Arctic Wolf counts nine security duties drawing 13 to 15 hours a week each

The sum is 117 hours a week at the low end and 135 at the high end ^[1]. Divide by a 40-hour week and that is 2.9 to 3.4 people of standing work before an alert arrives ^[1]. Arctic Wolf rounds it to roughly three full-time people ^[2].

That total holds only if no hour is counted twice. The nine categories include both configuring and updating tools and managing security automation and AI tools, and both incident response and threat hunting and proactive research ^[3]. The hours are what leaders estimated for their teams ^[1]. Arctic Wolf did not disclose the sample size for its own survey; the ISC2 study it cites alongside surveyed 16,029 practitioners and decision-makers ^[7].

Government, public sector and education teams averaged 17 hours per task, the highest of any sector on all nine, against 12.7 in travel and transport ^[4]. That gap is 4.3 hours per task, 38.7 hours a week across the nine, a little under one full-time equivalent between the busiest sector and the least busy ^[2].

Arctic Wolf reports that once the week fills, deadlined work gets done and the rest waits, and it names posture reviews, detection tuning and threat hunting as the first to slide ^[6]. A missed audit date is visible on a calendar; an untuned detection rule is visible only when it fails to fire. ISC2 found 88% of its respondents had at least one significant cybersecurity consequence from a skills deficiency ^[9].

The two constraints ISC2 measured came out close to even: 30% could not find people with the needed skills, 29% could not fund enough hires ^[7]. Fifty-nine percent called their skills needs critical or significant, up 15 points from 44% a year earlier ^[8][3]. A role posted today leaves the work uncovered for the months it takes to fill, and training asks the team to absorb the same workload while people are learning ^[14].

Nearly 60% of the leaders in Arctic Wolf's survey said they are investing in automation or AI to reduce manual workload ^[5]. Arctic Wolf's own report cautions that the result can be a workload rearranged instead of reduced, and that an AI layer bolted onto an existing workflow speeds up how quickly alerts move without changing what happens to them, so faster triage still routes to the same analysts in the same queue and the week ends with the same volume of human judgment to supply ^[12][11].

A manager can use the nine-duty count in a budget conversation as a scoping line: name the duties, name the hours, and the standing load is three people before incident surge. It does not settle the choice between a hire, an automation project and a contract. That comparison needs a measured figure for hours returned per task, and the post's frame is where a managed service fits alongside the other two ^[10].