Skip to main content
Everything on this page uses data Clarion already collects for your workspace. Open the Analytics page in the sidebar to follow along with your own numbers.

​
The four value levers

Clarion returns value in four ways. Each one maps to a metric you can read straight off the Analytics page.

Triage time returned

Every issue an agent auto-resolves is an investigation your team never had to run.

Noise reduction

Deduplication and alert filters cut the false positives that eat analyst hours.

After-hours coverage

Agents respond at 3am without waking anyone up, replacing on-call escalations.

Faster response

Agents triage an issue in 3.4 minutes on average, shrinking the window an attacker has to do damage.

​
Where your numbers live

​
Translating to hours

An auto-resolved issue never reaches an analyst, so the time saved is the full manual investigation it replaced. The 3.4 minutes an agent spends on average do not count against you: they run in parallel and cost your team nothing.
If you have not measured your own manual triage time, 15 to 30 minutes per alert is a common starting range for a SOC investigation. Substitute the number your team actually experiences. Issues that agents triage but still escalate carry a partial saving too, since analysts start from a finished report instead of a raw alert. The calculation above ignores that, so treat it as a conservative floor.

​
Translating to dollars

Use the fully loaded hourly cost: salary plus benefits, tooling, and overhead, not base pay. Many teams use a figure between $75 and $110 per hour; your finance team will have the real one.

​
A worked example

The numbers below are illustrative. Replace them with your own from the Analytics page.
That is the capacity of roughly three full-time analysts, recovered without hiring.

​
Value that is harder to price, but real

  • After-hours response. Count the issues resolved outside business hours. Each one is an avoided page, an avoided escalation, or an avoided morning backlog.
  • Faster containment. Agents deliver a first verdict within minutes of an issue opening, instead of the alert waiting in a queue for the next free analyst. Every hour off your mean time to respond is an hour less of attacker dwell time, and shorter incidents are cheaper incidents.
  • Knowledge that stays. Playbooks captured as skills keep working when the analyst who wrote them moves on. Onboarding a new hire onto documented, executable skills is faster than tribal knowledge transfer.
Review these numbers monthly. The Getting the most value checklist covers the setup changes that move them.