The Real Cost of “Is This Safe to Run?”

An EDR flags an unfamiliar binary on an endpoint. Nothing about it matches a known signature. It is not obviously malicious, and it is not obviously safe either. Somebody on your team now has to answer one question before anyone can move on: is this safe to run?

That question sounds small. In most SOCs, answering it well takes two to four hours per artifact, and it happens dozens of times a week.

Where the Hours Actually Go

The manual triage path most SOCs run today looks something like this:

Sandbox detonation. The artifact gets run in an isolated environment to observe what it does. This requires execution, takes anywhere from minutes to hours depending on queue depth, and can be evaded by malware built to detect sandbox conditions or delay its behavior until it is out of one.

Manual reverse engineering. If the sandbox result is inconclusive, which is common, a senior analyst opens the binary directly. This is the most expensive hour in the SOC, spent on work that does not scale with headcount.

Threat intelligence lookups. Useful for confirming known-bad, and close to useless for anything unknown: a file that has never been observed before, a polymorphic variant, or code an AI tool generated a few hours ago with no prior history anywhere clears these lookups by design, not by accident.

Ticketing and documentation. After the technical work is done, someone still has to write up a rationale that will hold up if an auditor or a regulator asks about it later.

Add it up across five to eight browser tabs and a couple of tools, and two to four hours per artifact is the realistic floor, not the ceiling.

The Cost Isn’t Just Time

The hours are the visible cost. The less visible cost is what those hours are made of.

It is senior analyst capacity, spent on triage that is largely deterministic once someone does the work, rather than on the investigations that actually need judgment. Hiring more analysts does not fix this, because the bottleneck is not headcount, it is how much of each analyst’s day gets consumed by the same repeatable question.

It is MTTR, which is quietly becoming a metric boards ask about directly, not just a SOC internal number.

And it is alert fatigue in its most literal form: most of what gets flagged is not malicious, but every flagged artifact costs roughly the same two to four hours until someone proves otherwise. The real threats are hiding in that same queue, getting the same treatment as the noise around them.

What Changes When the Verdict Comes in Minutes

Pre-execution behavioral analysis looks at what an artifact is capable of doing before it runs, without detonating it. That behavioral finding, mapped to MITRE ATT&CK and the Malware Behavior Catalog, is what produces the verdict: allow, block, restrict, quarantine, or require review. The verdict is the output. The behavior is what actually got evaluated.

This is a different kind of answer than a sandbox or a threat intel feed gives you. Those tools return a probability. A deterministic verdict is a decision, backed by evidence a person can actually review, not a score someone still has to interpret.

For a SOC running this workflow today, the practical change is that the two-to-four-hour question collapses to minutes, on the same artifacts, integrated downstream of whatever EDR is already flagging them (SentinelOne, CrowdStrike, Microsoft Defender, Carbon Black).

Why This Matters Beyond the SOC

The behavioral evidence produced for each artifact does not disappear once the ticket closes. It becomes the governance record: the documented answer to what was evaluated, what it was found capable of doing, and why it was or was not allowed to run. That is exactly what an auditor asks for after the fact, and exactly what most SOCs currently have to reconstruct from memory and Slack threads instead of producing on demand.

We have written before about how automation complements SOC analysts and about what happens when alert volume overwhelms a team’s capacity to keep up. This is the same problem, sized in hours.

The next time an artifact lands in your queue, time how long it actually takes your team to produce a defensible answer. That number, not the alert count, is the real cost of the question, and it is the number worth fixing first.