ALE Calculator (SLE × ARO)
ALE in cyber security is the money you can expect to lose to one risk in an average year: ALE = SLE × ARO, where SLE = asset value × exposure factor. Enter the asset value, the share of it one event would cost and how often the event happens, and this calculator shows each step of the working. Add more risks to rank them, and check whether a control pays for itself.
1. Describe the risk
EF is the share of the asset value lost in one event. A total loss is 100%.
2. Your result
- SLE = AV × EF
= $500,000 × 0.4 = $200,000 - ARO (once every 5 years)
= 1 ÷ 5 = 0.2 per year - ALE = SLE × ARO
= $200,000 × 0.2 = $40,000 per year
In the year it happens, this event costs the full SLE of $200,000, which is 5 times the ALE. Keep that in mind when you compare it with the budget for one year.
3. Is a control worth it?
Value of the control = (ALE before − ALE after) − annual cost of the control. Enter what the risk looks like with the control in place: a lower exposure factor, a lower frequency, or both.
4. Compare risks
Add each risk from step 1. The table ranks them by ALE and adds them up. Edit sends a row back to the calculator.
Before you put this in a board paper
- Every input is a single point estimate. A precise-looking ALE hides how unsure the asset value, exposure factor and frequency really are.
- ARO is often a guess, especially for rare events. Changing "once every 10 years" to "once every 20 years" halves the ALE.
- ALE averages the loss across years. A rare, severe event shows a small ALE, but in the year it happens you pay the full SLE.
- Rows that describe overlapping scenarios (the same data lost two ways) double-count when you add them up.
- For a range instead of one number, use a FAIR-style model that works with frequency and magnitude ranges.
Need a range rather than one number? Use the FAIR risk calculator, which works from threat frequency, vulnerability and primary and secondary loss.
What this tool does
- ALE (annualized loss expectancy) is the expected loss from one risk per year: ALE = SLE × ARO.
- SLE (single loss expectancy) is the cost of one event: SLE = asset value × exposure factor.
- ARO is how many times a year you expect the event. Type "once every N years" or "N times a year" and the calculator converts it.
- Add several risks to rank them by ALE with a total, and test a control with (ALE before − ALE after) − annual control cost.
- Pick your currency and copy the whole working as a plain-text report. Runs in your browser; nothing is uploaded.
The ALE formula, term by term
Fully expanded, ALE = (asset value × exposure factor) × ARO. The example column is the database breach from Annual Loss Expectancy explained.
| Term | What it means | Formula | Example |
|---|---|---|---|
| Asset value (AV) | What the asset is worth to you, including the data on it and the cost of recovery. | Your estimate | 500,000 |
| Exposure factor (EF) | The share of the asset value lost in one event, from 0% to 100%. | Your estimate | 40% |
| Single loss expectancy (SLE) | The cost of one occurrence. | SLE = AV × EF | 500,000 × 0.4 = 200,000 |
| Annualized rate of occurrence (ARO) | How many times a year you expect the event. | 1 ÷ years between events, or events per year | Once in 5 years = 0.2 |
| Annualized loss expectancy (ALE) | The expected loss per year from this risk. | ALE = SLE × ARO | 200,000 × 0.2 = 40,000 a year |
Converting frequency to ARO
For rare events, ARO = 1 ÷ the number of years between events. For frequent events, ARO is the number of times a year. ARO can be above 1.
| How often | ARO |
|---|---|
| Once every 100 years | 0.01 |
| Once every 20 years | 0.05 |
| Once every 10 years | 0.1 |
| Once every 5 years | 0.2 |
| Once every 2 years | 0.5 |
| Once a year | 1 |
| Four times a year (quarterly) | 4 |
| Once a month | 12 |
Is a control worth it? The safeguard value formula
The standard cost-benefit check in CISSP study material compares the ALE with and without the control: (ALE before − ALE after) − annual cost of the control = value of the control. A positive result is the yearly saving. A negative result means the control costs more than the expected loss it removes.
Worked example: the database breach has an ALE of 40,000 a year. A control that leaves the exposure factor at 40% but cuts the frequency from once every 5 years to once every 20 years brings the ALE down to 500,000 × 0.4 × 0.05 = 10,000. If the control costs 15,000 a year, its value is (40,000 − 10,000) − 15,000 = 15,000 a year. At 35,000 a year it would be −5,000, and the numbers alone would not justify it. Legal duty, contracts and due care can still make a control necessary.
The limits of ALE
- Every input is a single point estimate. A precise-looking ALE hides how unsure the asset value, exposure factor and frequency really are.
- ARO is often a guess, especially for rare events. Changing "once every 10 years" to "once every 20 years" halves the ALE.
- ALE averages the loss across years. A rare, severe event shows a small ALE, but in the year it happens you pay the full SLE.
- Rows that describe overlapping scenarios (the same data lost two ways) double-count when you add them up.
- For a range instead of one number, use a FAIR-style model that works with frequency and magnitude ranges.
Classic ALE and FAIR answer the same question in different ways. This page uses the single-number classic formula people are taught for exams and quick comparisons. The FAIR risk calculator breaks the loss into threat event frequency, vulnerability, and primary and secondary loss, and returns a range. For the difference between one event and a year, read Single loss expectancy vs ALE.
Frequently asked questions
What is ALE in cyber security?
ALE stands for annualized loss expectancy (also written annual loss expectancy). It is the amount you can expect to lose to one specific risk in an average year, in money. It turns a "high, medium, low" rating into a figure you can compare with the yearly cost of a control. ALE is a classic quantitative risk analysis formula and is taught in CISSP study material.
What is the ALE formula?
ALE = SLE × ARO. SLE is the single loss expectancy, the cost of one event. ARO is the annualized rate of occurrence, how many times a year you expect the event. Because SLE = asset value × exposure factor, the full formula is ALE = (AV × EF) × ARO. Example: 500,000 × 40% = 200,000 SLE; once every 5 years is an ARO of 0.2; ALE = 200,000 × 0.2 = 40,000 a year.
How do you calculate single loss expectancy?
Multiply the asset value by the exposure factor: SLE = AV × EF. The exposure factor is the share of the asset value lost in one event, from 0% to 100%. A 2,500 laptop that is lost outright has an EF of 100% and an SLE of 2,500. A 500,000 database where one breach costs 40% of its value has an SLE of 200,000.
Is it annual or annualized loss expectancy?
Both names are used for the same thing, and both are abbreviated ALE. Likewise ARO is written as annual or annualized rate of occurrence. The maths is the same: the single loss expectancy multiplied by how often the event is expected per year.
How do you convert "once every 10 years" to ARO?
Divide 1 by the number of years between events. Once every 10 years is 1 ÷ 10 = 0.1. Once every 5 years is 0.2, once a year is 1. If the event happens several times a year, the ARO is simply that count: six times a year is an ARO of 6. ARO can be above 1.
How do you know if a security control is worth the cost?
Work out the ALE before the control and the ALE after it, then subtract the annual cost of the control: value = (ALE before − ALE after) − annual control cost. A positive value means the control removes more expected loss each year than it costs. A negative value means it does not pay for itself on these numbers, though law, contracts or due care may still require it.
More free security tools
The tools people use most on PlayCISO.
Catch injected instructions hiding in content your AI agent should only read.
Score your readiness against the first international standard for AI security threats.
Critical CVEs across 21 major vendors, month by month — and what the 2026 surge means.
Build an ordered ruleset, replay labelled packets and catch shadowed and any-to-any rules.
Self-assess all six Functions, from Govern to Recover, and see your weakest one.
Search 172 threat actors across Microsoft, CrowdStrike, Mandiant and community names.