Lesson 1.35: Capacity: can the team deliver the strategy?
A strategy without the hours to deliver it is a wish list. Security teams spend most of their time on running work (alerts, vulnerabilities, access reviews, incidents), which leaves little for the change work a strategy needs. A simple capacity model compares the hours the work needs with the hours people have, shows how much automation can return, and turns the rest into a headcount request backed by numbers. In the lab you build that model for Northwind's five-person team.
19 min
You will learn to
- Separate run and change work
- Compare demand with available hours
- Express a gap in FTEs
- Estimate what automation returns
- Write a resourcing plan
Key terms
- Run work
- Recurring operational work that never ends: alerts, patching, reviews.
- Change work
- Projects that improve or build something and then end.
- FTE
- Full-time equivalent: one person's productive hours.
- Utilisation
- Demand divided by available hours.
← Loss exceedance curves and risk appetite · All lessons · Linux distributions →