# Annual Loss Expectancy (ALE), Explained — With the Formula

> Annual Loss Expectancy (ALE) estimates the expected yearly cost of a risk. The ALE formula, how SLE and ARO feed into it, a worked example, and how to use it for security decisions.

Source: https://playciso.com/blog/annual-loss-expectancy-explained · Published: 2026-09-26 · Publisher: PlayCISO (https://playciso.com)

---

Annual Loss Expectancy (ALE) is the metric that turns "this risk feels serious" into a number you can put next to the price of a control. It is the expected cost of a risk over a year, and its formula is simple enough to do on a whiteboard — which is exactly why it is one of the most-searched concepts in security risk management. ## The formula **ALE = SLE × ARO** - SLE (Single Loss Expectancy): the cost of one occurrence. SLE = Asset Value × Exposure Factor, where the Exposure Factor is the fraction of the asset lost in a single event. - ARO (Annualized Rate of Occurrence): how many times per year you expect the event. Once every five years = 0.2. Fully expanded: **ALE = (Asset Value × Exposure Factor) × ARO**. ## A worked example A customer database is valued at $500,000. A breach would compromise 40% of its value, so the Exposure Factor is 0.4 and **SLE = $500,000 × 0.4 = $200,000**. You estimate such a breach happens once every five years, so **ARO = 0.2**. Therefore **ALE = $200,000 × 0.2 = $40,000 per year**. If a control that meaningfully reduces that risk costs less than $40,000/year, it is likely worth it; if it costs far more, the numbers say think again. ## Why ALE is useful It converts risks into a common currency — annual dollars — so you can rank them and compare each against the cost of mitigation. That is the core of cost-justifying security spend to a CFO. ## The caveats ALE is only as good as its inputs, and ARO in particular is hard to estimate for rare events. It also averages away variance, so it understates catastrophic tail risk (a once-in-20-years disaster looks small annualized). Use ALE to structure comparisons and justify controls — and pair it with scenario analysis for low-probability, high-impact events. For the difference between one-off and annualized loss, see [SLE vs ALE](/blog/single-loss-expectancy-vs-ale). Calculate ALE for your own scenarios with the free [ALE calculator →](/tools/fair-ale), and estimate the SLE side with the [Breach Cost calculator](/tools/breach-cost). ## Frequently asked questions **What is ALE?** The expected monetary loss from a risk over one year — a core quantitative risk metric. **What is the formula?** ALE = SLE × ARO, and SLE = Asset Value × Exposure Factor. **Example?** $500k asset × 0.4 exposure = $200k SLE; × 0.2 ARO = $40k/year ALE. **Limitations?** Inputs are estimates (especially ARO), and it understates tail risk — pair it with scenario analysis.