> ## Documentation Index
> Fetch the complete documentation index at: https://docs.clarion.cantina.xyz/llms.txt
> Use this file to discover all available pages before exploring further.

# Measuring your ROI

> Turn the numbers on your Analytics page into hours and dollars saved.

<Note>
  Everything on this page uses data Clarion already collects for your workspace. Open the **Analytics** page in the sidebar to follow along with your own numbers.
</Note>

## The four value levers

Clarion returns value in four ways. Each one maps to a metric you can read straight off the Analytics page.

<CardGroup cols={2}>
  <Card title="Triage time returned" icon="clock">
    Every issue an agent auto-resolves is an investigation your team never had to run.
  </Card>

  <Card title="Noise reduction" icon="filter">
    Deduplication and alert filters cut the false positives that eat analyst hours.
  </Card>

  <Card title="After-hours coverage" icon="moon">
    Agents respond at 3am without waking anyone up, replacing on-call escalations.
  </Card>

  <Card title="Faster response" icon="gauge-high">
    Agents triage an issue in 3.4 minutes on average, shrinking the window an attacker has to do damage.
  </Card>
</CardGroup>

## Where your numbers live

| Analytics metric         | What it tells you                                                               |
| ------------------------ | ------------------------------------------------------------------------------- |
| **Issues Auto-Resolved** | The count of issues fully triaged and closed by agents with no human time spent |
| **AI Auto Resolved**     | The share of your issues resolved without human involvement                     |
| **Agent Runs**           | Total investigations agents performed on your behalf                            |
| **False Positive Rate**  | How much incoming noise Clarion is absorbing before it reaches your team        |
| **Mean Time to Respond** | How quickly issues get a verdict, around the clock                              |
| **Issues by Severity**   | Where agent effort is concentrated, and what would otherwise be your queue      |

## Translating to hours

An auto-resolved issue never reaches an analyst, so the time saved is the full manual investigation it replaced. The 3.4 minutes an agent spends on average do not count against you: they run in parallel and cost your team nothing.

```text theme={null}
minutes saved = auto-resolved issues x manual triage minutes
hours saved   = minutes saved / 60
```

If you have not measured your own manual triage time, 15 to 30 minutes per alert is a common starting range for a SOC investigation. Substitute the number your team actually experiences.

Issues that agents triage but still escalate carry a partial saving too, since analysts start from a finished report instead of a raw alert. The calculation above ignores that, so treat it as a conservative floor.

## Translating to dollars

```text theme={null}
dollar value = hours saved x analyst hourly cost
```

Use the fully loaded hourly cost: salary plus benefits, tooling, and overhead, not base pay. Many teams use a figure between \$75 and \$110 per hour; your finance team will have the real one.

### A worked example

The numbers below are illustrative. Replace them with your own from the Analytics page.

| Input                            | Example value |
| -------------------------------- | ------------- |
| Issues Auto-Resolved (per month) | 1,500         |
| Minutes per manual triage        | 20            |
| Fully loaded analyst cost        | \$85/hour     |

```text theme={null}
minutes saved = 1,500 x 20             = 30,000 minutes/month
hours saved   = 30,000 / 60            = 500 hours/month
dollar value  = 500 x $85              = $42,500/month
annualized    = $42,500 x 12           = $510,000/year
```

That is the capacity of roughly three full-time analysts, recovered without hiring.

## Value that is harder to price, but real

* **After-hours response.** Count the issues resolved outside business hours. Each one is an avoided page, an avoided escalation, or an avoided morning backlog.
* **Faster containment.** Agents deliver a first verdict within minutes of an issue opening, instead of the alert waiting in a queue for the next free analyst. Every hour off your mean time to respond is an hour less of attacker dwell time, and shorter incidents are cheaper incidents.
* **Knowledge that stays.** Playbooks captured as [skills](/learn/skills/introduction) keep working when the analyst who wrote them moves on. Onboarding a new hire onto documented, executable skills is faster than tribal knowledge transfer.

<Tip>
  Review these numbers monthly. The [Getting the most value](/roi/getting-the-most-value) checklist covers the setup changes that move them.
</Tip>