SLE Calculator
Single loss expectancy is the dollar figure at the heart of quantitative risk analysis: what one occurrence of a threat will cost you. This SLE calculator computes it from the asset value and exposure factor, extends it to an annualized loss expectancy with the annual rate of occurrence, and finishes the job most tools skip: a plain-dollar verdict on whether a security control pays for itself.
Optional. Adds the annualized loss expectancy (ALE).
Optional. Adds the cost-benefit verdict.
Result
Quick Answer
For a customer database valued at $50,000 with a 30% exposure factor, one breach costs $15,000.00 (the SLE). If that breach happens about once every two years, the annualized loss expectancy is $7,500.00 per year. A control costing $3,000 a year pays for itself here, saving about $4,500.00 a year on loss avoidance alone.
Key takeaways
- SLE = asset value × exposure factor. It prices one incident, never a year of them.
- ALE = SLE × annual rate of occurrence. That yearly figure is what security budgets are built against.
- A control is worth buying on loss math alone when its annual cost sits below the ALE; above it, it needs a compliance, reputation or safety justification.
- The exposure factor is threat-specific, not asset-specific: one asset can carry very different EFs for different threats.
How to use this calculator
Enter the asset value in dollars and the exposure factor as a percentage from 0 to 100, then click Calculate for the SLE. Add the annual rate of occurrence for the ALE, and add the control’s yearly cost for the worth-it verdict. The two optional fields can be left blank: without an ARO you get SLE only, and without a cost you get SLE plus ALE with no verdict. Use Reset to restore the worked-example values.
The tool accepts commas in the asset value, so 50,000 and 50000 give the same answer. Negative values are rejected with a plain message, and an exposure factor above 100 is refused: the calculator keeps results conservative, as explained in the FAQs.
The formulas, worked through
Three formulas chain together, and the calculator shows each one with your own numbers substituted so the answer is auditable. SLE = asset value × exposure factor. With the worked-example inputs: $50,000.00 × 30% = $15,000.00. That is the expected cost of one breach, and nothing more.
ALE = SLE × annual rate of occurrence. The ARO is how many times per year the threat is expected to materialize: 1 for yearly, 0.5 for once every two years, 0.1 for once a decade. Here: $15,000.00 × 0.5 = $7,500.00 per year. This is the figure a security budget is actually built against, and it is the one the companion annual loss expectancy calculator centers on.
Control test: worth it if annual control cost < ALE. The comparison is an expected-value judgment at heart: the control earns its keep only when its yearly cost sits below the expected loss, the same arithmetic an expected value calculation performs. The gap is the verdict: $7,500.00 expected loss minus $3,000.00 control cost leaves $4,500.00 saved per year. When the cost exceeds the ALE, the tool says so honestly instead of pretending the math works: some controls are still justified for compliance, customer trust or safety, but the loss column does not cover them.
Worked example: customer database breach
A customer database is valued at $50,000, counting the data itself, regulatory exposure and lost revenue. A breach is expected to destroy 30% of that value, and breaches of this type happen about once every two years. The decision chain runs in three steps.
Step 1: SLE
$50,000 × 30% = $15,000.00
one breach
Step 2: ALE
$15,000 × 0.5 = $7,500.00
per year
Step 3: verdict
$3,000 control < $7,500 ALE
Worth it: saves $4,500/yr
Enter AV = 50000, EF = 30, ARO = 0.5 and control cost = 3000 into the calculator above and every one of these numbers reproduces exactly, including the green Worth it badge.
Choosing an exposure factor
The exposure factor is the hardest input because it describes a specific threat against a specific asset, not the asset alone. Anchor it in the actual damage mechanism, recent incident data and what existing controls already mitigate. These illustrative ranges reflect common industry practice, not guarantees.
The same asset can carry several EFs at once, one per threat, which is why a data breach cost calculator treats the breach scenario separately from the hardware underneath it. When the number is uncertain, run the tool twice with a low and high EF and present the range; that honesty is exactly what NIST’s risk assessment guidance asks for.
What competing calculators miss
We tested the dedicated SLE tools ranking for this keyword. Most stop at the SLE number: enter asset value and exposure factor, get a dollar figure, done. One competitor adds an ARO field, and a stronger one adds ALE plus a 10-year exposure view, but none of the interactive tools answers the question the numbers exist for: is this control worth buying? They leave you to subtract the control cost yourself. This calculator completes the chain that risk textbooks teach, SLE to ALE to cost-benefit, in a single pass, prints each formula with your numbers substituted so the result is auditable, and gives a plain-language verdict with the dollar gap instead of a bare figure.
One more gap worth naming: a popular explainer-style tool defines SLE as annual frequency times exposure value, which is not the standard definition and produces a different number than every textbook. The standard chain, used by CISSP and Security+ study material alike, is SLE = AV × EF, then ALE = SLE × ARO. This page and its tool use the standard chain everywhere.
Frequently asked questions
The expected monetary loss from one occurrence of a specific threat against a specific asset: SLE = asset value × exposure factor. It prices a single incident and deliberately says nothing about how often the threat happens; that is what ARO and ALE are for.
SLE is per incident; ALE (annualized loss expectancy) is per year: ALE = SLE × annual rate of occurrence. Use SLE to size one incident, ALE to build a yearly security budget and to justify controls.
Assess the specific threat against the specific asset: what percentage of the asset’s value would one occurrence destroy, given the controls you already have? Use incident history, vendor data and tabletop estimates; the guidance table above gives typical ranges for common scenarios.
In textbook treatments it can, when secondary losses such as fines, lawsuits and reputation damage exceed the asset’s own value. This calculator caps EF at 100% to keep results conservative; note larger consequential losses separately.
Express it as a fraction of a year: once every two years is 0.5, once every four years is 0.25, once a decade is 0.1. ARO can also exceed 1 for threats that strike multiple times per year, such as monthly phishing-driven incidents at 12.
On pure loss math, when its annual cost is below the ALE. Above the ALE it needs another justification: a compliance mandate, customer trust, safety, or strategic risk reduction. The calculator states the verdict and the dollar gap either way.
Because the numbers exist to support a decision. Most SLE tools stop at the dollar figure and leave you to do the subtraction against the control cost yourself; the verdict here, Worth it, Break-even or Not worth it on loss alone, completes the chain in the same pass.
Add This Calculator to Your Website
Embed this calculator on your own site with the code below. Pick a size to preview it live, then copy the code.
Powered by Calculator Zilo
References
- National Institute of Standards and Technology. Guide for Conducting Risk Assessments (SP 800-30 Rev. 1). Accessed October 23, 2026.
- Cisco Learning Network. CCNA Security Risk Quantitative Assessment. Accessed October 23, 2026.
- TechJack. Understanding Security Risk: SLE, ARO and ALE. Accessed October 23, 2026.
- TiltedLunar123, DEV Community. SLE, ARO, ALE: the Security+ Risk Math. Accessed October 23, 2026.
- ExamGuides. CompTIA Security+: Risk Management Processes and Concepts. Accessed October 23, 2026.
- ClimbTheLadder. How to Calculate Single Loss Expectancy (SLE). Accessed October 23, 2026.