Annual Loss Expectancy Calculator
Annual loss expectancy turns a vague worry, a breach would be bad, into a budget number: this risk costs about $20,000 per year. The annual loss expectancy calculator on this page runs the standard quantitative risk chain used in security management, ALE equals ARO times SLE, and it runs it three ways: from a single loss figure you already know, from asset value and exposure factor, or as a test of whether a security control pays for itself.
That last test is where ALE earns its keep. A control that cuts expected losses by $15,000 a year and costs $8,000 a year is an easy yes. One that costs $30,000 to shave the same $15,000 is a no, however good it sounds in a sales pitch. The numbers below use one consistent case, a $200,000 customer database facing ransomware, so you can follow the chain from asset to verdict without switching examples.
Estimates, not predictions. ALE is only as honest as the asset value, exposure factor, and occurrence rate behind it, so keep the source of each input with the result when you present it.
Quick Answer
Key takeaways
- ALE = SLE x ARO. SLE itself is asset value times exposure factor. Three multiplications turn a threat into a yearly dollar figure.
- ARO is a rate, not a probability. It can be below 1 (rare events) or above 1 (events that happen several times a year).
- A control is worth buying, on ALE alone, when the ALE it removes is bigger than its annual cost.
- ALE ranks risks against each other. It does not predict what will actually happen next year.
The risk chain: AV, EF, SLE, ARO, then ALE
Five values build on each other in a fixed order, and the order is the whole method. Asset value comes first, exposure factor turns it into a single-incident cost, and occurrence rate spreads that cost across a year. Skip a step and the final number has no audit trail.
Asset value (AV). What the asset is worth if you had to replace or rebuild it, including the data on it and the revenue it supports. The worked example uses a $200,000 customer database.
Exposure factor (EF). The fraction of that value one incident destroys. Ransomware that encrypts the database but leaves backups partly usable might be 40%. A fire that takes the only copy is close to 100%.
Single loss expectancy (SLE) = AV x EF. $200,000 x 40% = $80,000. That is the price of one bad day, before you ask how often bad days happen.
Annualized rate of occurrence (ARO). How many times a year this threat is expected to land on this asset. Once every four years is 0.25. Incident history and industry reports are the honest sources here.
Annual loss expectancy (ALE) = SLE x ARO. $80,000 x 0.25 = $20,000 per year. This is the number a budget can use.
Worked example: ransomware against a customer database
The calculator is pre-filled with this case on the Full chain tab, and every figure below is what it returns. Asset value $200,000, exposure factor 40%, occurrence once every four years.
| Figure | Value |
|---|---|
| Asset value (AV) | $200,000 |
| Exposure factor (EF) | 40% |
| Single loss expectancy (AV x EF) | $80,000 |
| Annual rate of occurrence (ARO) | 0.25 |
| Annual loss expectancy (SLE x ARO) | $20,000 / year |
| Control test: ALE $20,000 to $5,000, control $8,000/yr | Net benefit $7,000 / year, payback 0.53 years |
Read the control line carefully, because it is the decision most teams actually face. The control does not remove the risk. It cuts the expected yearly cost from $20,000 to $5,000, a $15,000 reduction, and charges $8,000 a year for doing it. Net gain $7,000 a year, and the control pays for itself in about half a year of avoided expected loss. Flip the cost to $18,000 a year and the same control fails the test, which is exactly the conversation ALE is meant to force before money is spent. Teams weighing the downtime part of an incident can cost that piece separately with a business downtime calculator and fold it into the asset value.
Comparing risks on one scale
A single ALE tells you what one risk costs. A table of ALEs tells you where to work first, and it routinely overturns gut feeling, because a huge loss that almost never happens can cost less per year than a modest loss that happens constantly.
| Scenario (same SLE method) | SLE | ARO | ALE per year |
|---|---|---|---|
| Database ransomware (worked example) | $80,000 | 0.25 | $20,000 |
| Frequent phishing account takeover | $15,000 | 2 | $30,000 |
| Major breach, very rare | $2,000,000 | 0.02 | $40,000 |
| Laptop theft, small and common | $2,500 | 4 | $10,000 |
The phishing row is the lesson. Nobody puts a $15,000 incident at the top of a risk register, yet twice a year it quietly costs more than the ransomware case everyone worries about. The same expected-value thinking prices other uncertain losses: an annual insurance premium calculator shows what a risk costs when you transfer it instead of carrying it, and the comparison between premium and ALE is a fair first check on whether insurance is priced sensibly for that risk.
The two input traps that wreck ALE
Most wrong ALEs fail on wording, not arithmetic. The first trap is ARO phrasing. Once every four years gets typed in as 4, which multiplies the loss by four per year instead of spreading it over four years, a sixteen-fold error on the worked example ($320,000 instead of $20,000). The Quick tab helper exists for this: type the 4, press the button, and the ARO becomes 0.25.
The second trap is a tidy exposure factor. EF is a guess about how much of the asset one incident destroys, and real incidents spill over: a database breach can trigger fines and churn that exceed the database value, which is why this calculator accepts EF above 100% instead of capping it. Risk teams who also work with market risk will recognize the discipline from an equity risk premium calculator: the output is only defensible when every input has a stated source. Capital planners make the same point with a bank risk based capital calculator, where the buffer you hold is tied to a quantified exposure, not a feeling.
