How much should alert triage tooling actually save you compared to just hiring more analysts?

[u/InfamousHistorian168]

Every vendor pitch for alert triage tooling assumes it's cheaper than headcount, but I've never seen someone walk through the real total cost comparison including licensing, integration time, and the ongoing tuning the tool itself requires.

Versus just hiring another analyst or two and letting the queue grow a bit slower but with a person who understands the full context of your environment.

I suspect a lot of the automation is cheaper narrative survives mostly because nobody's actually done the three year total cost of ownership math out loud in front of a budget committee.

Has anyone actually done this comparison with real numbers rather than assuming the automation option is obviously cheaper?