Speed per alert
12× faster
15 min manual → 1.2 min end to end (40,000 context + 2,000 generated tokens, plus tool calls)
What does your SOC get back when the AI does the first pass?
Type in your daily volumes. The calculator sizes the work in tokens using Imperum's per-module profiles, times it against the appliance's throughput, and compares it with what your analysts spend today, in hours, people and money. Defaults come from published industry data; change any of them to match your SOC.
Your SOC today
Everything your SIEM / EDR / mail gateway raises that a human would look at
Alerts that become a case and need a real investigation
User-reported or gateway-flagged emails to verify
Ad-hoc hunts and questions analysts ask the data
Your team
People on the alert queue, all shifts
%
Share of alerts that turn out benign. Surveys: 45–46% (IDC 2021, Microsoft/Omdia 2026)
h
Mean time to respond today, alert to containment
Where the LLM runs
$
$
On-prem path: AI cost = platform + 1 appliance sized for your peak load. No per-token bill. Enter your quoted prices.
Assumptions
15 min per alert, 4 h per investigation, $130k per analyst a year, 80% of benign alerts closed alone, 20× context
min
Published range 10–30 min
h
$/ yr
About $91k base × 1.43 (BLS: wages are 70% of private-industry compensation)
%
The AI only auto-closes benign alerts, so no-touch volume = benign rate × auto-close
×
Elastic Security Labs (2026) measured ~50k tokens per agentic triage and ~113k per investigation; 20× the generated tokens matches that
Your estimate
Net savings / year$538k$658k analyst time freed − $120k Imperum cost
ROI+449%Payback in 2.2 months
Analyst FTEs freed5.19,114 h / yr spare with the whole queue workedAnother 4.9 FTE of released time goes into the backlog
What changes
Speed per alert12× faster
Speed per investigation45× faster
MTTR6 h → 3.1 h
Handled without a human166 / day
Queue coverage50% → 100%
False-positive drag5.3 FTE
Analyst hours per year
What changes in your SOC
Speed per investigation
45× faster
4 h manual → 5.3 min for a Pilot run (8,000 generated tokens, SIEM / EDR queries included)
MTTR
6 h → 3.1 h
Queue wait disappears and investigation time halves (CSA 2025), plus one Pilot run. An estimate: track it in your own data.
Handled without a human
166 / day
60,444 alerts a year (37% of the queue) triaged, decided and written up by the AI; analysts spot-check 5%. Only benign alerts are auto-closed.
Queue coverage
50% → 100%
Today your 20 analysts reach 50% of the queue. With Imperum the AI works every alert, every shift, and humans can review everything it escalates.
False-positive drag
5.3 FTE
9,527 of your team’s worked hours a year go to alerts that turn out benign (46% benign rate). The AI absorbs these first.
Tokenomics: cloud vs on-prem
Tokens per day (context + generated)23.3 M
Appliance load, average / peak8% / 23%
Cloud token bill / year$33k
Appliance / year$60k (1 appliance)
Platform / year (both paths)$60k
At your volume cloud tokens are cheaper by $27k a year; they overtake the appliance at roughly 1.8× today’s volume. The appliance keeps every prompt on your rack and the bill flat.
Recommended tier
M
Production SOC1 appliance, 10–50 analysts
Sized from GPU time per run (prefill 2,500 tok/s, decode 48 tok/s per stream, 8 slots at 60% batching efficiency) at a 3× peak hour. Measure your peak before quoting.
Why the first pass matters
Published figures the model is calibrated against
Average cost of a data breach worldwide ($10.22M in the US)
IBM Cost of a Data Breach 2025Mean time to identify and contain a breach
IBM Cost of a Data Breach 2025Shorter breach lifecycle, and $1.9M lower cost, with extensive security AI and automation
IBM Cost of a Data Breach 2025Of alerts are never investigated; 46% turn out to be false positives
Microsoft / Omdia 2026, via CSAFaster investigations, with 22–29% higher accuracy, when analysts work with an AI agent
Cloud Security Alliance, 2025 (n = 148)Of SOC practitioners report burnout
Tines Voice of the SOC 2023 (n = 900)How the numbers work
Savings count only analyst hours that are genuinely spare once Imperum works the whole queue. Idle capacity you already have and hours that go into clearing a backlog are not counted, so the headline is a floor, not a ceiling.
Generated-token profiles and appliance throughput are Imperum's own (Module Compute Profile v1.0, §8); context size is calibrated to Elastic Security Labs' published agentic-triage measurements. Analyst cost default ≈ $91k base × 1.43 (BLS: wages are 70% of private-industry compensation, June 2026; information security analyst median $129,180, May 2025). Cloud prices are frontier-model list prices (e.g. Claude Sonnet 4.6 $3 / $15, Claude Opus and GPT-5.5 $5 / $25–30 per M tokens). Every input is editable; results are estimates to validate against your own workload.
Fixed in the model: 1,800 paid hours per analyst a year, 75% of them on the queue; 15 min per reported phish and 10 min per assistant search; 20% of reported phish and 25% of search results still get a human look; analysts spot-check 5% of AI-closed alerts; escalated work with the AI write-up attached takes 50% of the manual time; generated tokens per run are triage 2,000, Pilot 8,000, phishing 3,500, assistant 1,500 and prioritizer 1,000, and tool calls add 15 s to a triage, 90 s to a Pilot run, 20 s to a phishing check and 10 s to a search; the appliance is sized for a 3× peak hour.
Check the estimate against your own SOC
The figures above come from your inputs and the model's defaults. Book a demo to see Imperum triage and investigate alerts like yours.