Annual Loss Expectancy (ALE): Formula + Calculator
TL;DR · the short version
Annual Loss Expectancy (ALE) is a foundational risk-quantification metric: the expected cost of a particular risk over a year. It is calculated from two inputs — Single Loss Expectancy (SLE), the cost of one occurrence, and Annualized Rate of Occurrence (ARO), how many times per year you expect it to happen: ALE = SLE × ARO. SLE itself is Asset Value × Exposure Factor (the fraction of the asset lost in one event). ALE is useful because it converts a risk into an annual dollar figure you can compare against the cost of a control — if a safeguard costs less per year than the ALE it reduces, it is likely worth it. This guide gives the formula, a worked example, and the caveats.
If the SLE is $5,000 and you expect 5 occurrences a year, what is the ALE?
$25,000. ALE = SLE × ARO, so $5,000 × 5 = $25,000 per year. The ARO is the expected number of occurrences per year, so 5 occurrences a year means an ARO of 5.
If the SLE is $15,000 and the ARO is 0.1 per year, what is the ALE?
$1,500 per year. ALE = SLE × ARO = $15,000 × 0.1. An ARO of 0.1 means one occurrence every ten years, which is why the annualized loss is a tenth of one event's cost.
How do you get the ALE from asset value, exposure factor and rate of occurrence?
Work in two steps. First SLE = Asset Value × Exposure Factor, then ALE = SLE × ARO. Example: an asset worth 15,00,000 rupees with a 40% exposure factor has SLE = 15,00,000 × 0.40 = 6,00,000; if the threat occurs 2 times a year, ALE = 6,00,000 × 2 = 12,00,000 rupees.
If the SLE is 8,00,000 and the ALE is 12,00,000, what is the ARO?
1.5 occurrences per year. Rearranging ALE = SLE × ARO gives ARO = ALE ÷ SLE = 12,00,000 ÷ 8,00,000 = 1.5, or one and a half events a year on average.
Which values do you need to calculate ALE, and which type of risk analysis uses it?
You need two values: the Single Loss Expectancy (SLE) and the Annualized Rate of Occurrence (ARO), with SLE itself built from asset value and exposure factor. Because it produces a dollar figure, ALE belongs to quantitative risk analysis, as opposed to qualitative ranking such as high, medium and low. NIST's 1979 FIPS PUB 65 (now withdrawn) describes the same idea as annual loss exposure, the product of estimated impact in dollars and estimated frequency of occurrence per year; the SLE, ARO and exposure-factor labels are the conventional textbook notation for those two terms.
Sources (accessed 2026-11-03): NIST FIPS PUB 65, Guideline for Automatic Data Processing Risk Analysis (1979, withdrawn), section 4.3; NIST CSRC record for FIPS 65
Annual Loss Expectancy (ALE) is the metric that turns "this risk feels serious" into a number you can put next to the price of a control. It is the expected cost of a risk over a year, and its formula is simple enough to do on a whiteboard — which is exactly why it is one of the most-searched concepts in security risk management.
Want the answer for your own risk? Open the ALE calculator: enter asset value, exposure factor and annual rate of occurrence and it works out SLE and ALE step by step.
The formula
ALE = SLE × ARO
- SLE (Single Loss Expectancy): the cost of one occurrence. SLE = Asset Value × Exposure Factor, where the Exposure Factor is the fraction of the asset lost in a single event.
- ARO (Annualized Rate of Occurrence): how many times per year you expect the event. Once every five years = 0.2.
Fully expanded: ALE = (Asset Value × Exposure Factor) × ARO.
Useful next, if this was relevant to you
SLE, ARO and exposure factor at a glance
| Term | What it means | How to get it | Example |
|---|---|---|---|
| Asset Value (AV) | What the asset is worth to you, including the data on it and the cost of recovering it | Replacement, recovery and business-impact estimates | $500,000 |
| Exposure Factor (EF) | The fraction of the asset’s value lost in one event, from 0 to 1 | Estimate from the impact of a realistic incident | 0.4 (40%) |
| Single Loss Expectancy (SLE) | The cost of one occurrence | SLE = AV × EF | $200,000 |
| Annualized Rate of Occurrence (ARO) | How many times a year you expect the event | 1 ÷ years between events, or events per year | 0.2 (once in 5 years) |
| Annual Loss Expectancy (ALE) | The expected loss per year from this risk | ALE = SLE × ARO | $40,000 a year |
Converting frequency to ARO: once every ten years is 0.1, once every five years is 0.2, once a year is 1, and four times a year is 4. ARO can be above 1 for events that happen more than once a year.
