Waiting time in a triage queue grows very fast as people get busier. In a simple single server model, average wait is utilization divided by (1 minus utilization), times the time one alert takes. At 50 percent busy the wait equals one alert. At 90 percent it is nine alerts long. Plan for slack, not full calendars.
The model, kept simple
Take one analyst, alerts arriving at random, and each taking about the same time to handle. Queueing theory gives the average time an alert waits before someone starts it:
wait equals utilization divided by (1 minus utilization), multiplied by average handling time
This is the textbook single server result for random arrivals and random handling times. Real teams have several people, shifts and priorities, so treat it as an intuition builder, not a forecast.
What the numbers look like
Say each alert takes 15 minutes to handle.
- 50 percent busy: wait is 1 times 15, so 15 minutes.
- 70 percent busy: about 2.3 times 15, so about 35 minutes.
- 80 percent busy: 4 times 15, so 60 minutes.
- 90 percent busy: 9 times 15, so 135 minutes.
- 95 percent busy: 19 times 15, so 285 minutes.
Going from 80 to 90 percent busy more than doubles the wait. Going from 90 to 95 percent doubles it again. The curve is steep near the top, so small increases in volume hurt a lot.
What this means for planning
- Do not size a team to full utilization. A schedule that looks efficient on paper produces long waits for the alerts that arrive at the wrong time.
- Spikes matter more than averages. A day with twice the usual alerts pushes utilization past 100 percent for a while, and the backlog takes much longer to clear than it took to build.
- Cutting handling time has a double effect. It lowers utilization and it lowers the multiplier, so wait falls faster than handling time does.
- Removing noise at the source beats adding people. Fewer false alarms lower arrivals directly. See the arithmetic of false positive cost.
Priority lanes
When alerts differ in urgency, split the queue. A fast lane for high confidence, high severity items keeps utilization of that lane low even when the overall system is busy. Low severity items wait longer, and that is the intended trade.
Do not put the same people at 90 percent in both lanes. The model above applies per lane.
What to measure
- Alerts arriving per hour, by hour of day, not just a daily total.
- Handling time per alert type.
- Time from arrival to first touch, as a percentile such as the 90th, not an average.
- Share of alerts that sat past their target.
If the first touch percentile keeps rising while headcount is constant, utilization is probably crossing into the steep part of the curve.
Quick check
Is this model accurate for a real security operations team?
Only roughly. Teams have several analysts, escalations and shifts. The shape holds, though: waits rise steeply as utilization approaches full.
Is there a safe utilization target?
There is no universal one. Many teams plan for well under full, and the right level depends on how bursty arrivals are and how costly a delay is.
Last reviewed: 19 October 2026.
