A properly staffed 24/7 NOC needs five to seven engineers before tooling.

Where the number comes from

Continuous coverage is not a headcount question, it is a rota question. Covering every hour of every day requires enough people that no single absence opens a gap — and absence includes leave, sickness, training and turnover, not just shift boundaries.

That is what produces the five-to-seven figure. It is the number required before any monitoring platform is licensed, before anyone is trained on your specific environment, and before the escalation path above Level 1 is staffed at all.

The common internal alternative is an on-call rotation layered onto the day team. That is cheaper on paper and it is where the cost reappears as something other than a line item.

What the headcount figure leaves out

The last point is the one that matters commercially. An incident detected at 2am and an incident detected at 8am are the same incident with a six-hour difference in business impact, and that difference is the whole outage.

When outsourcing is genuinely the cheaper answer

Not always. Where an organization already runs a mature internal NOC with depth on both voice and data, adding a provider usually adds coordination rather than coverage.

The cases where the arithmetic clearly favours a provider tend to share these characteristics:

Questions that establish the real number

Before comparing a retainer against a headcount, these four usually change the comparison.

The fourth question is the useful one. An organization that can answer it precisely usually needs a narrower engagement than it expected, because the gap turns out to be one class of failure rather than the whole estate.