelab.fyi/toolbox/patch-sla-backlog"
  ],
  "license": "CC-BY-4.0",
  "citation": "RevenueLab — SOC Staffing Coverage Calculator (https://www.revenuelab.fyi/toolbox/soc-staffing-coverage)"
}