Start with what the first look costs today
A business case for an AI SOC is not a case for buying AI. It is a case for changing who does the first look at security alerts, and what your people do with the time that frees. So it starts with an honest picture of today: how many alerts arrive, how long the first look takes, who does it and what an hour of their time costs.
You probably have most of these numbers already. Your SIEM can count alerts per day over the last three months. Your ticketing system shows who closed them. For the minutes per alert, time a sample: ask two analysts to note start and finish for twenty ordinary alerts each over a week. The answer is usually higher than people guess, because the first look includes finding the machine owner, checking the user’s recent logons, looking up an address and writing a note.
Use a loaded hourly cost for the people doing the work, including salary, benefits and overhead. Your finance team will have a standard figure. Using it, rather than a number you choose, makes the case harder to argue with.
Do the same for the second look. When the first look raises a concern, someone more senior usually checks it. Count how often that happens and how long it takes, because that time is spent too, and some of it is spent on alerts that turn out to be harmless.
Count what is not being done
The cost of the first look is only half the picture. The other half is the work that does not happen because the first look takes all the time. These are risks rather than costs, and they often matter more to a board than the hours.
Write each one down with an example from the last quarter. “Alerts raised on Friday evening were not read until Monday morning” is a risk anyone can understand. So is “we switched off the rule for unusual service creation in March because it was too noisy to keep up with”.
- Alerts closed in bulk, or closed without being read, because the queue was too long.
- Detection rules switched off or never turned on because nobody had time for the noise.
- Nights and weekends, when alerts wait for the morning.
- Machines that stopped sending logs without anyone noticing.
- Threat hunting and rule tuning that keep slipping to next month.
An illustrative calculation
Here is the arithmetic with stated assumptions. These are illustrative numbers, not customer data and not armor360’s price. Swap in your own. Assume 150 alerts a day, a first look by hand of 20 minutes each, staff time at $60 an hour, 3 minutes for a person to review an AI verdict and decide, and about $0.10 of compute per AI investigation.
By hand: 150 alerts × 20 minutes is 3,000 minutes, or 50 hours a day. At $60 an hour that is $3,000 a day of staff time. Over a 30-day month it is 1,500 hours and $90,000.
With an AI first look and a person reviewing: 150 × 3 minutes is 450 minutes, or 7.5 hours a day, which is $450 of staff time. Compute is 150 × $0.10, or $15 a day. Over a 30-day month that is 225 hours ($13,500) plus $450 of compute, about $13,950 in all.
The difference is 1,275 hours a month of skilled time. In money, $90,000 against about $13,950 is a gap of about $76,050 a month at the assumed rate, before the price of any product. Over twelve such months it is 15,300 hours. Treat that as capacity, not jobs cut and not a cash saving: it is time your people can spend on nights, hunting, tuning rules and the gaps listed above.
- By hand: 150 × 20 min = 50 h a day = $3,000 a day = $90,000 a month.
- Reviewed AI first look: 150 × 3 min = 7.5 h a day = $450, plus $15 compute = $465 a day.
- A month: 1,500 h by hand against 225 h of review, so 1,275 h of capacity back.
- Before the product’s own price, which you then subtract.
What the numbers do and do not say
The largest lever in the calculation is review time. If the evidence behind a verdict is clear, three minutes is realistic for a routine alert. If a person has to redo the investigation to trust the verdict, review time rises towards the manual time and the case falls apart. With 30 minutes of review against 20 minutes by hand, the AI first look is a loss. Say so in your case; it shows you understand where the value comes from.
Run the numbers at a few review times, say 3, 6 and 10 minutes, and show the break-even. A finance reader will trust a range more than a single figure, and you will be ready when someone asks “what if it is slower than you think?”.
Keep the hours as hours where you can. A claim that the company will spend less money invites the question of whose budget shrinks. A claim that the same team will cover nights and weekends and finally turn the noisy rules back on is easier to defend and closer to what actually happens.
Benefits that do not fit in a spreadsheet
Some of the strongest reasons are hard to put a figure on, and you should not try. List them plainly and let the reader weigh them.
- The same checks run on a quiet Sunday as on a busy Tuesday, so quality does not depend on who is on shift.
- Each verdict keeps the records behind it, which makes audits and incident reviews faster.
- Alerts raised overnight already have a verdict waiting in the morning, with real attacks first in the queue.
- Corrections people make are remembered, so knowledge stays when someone leaves.
- If the system runs on your own hardware, alert data need not leave your environment.
Let a pilot give you your own numbers
Every assumption above can be replaced by a measurement. A pilot on your own alerts, over a few weeks, tells you the real review time, how often your people agree with the verdicts, how often they change them and in which direction, and how long a verdict takes to arrive. Those four numbers are the business case.
Agree the success criteria before the pilot starts, in writing, with the person who will approve the budget. For example: median review time under five minutes, no real attack marked harmless, and agreement on most routine alerts. Then the decision at the end is a reading of the results, not a debate.
Where armor360 fits
armor360 takes the first look at alerts from Elastic Security, Splunk, Microsoft Sentinel, CrowdStrike Falcon or Microsoft Defender and hands a person a verdict with its evidence. Its running cost is about $0.10 of compute per investigation; that is an estimate of running cost, not a price.
Pricing is by quote, sized to what you protect, with no charge per person. The free pilot runs on your own alerts, so the business case is built on your numbers rather than ours.
