Rex says
Money math without the spreadsheet headache. Plug in your numbers and I'll show you exactly where the dollars land.
Try a scenario
Click to load — tweak from there.Inputs
Result
Required FTE for full coverage
4.3
Fully loaded annual cost
$564,375
Staffing gap (FTE)
1.3
Current coverage vs. requirement
70%
Fully loaded cost per FTE
$131,250
Psst — share this and help Rex grow
One click, a permanent link with your numbers baked in.
How to use this
- 1Enter concurrent analyst seats required.
- 2Enter coverage model.
- 3Enter average fully-loaded base salary.
- 4Enter overhead (benefits, tools, training).
- 5Enter current soc fte headcount.
- 6Read your required fte for full coverage on the right — it updates as you type.
- 7Hit Share to keep the scenario or send it to someone.
About this calculator
Security operations center staffing is a shift-math problem before it's a security problem. Continuous 24/7/365 coverage requires roughly 4.2-4.5 full-time equivalents per single seat once you account for weekends, holidays, vacation, sick time, and training days, not the naive 3 shifts x 1 person = 3 FTE that spreadsheets default to. This calculator applies a standard coverage factor to the number of concurrent analyst seats you need, then layers in tier distribution (Tier 1 triage, Tier 2 investigation, Tier 3 threat hunting) and shows fully loaded cost including the 20-30% overhead most companies underbudget for (benefits, tools, training, certification renewal). It also flags whether your current headcount can sustain true 24/7 coverage or whether you're actually running with unstaffed windows, which is the single most common gap auditors find in SOC maturity assessments.
Worked example
Using the values the calculator loads with:
Inputs
- Concurrent analyst seats required: 1
- Coverage model: 24/7/365 continuous
- Average fully-loaded base salary: 105000
- Overhead (benefits, tools, training): 25
- Current SOC FTE headcount: 3
Results
- Required FTE for full coverage: 4.3
- Fully loaded annual cost: $564,375
- Staffing gap (FTE): 1.3
- Current coverage vs. requirement: 70%
- Fully loaded cost per FTE: $131,250
What each field means
Inputs
- Concurrent analyst seats required
- The concurrent analyst seats required used in the calculation. Starts at 1 so you have a working example on load. Accepted range: 1–20.
- Coverage model
- Pick the option that matches your situation — the maths changes per option. Choices: 24/7/365 continuous, 16-hour extended coverage, Business hours + on-call, Business hours only, no on-call.
- Average fully-loaded base salary
- The average fully-loaded base salary used in the calculation. Starts at 105000 so you have a working example on load.
- Overhead (benefits, tools, training)
- The overhead (benefits, tools, training) used in the calculation. Starts at 25 so you have a working example on load. Accepted range: 0–100.
- Current SOC FTE headcount
- The current soc fte headcount used in the calculation. Starts at 3 so you have a working example on load.
Results
- Required FTE for full coverage
- Returned as a decimal number and shown as the headline result. It recalculates instantly whenever you change an input, so you can compare scenarios without reloading.
- Fully loaded annual cost
- Returned as a money amount in US dollars. It recalculates instantly whenever you change an input, so you can compare scenarios without reloading.
- Staffing gap (FTE)
- Returned as a decimal number. It recalculates instantly whenever you change an input, so you can compare scenarios without reloading.
- Current coverage vs. requirement
- Returned as a percentage. It recalculates instantly whenever you change an input, so you can compare scenarios without reloading.
- Fully loaded cost per FTE
- Returned as a money amount in US dollars. It recalculates instantly whenever you change an input, so you can compare scenarios without reloading.
FAQ
Why does 24/7 coverage need 4.3 FTE per seat instead of 3?
Three shifts of one person each only covers the calendar if nobody ever takes vacation, gets sick, or needs training time. Once you add roughly 15-20% for PTO and holidays and buffer for turnover and certification time, the realistic multiplier lands between 4.2 and 4.5 FTE per continuously staffed seat, which is standard workforce-planning math used across shift-based operations, not unique to security.
Can a smaller company skip 24/7 and still be reasonably covered?
Yes, many mid-market companies run business-hours SOC staffing with a managed detection and response (MDR) provider or on-call rotation covering nights and weekends, which is far cheaper than in-house 24/7 and appropriate if your threat model doesn't require sub-hour response at 3 AM.
How should Tier 1/2/3 split affect the FTE count?
This calculator gives you total seats needed; a typical mature SOC runs roughly 50-60% Tier 1 triage, 25-30% Tier 2 investigation, and 10-15% Tier 3 threat hunting and engineering. Apply that split to your total FTE result to build the actual org chart and salary bands, since Tier 3 analysts command 30-50% higher pay than Tier 1.
What's a realistic gap before it becomes a real risk?
A gap under 0.5 FTE is usually absorbable through overtime or a temporary MDR overlay. A gap over 1.5 FTE typically means real unstaffed windows exist, which is exactly the finding that shows up in SOC 2 and cyber insurance audits when incident response logs show delayed acknowledgment during off-hours.
Accuracy and limitations
- Results are estimates before tax, fees, and inflation unless an input explicitly covers them.
- Rates are treated as fixed for the whole period — variable-rate products will drift from this projection.
- This is educational maths, not financial advice. Check anything contractual with the lender or your accountant.
Related tools
MTTD/MTTR Cost Impact Calculator
See how faster detection and response times translate into dollars saved.
SIEM Log Ingestion Cost Calculator
Estimate monthly SIEM cost from log volume, sources, and retention period.
Patch SLA Backlog Calculator
See if your patching throughput can clear the vulnerability backlog before it grows.
Cite this calculator
Writing about this topic? Grab a citation — every link helps keep these tools free.
RevenueLab. (2026). SOC Staffing Coverage Calculator. Retrieved from https://www.revenuelab.fyi/toolbox/soc-staffing-coverage
<p>Source: <a href="https://www.revenuelab.fyi/toolbox/soc-staffing-coverage" target="_blank" rel="noopener">SOC Staffing Coverage Calculator — RevenueLab</a> (2026).</p>
Source: [SOC Staffing Coverage Calculator — RevenueLab](https://www.revenuelab.fyi/toolbox/soc-staffing-coverage) (2026).