What competing calculators miss
Most pages ranking for this term are guides, not tools. They explain the formula well, several with good examples, and then leave you to do the chain by hand and keep the intermediate SLE on a sticky note.
Winning move 1: the whole chain in one place. Guide pages stop at ALE = SLE x ARO and assume you already know your SLE. Here the Full chain tab builds SLE from asset value and exposure factor, so the two inputs reviewers actually argue about are visible and changeable.
Winning move 2: the control test is built in. The value-of-control formula, ALE before minus ALE after minus control cost, appears in textbooks as a sentence. This page makes it a tab with a verdict and a payback period, because the buy or do not buy decision is the main reason anyone computes ALE.
Winning move 3: the ARO helper. No competing guide or tool we reviewed converts once every N years into an ARO for you, even though that phrasing error is the most common way ALE gets inflated. One button removes it.
One honest limit: ALE inherits the weakness of every expected-value method. It averages. A risk that costs $0 in most years and $2,000,000 in one bad year has the same ALE as a steady $40,000 a year drain, and those two risks feel very different to live with. Use ALE to rank and budget, then look at the worst case separately before you decide how much tail risk you can carry.
Frequently asked questions
Annual loss expectancy is the expected cost of one specific risk over one year. You get it by multiplying the cost of a single incident, the single loss expectancy or SLE, by how often that incident is expected each year, the annualized rate of occurrence or ARO. An SLE of $80,000 with an ARO of 0.25 gives an ALE of $20,000 per year.
Work through the chain in order. Single loss expectancy equals asset value multiplied by the exposure factor: $200,000 times 40% is an SLE of $80,000. Then ALE equals SLE multiplied by ARO: $80,000 times 0.25 is $20,000 per year. The Full chain tab in the calculator does both steps and shows each result.
It means the incident is expected once every four years on average. ARO is a rate per year, not a probability capped at 1. Once a year is 1, twice a year is 2, once every ten years is 0.1, and once every four years is 0.25. The helper in the Quick tab converts once every N years into the ARO for you.
Yes, in real loss modelling it can. A breach can cost more than the system it hits is worth once fines, downtime, notification, and lost business are counted. The calculator accepts exposure factors above 100 percent for that reason. If you use one, document why, because reviewers will ask.
There is no universal good or bad ALE. The number matters against two things: your risk appetite and the cost of reducing it. An ALE of $20,000 per year rarely justifies a $50,000 per year control for that risk alone, while an ALE of $400,000 per year usually justifies serious spending. Compare risks on ALE to decide where the budget goes first.
Compare the ALE before and after the control with what the control costs per year. Net benefit equals ALE before minus ALE after, minus the annual cost. In the worked example, cutting ALE from $20,000 to $5,000 with an $8,000 per year control gives a net benefit of $7,000 per year, so it is worth it on the numbers. The Control ROI tab runs this test.
ALE is an estimate built from estimates, so treat it as a planning figure, not a prediction. Its value is comparison: ranking risks, sizing a budget, and testing controls on the same scale. Garbage asset values or invented occurrence rates produce a precise looking but useless number, so source your ARO from incident history or industry data where you can.
SLE is the cost of one incident, once. ALE is that cost spread over a year using how often the incident happens. A $2,000,000 breach sounds like the top priority until an ARO of 0.02 turns it into $40,000 per year, while a $60,000 incident four times a year is $240,000 per year. SLE ranks severity, ALE ranks expected annual cost.
Add This Calculator to Your Website
References
- National Institute of Standards and Technology, "Guide for Conducting Risk Assessments, SP 800-30 Revision 1" - the US federal risk assessment guide behind quantitative loss estimates. NIST SP 800-30 Rev. 1: Guide for Conducting Risk Assessments. Accessed October 2026.
- National Institute of Standards and Technology, "Managing Information Security Risk, SP 800-39" - risk management at organization, mission, and system level. NIST SP 800-39: Managing Information Security Risk. Accessed October 2026.
- National Institute of Standards and Technology, Computer Security Resource Center Glossary, "Annualized Loss Expectancy" - definition of ALE as SLE multiplied by ARO. CSRC Glossary: Annualized Loss Expectancy. Accessed October 2026.
- FAIR Institute, "What is FAIR?" - overview of the Factor Analysis of Information Risk model, the open standard for quantifying cyber risk in financial terms. FAIR Institute: What is FAIR?. Accessed October 2026.
- Cybersecurity and Infrastructure Security Agency, "Risk Management" - CISA guidance on identifying, assessing, and prioritizing risk. CISA: Risk Management. Accessed October 2026.
- European Union Agency for Cybersecurity (ENISA), "Risk Management" - ENISA topic hub for risk management methods and the ENISA threat landscape work. ENISA: Risk Management. Accessed October 2026.
- National Institute of Standards and Technology, "Cybersecurity Framework" - the CSF functions used to organize controls whose cost ALE tests against. NIST: Cybersecurity Framework. Accessed October 2026.
- ISACA, "COBIT Framework" - governance framework that pairs risk appetite and control ownership with quantified risk. ISACA: COBIT Framework. Accessed October 2026.