Worked examples
Example 1: a database breach. A customer database is valued at $500,000. A breach would compromise 40% of its value, so the Exposure Factor is 0.4 and SLE = $500,000 × 0.4 = $200,000. You estimate such a breach happens once every five years, so ARO = 0.2. Therefore ALE = $200,000 × 0.2 = $40,000 per year. If a control that meaningfully reduces that risk costs less than $40,000/year, it is likely worth it; if it costs far more, the numbers say think again.
Example 2: lost laptops. Replacing and reimaging a laptop costs $2,500, and a lost laptop is a total loss, so the Exposure Factor is 1.0 and SLE = $2,500. If your fleet loses six laptops a year, ARO = 6 and ALE = $2,500 × 6 = $15,000 per year. This is a frequent, low-cost event, the opposite shape to Example 1, and it shows why ARO is not capped at 1.
Why ALE is useful
It converts risks into a common currency — annual dollars — so you can rank them and compare each against the cost of mitigation. That is the core of cost-justifying security spend to a CFO.
The caveats
ALE is only as good as its inputs, and ARO in particular is hard to estimate for rare events. It also averages away variance, so it understates catastrophic tail risk (a once-in-20-years disaster looks small annualized). Use ALE to structure comparisons and justify controls — and pair it with scenario analysis for low-probability, high-impact events. For the difference between one-off and annualized loss, see SLE vs ALE. When a single-point ARO is too uncertain, the FAIR risk calculator estimates ALE from ranges of event frequency and loss magnitude instead, and how to calculate annualized loss expectancy walks through choosing the inputs.
Calculate ALE for your own scenarios with the ALE calculator →, and estimate the SLE side with the Breach Cost calculator.
Frequently asked questions
What are the two main types of risk analysis? The two main approaches are qualitative risk analysis, which ranks risks by relative severity (e.g. high/medium/low), and quantitative risk analysis, which assigns dollar values. ALE is a quantitative method; many teams use both — qualitative to triage, quantitative to justify spend on the top risks.
How do you calculate SLE (Single Loss Expectancy)? SLE = Asset Value x Exposure Factor (EF), where the Exposure Factor is the fraction of the asset's value lost in a single event. SLE is then multiplied by the Annualized Rate of Occurrence (ARO) to produce the ALE.
What is ALE? The expected monetary loss from a risk over one year — a core quantitative risk metric.
What is the formula? ALE = SLE × ARO, and SLE = Asset Value × Exposure Factor.
Example? $500k asset × 0.4 exposure = $200k SLE; × 0.2 ARO = $40k/year ALE.
Limitations? Inputs are estimates (especially ARO), and it understates tail risk — pair it with scenario analysis.
Frequently asked questions
How do you calculate ALE (Annual Loss Expectancy) in cybersecurity?
Use ALE = SLE × ARO. First work out the Single Loss Expectancy (SLE), the cost of one occurrence, as Asset Value × Exposure Factor (the fraction of the asset lost in one event). Then multiply by the Annualized Rate of Occurrence (ARO), how many times per year you expect it. Worked example: a $500,000 database with a 0.4 exposure factor gives SLE = $200,000; if a breach is expected once every five years, ARO = 0.2, so ALE = $200,000 × 0.2 = $40,000 per year. Compare that annual figure against the yearly cost of a control to decide whether the control is worth it.
What is Annual Loss Expectancy (ALE)?
ALE is the expected monetary loss from a specific risk over one year. It is a core quantitative risk-analysis metric, calculated as the Single Loss Expectancy (the cost of one occurrence) multiplied by the Annualized Rate of Occurrence (how many times per year the event is expected). ALE turns a risk into an annual dollar figure you can compare against the cost of mitigating it.
What is the ALE formula?
ALE = SLE × ARO, where SLE (Single Loss Expectancy) is the cost of a single occurrence and ARO (Annualized Rate of Occurrence) is the expected number of occurrences per year. SLE is itself calculated as Asset Value × Exposure Factor, where the Exposure Factor is the percentage of the asset lost in a single event. So the full expansion is ALE = (Asset Value × Exposure Factor) × ARO.
Can you give an ALE example?
Suppose a customer database is valued at $500,000, a breach would compromise 40% of its value (Exposure Factor 0.4), so SLE = $500,000 × 0.4 = $200,000. If you expect such a breach once every five years, the ARO is 0.2. Then ALE = $200,000 × 0.2 = $40,000 per year. A control that reduces the likelihood or impact of that breach is worth considering if it costs less than the ALE reduction it delivers.
What are the limitations of ALE?
ALE is only as good as its inputs, and both SLE and ARO are estimates — especially ARO, since rare, high-impact events are hard to rate accurately. ALE also averages out variance, so it understates tail risk (a once-in-20-years catastrophic loss looks small annualized). Use it as a structured way to compare risks and justify controls, not as a precise prediction; pair it with scenario analysis for low-probability, high-impact events.