Agentic SOC Triage Economics: The Per-Alert Price That Survives CFO Scrutiny

• Marketed per-alert pricing in the agentic SOC category runs $9 to $10, and at least one leading AI SOC pure-play markets $9 per alert flat, with no distinction among low, medium, and difficult alerts. A flat price carries no information about how much investigative work any alert actually received.
• The labor an agentic SOC displaces is worth roughly $20 to $45 per alert. Proper Tier 1 triage takes 20 to 40 minutes of analyst time; at fully loaded rates of $57 to $68 per productive hour, that is the honest value of the work. This range, not vendor list price, is the correct denominator for every ROI claim in the category.
• The best triage money could theoretically buy has never been affordable. An hour-plus of experienced analyst attention per alert implies roughly 200 analysts and $25 to $30 million a year for a 1,000-alert-per-day SOC, about $70 to $80 per alert. Humans lost the triage war on arithmetic, not quality.
• At $9 to $10 per alert, the return on displaced labor is roughly 2x to 5x, below the 10x bar finance commonly applies to preventive controls. And per-alert bills scale with alert volume, not license tiers: at 10,000 alerts a day, $9 per alert is about $33 million a year, more than the 200 analysts it was meant to replace.
• A triage bill that stays below the cost of the two to three analysts it frees, about $360,000 a year, works out to about $1 per alert for a 1,000-alert-per-day SOC. That is the level at which the line item stops needing an annual defense.

Security operations leaders evaluating agentic SOC triage should:

• Anchor every pricing discussion to the value of displaced labor. Require vendors to state your cost per alert at your volume and alert mix, and read that price as a multiple of the $20 to $45 that proper human triage is worth. Demand the multiple, not the adjective.
• Run the three tests in this research (ROI, budget, and scale) before signature, and model the bill at ten times current alert volume in every scenario presented to finance. Alert volume always grows; contracts should be priced for the SOC you are becoming.
• Treat flat per-alert pricing as a due-diligence flag, not a convenience. Establish which party absorbs the difference between easy and difficult alerts, and require a readable per-alert risk assessment as evidence that depth accompanied the price.
• Never evaluate cost alone. A price evaluation without evidence of production accuracy, and without evidence of what the system does when evidence is missing or confidence is low, is an incomplete evaluation of an incomplete product.

Through 2027, we expect per-alert triage prices above $4.50 to increasingly fail standard preventive-control ROI review as SOC alert volumes grow, forcing repricing or vendor displacement at renewal.

By 2028, we expect depth-blind flat pricing to be regarded as a legacy model, with pricing that carries information about work performed becoming a standard evaluation requirement.

An agentic SOC applies AI agents to autonomously triage, investigate, and respond to security alerts, with human analysts supervising instead of grinding through queues. The category has raced from pilot to production consideration, and its pricing has not received the scrutiny its growth deserves. Buyers report three recurring problems. They cannot benchmark what triage should cost, because vendors publish prices with no reference to the labor economics they claim to improve. They cannot compare flat prices across vendors, because a flat price hides how much work each alert receives. And they face finance organizations that, with security spending already near 9 percent of the IT budget in benchmarks reported by Gartner, subject every new recurring line item to the strictest review in the building.

This research addresses all three problems with one method: price the labor honestly, read every vendor price as a multiple of it, and stress the result against budget placement and volume growth.

What labor does agentic SOC triage displace, and what is it worth?

Return-on-investment analysis starts with the value of the work being replaced, and that value should be priced honestly, at two levels.

The first level is the theoretical ideal, and it is worth a moment of imagination. Take an ordinary 1,000-alert-per-day SOC and ask: what is the highest-quality triage money could theoretically buy? It is not a model. It is an experienced analyst with something no SOC has ever given one: time. Give every alert more than an hour of undivided attention from someone with real intuition, the kind that notices the corner nobody checked and gets suspicious when a query comes back a little too clean. That analyst does not hallucinate. When they do not know, they know they do not know, and they go find out. Now price it. A thousand alerts at an hour-plus each is over 1,200 analyst-hours a day. Cover shifts, weekends, leave, and turnover, and you are staffing roughly 200 analysts at $25 to $30 million a year: about $70 to $80 per alert, for the best triage on earth. Nobody has ever paid it. Nobody ever will. The economics killed the ideal before AI arrived, which is why the humans-versus-AI debate is the wrong debate. It was settled by arithmetic, not quality.

The second level is the realistic standard, and it is the correct ROI baseline. Industry guidance places a proper Tier 1 investigation at 20 to 40 minutes per alert; research from IBM and IDC, summarized in D3’s published capacity analysis, puts the workup of a false positive alone near 30 minutes. At the loaded rates implied by the staffing model above ($57 to $68 per productive hour), 20 to 40 minutes of analyst time is worth roughly $20 to $45 per alert. Hold onto that range. Every ROI claim in this category is a multiple of it.

