How to Measure AI SOC ROI: Beyond Hours Saved

John White is the Field CISO for EMEA at Torq. A respected security executive with more than 20 years of leadership experience, John previously served as CISO at Virgin Atlantic, where he led a multi-year transformation deploying the Torq AI SOC Platform to modernize cyber operations. Prior to Virgin Atlantic, he built and transformed security functions for global organizations, including ASOS, Liberty Global, AEG Europe, and KPMG.

Every CISO I speak to eventually arrives at the same meeting: the one where you have to show what the investment bought you. And almost everyone walks in to defend their AI SOC ROI with the same number: hours saved.

It’s the weakest number you can bring. It invites the obvious follow-up question about headcount, which you don’t want to answer because the answer is that you aren’t cutting anyone. Worse, it describes a fraction of what actually changed. AI SOC ROI means different things depending on who’s asking, and “how many hours did we save?” is only one form of return.

Here’s how I’d measure it instead.

Measure AI SOC ROI as an Incremental Return

Adding AI agents doesn’t mean firing analysts, so don’t frame it as money saved. Frame it as an incremental return: for the extra you spend on agents, how much more do you get back?

Take an illustrative team of 10 analysts, still overwhelmed by volume and short on coverage across controls and projects. Add an agentic layer at roughly the cost of two or three good analysts, and you can automate the vast majority of your team’s Tier 1 work. Those analysts are released from the mundane and repeatable work and reallocated to higher-value activities. Compliance improves because the team now covers more controls. Risk from machine-speed attacks drops because triage and response happen at machine speed. Re-motivated analysts start engineering and delivering new capability on timeframes you couldn’t have committed to before.

That’s a significant uplift across the board, and it would have taken a team twice the size under a traditional, human-scaled model. That’s the number to bring.

Run Two Dashboards, Not One

One transformation, two audiences. I’d split measurement into a strategic dashboard and an operational one.

The strategic dashboard tracks what the board cares about: what you spent, how headcount was reallocated, how far risk came down, whether control metrics are improving, and whether the auditors are satisfied. If you’re reporting upward, ROI might mean that risk thresholds are met, the likelihood of breach is reduced, the cost of exposure is reduced, and legal and regulatory obligations are satisfied. It might mean showing no increase in committed headcount while efficiency and control coverage both go up. It might mean proving you delivered this transformation alongside a tech debt program or an ERP onboarding without derailing either.

The operational dashboard tracks how the work itself has changed: how many people moved from operations onto projects, which roles were refactored into the new structure, and how far case resolution time has dropped. In one enterprise I know, that went from 30 minutes to two. Quality improves as well, because every case arrives enriched with more context before anyone makes a decision.

The link between the two is capacity. Freed capacity isn’t a saving sitting in a spreadsheet: it’s value you redeploy, and the strategic dashboard is where that shows up.

The Benefits Most CISOs Aren’t Measuring

The secondary effects are where a lot of the real value hides, and most teams never put a number on them.

Reallocated hours change your risk posture. Reduced exposure changes what the business sets aside for cyber insurance. There’s the story you tell a regulator, for example, about running strong, agentic security inside critical national infrastructure, and there’s the evidence you can produce for the EU AI Act and the Cyber Resilience Act. 

None of that is technical, and all of it counts. The business benefits matter as much as the operational ones.

Get the Right People in the Room

The measurement conversation can’t stay inside the SOC, and this is where I see good programs undersell themselves.

You need the GRC team, enterprise risk, and procurement involved. Often, you want your other vendors too, because they’re seeing reduced volumes and faster response on their side, and that’s evidence you can use. Bring in any IT outsourcing team that owns part of the process. Don’t forget the regulators. Each of them measures your success differently, and if you’re the only one defining the measure, you’ll define it too narrowly.

Score AI SOC ROI Across All Three Layers

I’ve written before about the three layers you’re buying with an AI SOC: outcome, judgment, and execution. Measurement works the same way, and each layer has a tangible, measurable benefit.

1. At the outcome layer, you set risk reduction targets, machine-speed defense requirements, compliance obligations, and the confidence you need to demonstrate to your board, your regulators, and your insurers. These get defined up front and measured within the judgment function.
2. At the execution layer, you measure the incremental return described above. That’s where the leverage lives, as long as you measure it the right way.
3. At the judgment layer, you measure continuous improvement, decision quality, and audit transparency. Can the system show you its reasoning? Can you tune it? Does it get better? That’s the layer that tells you whether you bought a capability or just a tool.

If a vendor can only show you the execution layer and can’t speak to judgment or outcomes, the relationship will stall. That’s worth knowing before you sign rather than after.

The Org Change That Makes the Metrics Move

There’s a hard truth underneath all of this. Without organizational change, the metrics plateau no matter how good the technology is.

Adopt the three-layer model as a product approach. Lay out your services, define the capabilities that deliver them, and measure how every capability performs. Move people into roles that understand this approach — something service- and capability-oriented — and split them into connected teams that deliver on outcomes, execution, and judgment. 

The technology gives you the capacity. The organization decides whether that capacity turns into results.

Inaction Is Its Own Risk

At the very least, after all of this, have a plan. If your plan is not to adopt an AI SOC yet, you need a justification that stands up to scrutiny, and I’d challenge you to find one. Are you saying machine-speed threats aren’t a risk to your organization? Do you have the resources to cope with current alert volumes, let alone next year’s?

Look at how fast a machine-speed attack actually moves. If your first line of defense runs at human speed, you’re handing attackers the dwell time they need before you’ve begun to respond. The exposure that comes from standing still outweighs the risk of taking a first step in the right direction. A tentative, risk-based, well-planned move forward beats waiting for a certainty that isn’t coming.

Whatever you choose, run it like a program rather than a purchase. Start with the repeatable Tier 1 work that eats the most time, prove it, measure it in terms your board and your auditors care about, and expand as trust builds.

You need a plan. Start building it now.

The full AI SOC Buyer’s Guide has the measurement dashboards, the incremental AI SOC ROI model, and the questions to bring into the room with every vendor on your shortlist.