A survey of 250-plus SOC practitioners puts 135 minutes between an alert firing and an answer

Multiply the survey's own averages. One hundred alerts a day at 75 minutes each is 7,500 analyst-minutes, or 125 hours of investigation work generated every day ^[3][5][1]. Many respondents run fewer than ten analysts ^[4]. Ten people on eight-hour shifts supply 80 hours, and nobody spends a full shift on triage, so the shortfall is at least 45 hours a day before meetings, projects and on-call ^[2]. The 28 percent of alerts that never get investigated ^[8] is that shortfall expressed as a percentage.

For the quarter of teams above 500 alerts a day ^[3], the same arithmetic demands 625 analyst-hours, a gap no hiring plan closes ^[5].

The clock the report builds its case on is a different one. An hour of queue time before a human touches the alert ^[6] plus 75 minutes to work it ^[5] is 135 minutes from firing to answer, about 4.7 times the 29-minute breakout figure the report uses as its benchmark ^[7][3]. Now apply the reported gain: 72 percent of AI users say investigation time fell by at least 25 percent, roughly 25 minutes an alert ^[14]. That takes 75 minutes to 50, and the cycle to 110 ^[4]. That is still 3.8 times breakout ^[4]. The saving is landing on the analysis while most of the delay sits in the queue.

Which is why the muted-rule number carries more weight than the volume number. Up to 40 percent of organizations have switched off alert rules because they had no one to read the output ^[10]. The report draws the distinction correctly: retiring a rule that never escalates is detection engineering, while silencing one because nobody has time narrows coverage precisely where the team already cannot see, so real load and real exposure both exceed what respondents reported ^[11]. The 100-alert average measures what teams chose to keep.

One note on provenance. This is a single vendor report, produced by Prophet Security from ViB's survey of 250-plus practitioners ^[1], and its most quotable finding is the one about in-house work: 72 percent of AI users tried to build their own tooling, and 46 percent of those projects were abandoned, never reached production, or were replaced by a commercial product ^[15]. The companion number is the one that keeps it honest. Teams that built reported investigation-time gains of 25 percent or more at 73 percent, against 72 percent for AI users overall ^[16]. The two paths were level on speed, and differed only in whether the thing was still running a year later.

The autonomy ceiling is set by the respondents, not by the vendor: 57 percent require a human to review every AI decision before an alert closes, 44 percent use AI to recommend actions for people to execute, 30 percent allow low-risk automated remediation, and none grants unsupervised autonomy ^[17]. Where the recovered time goes is threat hunting, and 38 percent of teams say hunting turned up malicious activity their automated tooling missed ^[18]. That is a real return, but not a containment return. If the 60-minute first-touch delay stays where it is, the gap against a 29-minute breakout survives every efficiency gain in the report.