What does agentic SOC triage cost today?

Marketed per-alert pricing in the agentic SOC category runs $9 to $10. A leading AI SOC pure-play markets $9 per alert, flat: a low-severity duplicate and a difficult multi-pivot investigation carry the same price, because the pricing model does not distinguish among low, medium, and difficult alerts. For a 1,000-alert-per-day SOC, $9 per alert is about $3.3 million a year, for triage alone. Independent reporting describes the same territory: SecurityWeek’s coverage of agentic AI economics describes autonomous investigation loops running without human pacing and producing real cost blowouts. The arithmetic: $9 against labor worth $20 to $45 is a return of roughly 2x to 5x. That is not nothing. It is also not a business case that survives the three tests below.

What tests will finance apply to an agentic SOC price?

Three, in predictable order, and most marketed pricing fails all of them.

What agentic SOC triage costs and returns, on a 1,000-alert-per-day SOC

Vendor figures reflect public marketed pricing taken at face value; all model assumptions appear in the Evidence section, so you can re-run the arithmetic with your own inputs.

At what price per alert does agentic SOC triage withstand scrutiny?

The three tests converge. The ROI test caps a defensible price at $2 to $4.50. The budget test places the durable level at about $1, the point at which the bill fits inside the analyst line it relieves. The scale test disqualifies any price whose bill overtakes the human alternative as volume grows, which is exactly the trajectory of $9 to $10 pricing. The resulting guidance: below about $4.50, the business case starts working. At $2 or less, it survives a skeptical CFO. At about $1, triage becomes a rounding error in the security budget instead of a program defended annually.

The humans-versus-AI debate is settled. For buyers, the question now is which vendor clears three bars at the same time: excellent triage, real guardrails, and a unit cost that survives the CFO. Evaluate all three together, because each one covers for the others’ failure modes.

A vendor can clear one bar and still fail you on the other two, so hold every name on your shortlist to all three.

Why is depth-blind flat pricing a due-diligence flag?

Because triage is work, the work varies, and a price that pretends otherwise is hiding something a buyer needs to see. A false positive is not self-evident. An alert only becomes a false positive after it has been properly triaged; closing it without the work is how attacks get missed. That is why Morpheus does extensive work on every alert and produces a risk assessment before any classification: what the alert claims happened, what evidence exists, what that evidence actually shows, and how much risk it carries. A flat $9 price treats a commodity phishing alert and a chained lateral-movement investigation as the same product. They are not the same work, and a price that cannot tell them apart is telling you something about the triage behind it: either you are overpaying on the easy alerts, or the difficult ones are not getting the depth they need. From the finance side, a depth-blind price makes the ROI slide a guess, because the line item carries no information about work performed.

Does a lower cost per alert mean lower quality?

This is the right first question about any low number, and buyers should demand the evidence from every vendor, including D3. Here is our answer, stated plainly. Cost and quality only trade against each other when the architecture underneath is thin, because a vendor without a platform foundation has exactly one cost lever: cutting depth. Customers rely on Morpheus triage in production every day, and it has proven to be the gold standard for AI alert triage, with 98% accuracy. When Morpheus is uncertain, it defers to a human. In our opinion, D3 is delivering the best alert triage in the business right now, and we are saying that in the same breath as a sub-dollar price on purpose.

Morpheus performs exhaustive triage on every alert, never superficial triage, because superficial triage is how attacks get missed. Every alert gets a risk assessment before any classification. A cheap verdict that skips the corner nobody checked is not a verdict; it is a guess with a timestamp, and the miss it produces costs more than everything you saved. IBM’s breach-cost research places the average incident in the millions.

The reason we can hold both positions, exhaustive depth and $0.97 per alert, is architecture. Morpheus is an agentic SOC layered on a platform we built from scratch, over two years, with a team of 60. That platform carries the load that makes excellent triage, real guardrails, and cost containment possible at the same time. The evaluation guidance here applies to every vendor, whatever their architecture: require evidence that depth survived the price, at any price point.

• What is my cost per alert at my volume and my depth mix, not the demo’s?
• What ROI multiple does that price represent against the analyst hours it displaces?
• Does the price distinguish between an easy alert and a difficult one? If it is flat, which one of us absorbs the difference?
• Do you produce a risk assessment on every alert before classifying it, and can my team read it?
• What happens to my bill when alert volume doubles in a bad week? At ten times current volume?
• At what alert volume does your pricing stop making sense, for you or for me?
• When the model is uncertain or evidence is missing, what happens, and what does that path cost?
• Who pays for retries and failed investigation loops, you or me?
• Does your pricing get better or worse for you when my SOC gets noisier? A vendor should win when your SOC gets quieter.
• What triage accuracy do you sustain in production, and how do you measure it?

All comparisons in this research run on a 1,000-alert-per-day SOC (365,000 alerts per year); the scale test is run at 10,000 per day. The thresholds move with the inputs; the method does not.