Annual loss expectancy formula: ALE = SLE × ARO, with a worked example

The ALE formula

SLE = AV × EF and ALE = SLE × ARO, so ALE = AV × EF × ARO.

• Asset value (AV): what the asset is worth to the business. Include the cost to replace or rebuild it and the revenue or data that depend on it, not just the price of the hardware.
• Exposure factor (EF): the share of the asset value lost in one incident, from 0% to 100%.
• Single loss expectancy (SLE): the dollar loss of one incident.
• Annualized rate of occurrence (ARO): how many times the incident is expected per year. Once every five years is 0.2, four times a year is 4.

These terms are standard in quantitative risk analysis and appear in the CISSP and CompTIA Security+ exams, which typically give you three of the values and ask for the fourth, or for the value of a safeguard.

Working through the example

The file server and the data on it are worth $400,000 to the retailer. A ransomware attack would destroy 60% of that value through recovery work, lost orders and data that cannot be restored, so the SLE is $400,000 × 60% = $240,000. Such an attack is expected about once in five years, an ARO of 0.2, which gives an ALE of $48,000.

The other rows work the same way. A DDoS attack costs only 2% of the web shop's $900,000 value, $18,000 per outage, but it happens 1.5 times a year, so its ALE is $27,000. Four stolen laptops a year at $2,500 each cost $10,000. Added up, the five scenarios give a total ALE of $130,000, a first estimate of the yearly loss exposure. Sorted by ALE, ransomware ranks first, then the database breach ($30,000) and the DDoS attacks ($27,000).

Worked example: ALE for five threat scenarios and one safeguard

Asset values, exposure factors, AROs and the safeguard's figures are the yellow inputs. SLE, ALE and the value of the safeguard are formulas.

Worked example: ALE for five threat scenarios and one safeguard

	A	B	C	D	E	F
1	Threat scenario	AV ($)	EF	SLE ($)	ARO	ALE ($)
2	Ransomware on file server	400,000	60%	240,000	0.20	48,000
3	Customer database breach	1,200,000	25%	300,000	0.10	30,000
4	DDoS on the web shop	900,000	2%	18,000	1.50	27,000
5	Business email compromise	150,000	40%	60,000	0.25	15,000
6	Stolen laptop	2,500	100%	2,500	4.00	10,000
7	Total ALE: expected loss per year					130,000
8
9	Safeguard for row 2: immutable backups and endpoint detection
10	ALE before the safeguard					48,000
11	Exposure factor after					15%
12	ARO after					0.10
13	ALE after = AV × EF after × ARO after					6,000
14	Annual cost of the safeguard					22,000
15	Value of the safeguard per year					20,000
16	Return on security investment (ROSI)					90.9%

The company and all figures are fictional and for teaching only.

Estimating the ARO and the exposure factor

Your own incident history is the best starting point for the ARO: ARO = events observed ÷ years observed. Twenty stolen laptops in five years give an ARO of 4, the value in the example. For rare events with no history, use industry reports, insurers' data and threat intelligence, and write down where each number comes from.

For the exposure factor, walk through a single incident: restore and forensics costs, downtime, notification of customers, fines and lost business. Remember that ALE is an average, not a forecast. In most years the ransomware row costs nothing, and in a bad year it costs $240,000. Because the inputs are estimates, many teams use three-point ranges instead of single values.

Is the safeguard worth it? ALE before and after

Value of a safeguard = ALE before − ALE after − annual cost of the safeguard

Immutable backups and endpoint detection are proposed against ransomware. Faster recovery lowers the exposure factor from 60% to 15%, and better detection halves the ARO from 0.2 to 0.1. The ALE after is $400,000 × 15% × 0.1 = $6,000. The safeguard removes $48,000 − $6,000 = $42,000 of expected loss per year and costs $22,000 a year, so its value is $20,000 a year and it is worth buying. The return on security investment, value ÷ cost, is 90.9%.

The annual cost includes licences, the staff time to run the control and any one-off cost spread over its useful life. If a safeguard needs a large investment up front, discount the yearly values as in an NPV and IRR calculation. Note also the ceiling: a safeguard can never be worth more than the ALE it removes. No control against stolen laptops that costs more than $10,000 a year can pay off on these numbers, although legal duties may still require one, such as disk encryption.

Exam tips for CISSP and Security+

• Convert frequencies into a yearly rate: "once every four years" is an ARO of 0.25, "twice a month" is 24.
• Work backwards when needed: SLE = ALE ÷ ARO, and EF = SLE ÷ AV.
• The value of a safeguard uses the ALE after the control, not the SLE, and always subtracts the annual cost.
• When a control costs more than the reduction in ALE, the expected answer is usually to accept, transfer (insure) or avoid the risk instead.

Limits of a single ALE number

ALE multiplies two uncertain estimates and turns them into one tidy average. It hides the tail: a rare event with a huge loss can have the same ALE as a frequent small one, although a business may survive only one of them. It also ignores that incidents can be linked. Frameworks such as FAIR (Factor Analysis of Information Risk) and Monte Carlo simulation work with ranges for frequency and loss for that reason. ALE remains the common language for comparing risks and controls in dollars, and a risk register ranked by ALE is a sound place to start.

Common mistakes

• Multiplying the asset value by the ARO. One incident only destroys the exposure-factor share of the asset. Use SLE × ARO.
• Treating the ARO as a probability. It is a yearly frequency and can be above 1: an incident twice a year has an ARO of 2.
• Turning "once in ten years" into 10. The ARO is per year, so it is 1 ÷ 10 = 0.1.
• Forgetting the cost of the safeguard. ALE before − ALE after is only the loss the control removes. Subtract its annual cost to get its value.
• Counting only the hardware in the asset value. Downtime, lost revenue, data recovery and breach costs are usually larger than the device itself.
• Adding up SLEs for the total exposure. The yearly figure is the sum of the ALEs.