The analyst who always says yes
Your security operations team looks after a few dozen managed clients. Alerts come in through your SIEM and EDR consoles, tickets are raised in your PSA, and client requests arrive by email and phone. On paper, work is shared across the shift. In practice, one or two experienced analysts pick up the difficult investigations, answer the demanding clients, and field questions from newer colleagues.
Nobody notices until one of them hands in their notice, or makes a mistake after a long week. At the same time, one client on a modest contract generates a stream of noisy alerts and 'quick questions' that take hours a week, and another client on a large contract barely needs anything. Neither fact appears on any report.
Management sees ticket counts. Ticket counts do not say how hard the work was or who did it.
The shift lead has a feel for it, and the feel is usually right. But a feel cannot be put in front of the board, used to reprice a contract, or handed over when the shift lead moves on.
Why workload stays invisible
- Work arrives through several tools: SIEM, EDR console, PSA tickets, email, phone.
- Time spent on an investigation is not recorded consistently, or at all.
- Tickets vary hugely in effort, so counts mislead.
- Senior analysts absorb informal work (helping colleagues, answering clients directly) that leaves no record.
- Contract value and time spent per client are in different systems and never compared.
What invisible workload costs
| Blind spot | Result |
|---|---|
| Overloaded senior analysts | Burnout, resignations, knowledge lost |
| Noisy client on a small contract | Service subsidised by other clients |
| Uneven shift load | Slow handling at busy times |
| No evidence for hiring | Headcount decisions made on feel |
| No per-client effort data | Renewals priced without knowing the cost |
In a managed security business, analyst time is the main cost. Not knowing where it goes is like not knowing your cost of sales.
Shift patterns make it worse. Night and weekend cover is usually thinner, and the analyst on those shifts often handles more alerts per head with less support. If the only record is a ticket count, a quiet week on nights and a gruelling one look much the same.
The workload reporting we build
- Activity is pulled from your PSA or ticketing system (for example ConnectWise, HaloPSA or ServiceNow) and from your security tools where they expose it: alerts triaged, investigations opened and closed, and who handled them.
- Each piece of work is tagged to a client and an analyst, with effort estimated from time logged or, where time is not logged, from the type and duration of the activity.
- A light, quick way to log informal work (a client call, helping a colleague) is added to the tools analysts already use, so it is counted without a timesheet.
- Per-analyst views show load by shift and week, the mix of work, and how much of the difficult work falls on each person.
- Per-client views show effort against contract value, alert volumes and noisy sources, so tuning conversations and repricing have evidence behind them.
- A weekly summary goes to the SOC manager with the analysts and clients that stand out.
This is a management view of workload, not a performance score for individual analysts. We design it with that in mind, and with your team's input.
What the SOC manager can do with it
Rebalance work before someone breaks, with evidence rather than impressions. Show a client how much time their noisy sources are costing, and agree a tuning plan or a revised contract. Make the case for the next hire with real numbers from your own team. And see whether a new client's workload is in line with what the contract assumed.
Take a normal Monday. The weekly summary shows one analyst carried most of the complex investigations last week, two clients generated far more alerts than usual, and the night shift was busier than the day. The SOC manager moves the next complex case to a different analyst, books a tuning session with the noisiest client, and raises night cover at the next planning meeting, all before lunch and all with figures to point at.
Is this your SOC?
- A few analysts handle most of the difficult work.
- You measure work by ticket counts.
- Some clients take far more time than their contract reflects.
- Hiring decisions are made on feel.
- Nobody can say how much time a client took last month.