How to Calculate Annualized Loss Expectancy (ALE)
Annualized Loss Expectancy is the oldest and simplest way to put a dollar figure on a security risk per year. This guide shows you the standard math end to end — from asset value and exposure factor to SLE, ARO and ALE — then how ALE connects to FAIR and how to use it to decide whether a control is worth its cost.
In plain words
Annualized Loss Expectancy (ALE) is the expected cost of a risk per year, in two steps. First, Single Loss Expectancy (SLE) = Asset Value × Exposure Factor — the dollar loss each time the event happens. Then ALE = SLE × Annualized Rate of Occurrence (ARO) — the per-event loss times how often you expect it per year. PlayCISO has a free, browser-based FAIR/ALE tool that does the math for you.
ALE lets you compare very different risks on one footing and weigh them against the cost of a control. Its limit is that a single number hides uncertainty — which is exactly why FAIR works in ranges and distributions instead of false precision.
Step by step
- 1
Define the asset and its value (AV)
Start with one asset and one loss scenario — not your whole estate at once. The asset value (AV) is what you stand to lose if that asset is fully compromised: the replacement or rebuild cost, the revenue it generates, the data it holds, plus the regulatory and reputational exposure tied to it. Be explicit about what is in and out of the number so the rest of the math stays honest. For example, if a customer database underpins a line of business, its AV is far more than the cost of the server it runs on.
- 2
Estimate the Exposure Factor (EF)
The Exposure Factor (EF) is the percentage of the asset value you would lose if the event actually occurs — a number between 0 and 1 (0% to 100%). A ransomware event that encrypts a database with good backups might represent a 30% loss; a breach that destroys the asset and triggers fines might be 80-90%. EF forces you to separate "the asset is worth X" from "this particular event only destroys part of X."
- 3
Compute Single Loss Expectancy (SLE = AV × EF)
Single Loss Expectancy is the dollar loss from one occurrence of the event: SLE = Asset Value × Exposure Factor. For example, if AV is $500,000 and the EF for a given incident is 0.4, the SLE is $200,000 — the expected cost each time that event happens, before you account for how often it happens.
- 4
Estimate the Annualized Rate of Occurrence (ARO)
The Annualized Rate of Occurrence (ARO) is how many times you expect the event per year. It can be a fraction: an event you expect once every five years has an ARO of 0.2; one you expect twice a year has an ARO of 2. ARO is usually the hardest number to pin down — lean on your own incident history, industry breach reports, threat intelligence and expert judgement, and write down the basis for the figure.
- 5
Compute Annualized Loss Expectancy (ALE = SLE × ARO)
Annualized Loss Expectancy is the expected yearly cost of the risk: ALE = SLE × ARO. Continuing the example, an SLE of $200,000 with an ARO of 0.2 (once every five years) gives an ALE of $40,000 per year. ALE is the figure that lets you compare very different risks on one common footing — an annual, monetary expected loss.
- 6
Compare ALE to the cost of a safeguard
The point of ALE is to inform a decision. Estimate the ALE after a proposed control is in place, then compare the reduction in ALE to the control’s annualized cost. A rough return-on-security-investment (ROSI) is (ALE before − ALE after − annual cost of control) ÷ annual cost of control. If a $15,000/year control cuts ALE from $40,000 to $5,000, it removes $35,000 of expected loss for $15,000 — a clear win; if it only trims ALE by $5,000, the control is not worth it.
- 7
Acknowledge the uncertainty — prefer ranges to false precision
A single-point ALE hides how uncertain its inputs are, and a precise-looking number invites unwarranted confidence. This is why FAIR and modern quantitative risk work in ranges and distributions rather than one figure: you estimate minimum, most-likely and maximum values for loss magnitude and frequency, then run a Monte Carlo simulation to produce a loss distribution. Use single-point ALE for quick triage and communication, but move to ranges when the decision is expensive or contested.
Enter asset value, exposure factor and rate of occurrence and get SLE, ALE and a control cost-benefit view in your browser — no spreadsheet required.
Related
The interactive quantitative-risk tool this guide walks you through.
Cyber insurance premium estimatorTurn your expected-loss numbers into a view of what risk transfer should cost.
How to build a cybersecurity budgetUse ALE and control cost-benefit to justify where the security spend goes.
Vendor risk toolQuantify third-party exposure that feeds the asset values and scenarios in your ALE math.
Frequently asked questions
What is the difference between SLE, ARO and ALE?
SLE (Single Loss Expectancy) is the dollar loss from one occurrence of an event — Asset Value times Exposure Factor. ARO (Annualized Rate of Occurrence) is how many times per year you expect that event, often a fraction. ALE (Annualized Loss Expectancy) multiplies the two: SLE × ARO gives the expected loss per year. SLE answers "how bad each time," ARO answers "how often," and ALE combines them into an annual, comparable figure.
How does ALE relate to FAIR?
ALE is the classic single-point version of the same idea FAIR formalizes. FAIR (Factor Analysis of Information Risk) breaks risk into loss event frequency and loss magnitude, estimates each as a range rather than one number, and runs a Monte Carlo simulation to produce a distribution of annualized loss. You can think of ALE as the expected value at the center of a FAIR analysis — FAIR adds the spread and the confidence that a single ALE number throws away.
Is ALE still used, or is it outdated?
It is still widely used and taught — it appears in CISSP material and remains a fast, common-language way to compare risks and justify a control. Its weakness is that a single-point number hides uncertainty and can imply precision the inputs do not support. The modern practice is to keep ALE for quick triage and executive communication, but to use range-based methods like FAIR for high-stakes decisions where the inputs are uncertain.
How do I estimate ARO when I have no historical data?
Combine several imperfect sources rather than trusting one: your own incident and near-miss history, industry breach and threat reports for your sector, vendor and ISAC threat intelligence, and structured expert judgement from the people who run the controls. Estimate a range (how rare at best, how frequent at worst) instead of a single rate, document your reasoning, and revise the figure as real events accumulate. A defensible, written-down estimate beats a precise-looking number with no basis.
Should I report a single ALE number or a range?
Use a single number for a quick comparison or a headline, but prefer a range for anything expensive or contested. A single point implies a confidence the inputs rarely justify and invites arguments over the exact figure instead of the decision. A range — or a loss distribution from a FAIR-style simulation — communicates the uncertainty honestly and usually leads to a better conversation about risk appetite and how much to spend.
How does ALE drive a control decision?
Estimate the ALE for the risk as it stands, then estimate the ALE after a proposed control is in place. The difference is the expected annual loss the control removes. Compare that reduction to the control’s annualized cost: if the control removes far more expected loss than it costs, it is justified; if it barely moves ALE, the money is better spent elsewhere. This is the cost-benefit logic behind return on security investment (ROSI).