Annual Loss Expectancy (ALE), Explained — With the Formula
Annual Loss Expectancy (ALE) is a foundational risk-quantification metric: the expected cost of a particular risk over a year. It is calculated from two inputs — Single Loss Expectancy (SLE), the cost of one occurrence, and Annualized Rate of Occurrence (ARO), how many times per year you expect it to happen: ALE = SLE × ARO. SLE itself is Asset Value × Exposure Factor (the fraction of the asset lost in one event). ALE is useful because it converts a risk into an annual dollar figure you can compare against the cost of a control — if a safeguard costs less per year than the ALE it reduces, it is likely worth it. This guide gives the formula, a worked example, and the caveats.
Annual Loss Expectancy (ALE) is the metric that turns "this risk feels serious" into a number you can put next to the price of a control. It is the expected cost of a risk over a year, and its formula is simple enough to do on a whiteboard — which is exactly why it is one of the most-searched concepts in security risk management.
The formula
ALE = SLE × ARO
- SLE (Single Loss Expectancy): the cost of one occurrence. SLE = Asset Value × Exposure Factor, where the Exposure Factor is the fraction of the asset lost in a single event.
- ARO (Annualized Rate of Occurrence): how many times per year you expect the event. Once every five years = 0.2.
Fully expanded: ALE = (Asset Value × Exposure Factor) × ARO.
A worked example
A customer database is valued at $500,000. A breach would compromise 40% of its value, so the Exposure Factor is 0.4 and SLE = $500,000 × 0.4 = $200,000. You estimate such a breach happens once every five years, so ARO = 0.2. Therefore ALE = $200,000 × 0.2 = $40,000 per year. If a control that meaningfully reduces that risk costs less than $40,000/year, it is likely worth it; if it costs far more, the numbers say think again.
Why ALE is useful
It converts risks into a common currency — annual dollars — so you can rank them and compare each against the cost of mitigation. That is the core of cost-justifying security spend to a CFO.
The caveats
ALE is only as good as its inputs, and ARO in particular is hard to estimate for rare events. It also averages away variance, so it understates catastrophic tail risk (a once-in-20-years disaster looks small annualized). Use ALE to structure comparisons and justify controls — and pair it with scenario analysis for low-probability, high-impact events. For the difference between one-off and annualized loss, see SLE vs ALE.
Calculate ALE for your own scenarios with the free ALE calculator →, and estimate the SLE side with the Breach Cost calculator.
Frequently asked questions
What is ALE? The expected monetary loss from a risk over one year — a core quantitative risk metric.
What is the formula? ALE = SLE × ARO, and SLE = Asset Value × Exposure Factor.
Example? $500k asset × 0.4 exposure = $200k SLE; × 0.2 ARO = $40k/year ALE.
Limitations? Inputs are estimates (especially ARO), and it understates tail risk — pair it with scenario analysis.
Ready to practise the decisions these articles describe?
Run a free War Room →