Token economics became a serious conversation the moment the industry realized we'd been getting an unreasonably generous discount from AI vendors. Now that free tiers are shrinking and usage caps are showing up everywhere, teams have started rationing tokens the way they once rationed analyst hours.
That instinct is understandable. It’s also how the SOC staffing crisis got built in the first place. Hiring-based scaling wasn’t a mistake, it was the only way to run a SOC before AI could take on real triage work. But it locked every team into a ceiling that’s still being paid for today, and rationing AI capacity the same way risks rebuilding it.
The Ceiling Every SOC Already Hit
Traditional SOCs scale by hiring, and hiring has a hard ceiling: headcount costs money, so every team caps capacity somewhere below the alert volume it actually faces. The average organization now generates roughly 4,484 alerts a day, and about half go completely un-investigated (Netenrich, 2025).
Management overhead is an even harder ceiling than the hiring budget itself. A SOC manager can only effectively run so many analysts, and once a team grows past that span, the org chart adds another layer of managers, then managers of managers, and coordination overhead starts eating the capacity gains headcount was supposed to buy. Even with an unlimited hiring budget and the largest office in the world, management overhead becomes the bottleneck long before budget does.
That gap isn't free. It shows up as burnout: 71% of SOC analysts report burnout, and 64% say they're likely to change jobs within a year (Tines, "Voice of the SOC Analyst"). 42% of SOC leaders report that staff tenure is actively shrinking (Netenrich, 2025). Capacity limits didn't just create a coverage gap, they built a churn engine. Deprioritization carries its own risk, too: studies of SOC alert queues have found as few as 1 in 100 investigated alerts turns out to be a genuine threat, which means blanket deprioritization can't tell the one real alert from the 99 that aren't (Alahmadi et al., USENIX Security). Deprioritization isn't neutral, it's an attack surface.
Repeating the Same Mistake with AI
Move to an AI-native SOC and the first question people ask is still a capacity question, just with tokens instead of headcount: if we send 10% of incidents to the model, what's the bill? Should we cut it to 5%? Frontier pricing makes that instinct rational in isolation, i.e. Claude Opus 4.6 runs $5/$25 per million input/output tokens, and top reasoning tiers elsewhere in the market run as high as $30 per million input tokens (CloudZero, LLM API Pricing Comparison 2026).
.png)
But optimizing around that number recreates the exact ceiling the SOC just escaped. If AI capacity gets rationed the same way analyst hours were, incidents get triaged down to fit a budget rather than investigated because they matter.
Two Different Starting Questions
"How many tokens can we afford" and "how do we keep the model working around the clock on every weak signal" produce two different SOCs. The first treats AI like an expensive analyst headcount line. The second treats it like infrastructure which is something provisioned for constant use, not metered scarcity.
That shift only works if cost isn't the first constraint the design revolves around, which means the model layer underneath has to look nothing like a single frontier API call per incident.
Why the Pipeline Has to Be Multi-Tier
Pricing across the model market now spans a wide range, from $0.20 per million input tokens for commodity models like GPT-5.6 Luna up to $30 for the top reasoning tiers (CloudZero, LLM API Pricing Comparison 2026). That range is the point: a multi-tier pipeline routes routine triage to small, cheap, sometimes locally hosted models, and reserves frontier reasoning for the handful of cases that actually need it.
What makes the cheap tier viable at scale is running those models on local GPU resources instead of paying per-token frontier API rates for routine triage. A model hosted on owned or dedicated GPU hardware costs roughly the same whether it handles ten calls a day or ten million, which decouples the bottom of the pipeline from token-metered pricing entirely. Fixed, low-marginal-cost capacity at the bottom of the pipeline is what lets the top stay reserved for real escalations.
What AI Doesn't Burn Out On
Run a traditional SOC on "keep every analyst maximally busy at all times" and the first record broken is the attrition rate. No team survives that operating model. That's precisely why the shift matters: AI doesn't get tired, doesn't quit, and doesn't need a fifth of its headcount replaced every year. It just needs power, cooling, and GPUs, many, many GPUs.
That difference is the argument for flipping the pipeline. Once idle model capacity is nearly free, the constraint that forced deprioritization in the first place (a fixed number of tired humans) stops applying.
Where Costs Actually Belong
None of this makes token cost irrelevant. It just moves it to the right place in the pipeline: a question asked about the handful of cases that escalate to frontier reasoning, not a gate applied to every incoming alert. Capable models like DeepSeek V4 Flash already run at $0.14/$0.28 per million input/output tokens (CloudZero, LLM API Pricing Comparison 2026) which is cheap enough that "should we even look at this" stops being a real budget question.
.png)
The SOC industry spent a decade building a model where every analyst hit a hard capacity ceiling, and burnout is what that ceiling cost. Repeating the same design with tokens just moves where the ceiling sits. A multi-tier pipeline is cheap and local at the bottom and frontier reasoning at the top. This is what actually lets the constraint disappear instead of just changing currency.
In the next post, we'll dig into how we build that multi-tier pipeline and how we measure whether it's actually working.