Annual Loss Expectancy (ALE) Calculator
Put a dollar figure on a risk. This calculator quantifies ALE in cyber security — Annual Loss Expectancy (ALE = SLE × ARO) — using a simplified Open FAIR model, so you can express risk in dollars for the board and compare controls by risk-reduced-per-dollar.
Simplified Open FAIR model (The Open Group / FAIR Institute). This is an estimation model for decision support — the ±50% range reflects the uncertainty inherent in any risk estimate. It is not a prediction; use ranges and your own calibrated inputs, and treat the output as an input to judgement, not a result.
Loading…
Sample report · illustrative data
Sample result: annualized loss expectancy
Example inputs: loss event "Ransomware on core systems", 2 threat events a year, 30% vulnerability, $500,000 primary loss, $2,000,000 secondary loss at 40% probability.
Annualized Loss Expectancy
- Loss Event Frequency
- 0.6 per year (2 x 30%)
- Single loss
- $1,300,000 ($500,000 + $2,000,000 x 40%)
- ALE
- $780,000 per year
- Range (plus or minus 50%)
- $390,000 to $1,170,000
Control ROI (example control: $150,000 a year, frequency -50%, magnitude -20%)
- Residual ALE
- $312,000
- Risk reduced
- $468,000
- Risk reduced per $1 spent
- $3.12
- Net benefit
- $318,000
Simplified Open FAIR model. The output is an estimate for decision support, not a prediction.
Made-up example data. Your own run uses your inputs. Downloads of the full report need Pro.
What is ALE in cyber security?
ALE (Annualized Loss Expectancy) is the average amount of money you should expect to lose from a particular risk over one year. It converts a fuzzy “high / medium / low” risk rating into a dollar figure that a board or budget owner can actually act on, which is why it sits at the heart of quantitative risk methods like FAIR and appears in certifications such as CISSP.
It is built from two ideas:
- SLE (Single Loss Expectancy) — the dollar loss from one occurrence of the event: SLE = Asset Value × Exposure Factor.
- ARO (Annual Rate of Occurrence) — how many times per year you expect it to happen.
- ALE = SLE × ARO — the annualized figure the calculator above returns in dollars.
Comparing the ALE before and after a control is the cleanest way to justify security spend: if a $40,000 control cuts a $250,000 ALE to $50,000, that is a $200,000/yr risk reduction for $40,000. Use the calculator's control-ROI mode to rank mitigations, and pair it with the Breach Cost Calculatorand the NIST CSF 2.0 assessment to turn the numbers into a plan. Just need SLE × ARO worked step by step for an exam question? Use the annualized loss expectancy calculator. For the full method, read Annual Loss Expectancy explained and Single Loss Expectancy vs ALE.
FAQ
What is ALE in cyber security?
ALE stands for Annual Loss Expectancy (also written Annualized Loss Expectancy): the average dollar amount you should expect to lose from a specific risk over one year. It turns a vague “high / medium / low” rating into a number leadership can act on, and is a core quantitative-risk concept used in FAIR and in certifications like CISSP. It is calculated as ALE = SLE × ARO.
What is the annual loss expectancy (ALE) formula?
ALE = Single Loss Expectancy (SLE) × Annual Rate of Occurrence (ARO), where SLE = Asset Value × Exposure Factor. This calculator does the math and expresses the result in dollars, with a ±range to reflect the uncertainty in any estimate.
What is the difference between SLE and ALE?
SLE is the dollar loss from a single event; ALE annualizes it by multiplying by how often the event is expected each year (ARO). The calculator shows both, plus the control-ROI comparison.
More security tools
The tools people use most on PlayCISO.
Catch injected instructions hiding in content your AI agent should only read.
Score your readiness against the first international standard for AI security threats.
Critical CVEs across 21 major vendors, month by month — and what the 2026 surge means.
Build an ordered ruleset, replay labelled packets and catch shadowed and any-to-any rules.
Self-assess all six Functions, from Govern to Recover, and see your weakest one.
Search 172 threat actors across Microsoft, CrowdStrike, Mandiant and community names.