Risk: SLE & Annual Loss Expectancy Calculator

Understanding the SLE and annual loss expectancy calculator — concept and principle

Annual loss expectancy (ALE) is the classic way to put a yearly money figure on a security risk. It answers "how much does this threat cost us on average per year?" and, by comparing before and after a safeguard, "is this control worth its price?". It is a staple of security risk courses and budget discussions.

The control cuts expected losses from 30,000 to 7,500 a year, which beats its 20,000 cost by 2,500.

How it is calculated

Single loss expectancy: SLE = AV × EF, where AV is the asset value and EF is the exposure factor, the percentage of the asset lost in one incident.
Annual loss expectancy: ALE = SLE × ARO, where ARO is the annualised rate of occurrence, the expected number of incidents per year (0.2 means once every five years).
ALE after control: SLE × ARO after the control is in place.
Control value per year: ALE before − ALE after − annual cost of the control.

The principle

ALE is an expected value: the loss per event times the average number of events. If a 150,000 loss happens on average once every five years, spreading it over time gives 30,000 per year. A control is worth buying when the yearly loss it removes is larger than what it costs each year. The model assumes that losses are roughly the same each time, that incidents are independent and that the rates are reasonably known. Many controls lower ARO (prevention), others lower EF (limiting damage, such as backups).

Worked example

Inputs: asset value 500,000, EF 30%, ARO 0.2, control cost 20,000 per year, ARO after control 0.05.
SLE = 500,000 × 0.30 = 150,000.
ALE before = 150,000 × 0.2 = 30,000.
ALE after = 150,000 × 0.05 = 7,500.
Control value = 30,000 − 7,500 − 20,000 = 2,500 per year.

Each point is the calculator re-run with only “Asset value” changed; the gold point is the default example. Change the inputs above and this chart follows your numbers.

Asset value	ALE before
125,000	7,500
250,000	15,000
375,000	22,500
500,000	30,000
625,000	37,500
750,000	45,000
1e+06	60,000

How to read the result

A positive control value means the safeguard is expected to save more than it costs; a negative value means it costs more than the average loss it prevents. Here the margin of 2,500 is small compared with the uncertainty of the ARO estimates, so a small change in assumptions could flip the decision. Test the result with optimistic and pessimistic inputs before deciding.

Common mistakes

Valuing only the hardware, ignoring data, downtime, legal costs and reputation.
Treating ARO as a probability; it is a rate and can exceed 1 for frequent events.
Expecting the average to describe a bad year: a rare event yields zero loss in most years and a large loss in one.

Keep in mind: ALE is a simplified expected-value model and not financial or insurance advice. Rare, high-impact events and regulatory obligations may justify controls even when the ALE comparison is negative.

Frequently asked questions

What is a good exposure factor?

It depends on the scenario: a ransomware attack with good backups might destroy a small share of value, while a total data breach might approach 100%.

Where do ARO estimates come from?

From your own incident history, industry breach reports, insurer data and expert judgement; record the source of each number.

Is the control value the same as ROSI?

Closely related. Return on security investment divides the net benefit by the control cost: here 2,500 ÷ 20,000 = 12.5%.

Sources: NIST SP 800-30 Rev. 1, Guide for Conducting Risk Assessments · ISO/IEC 27005, Information security risk management

Checked 8 Nov 2026. Standard formulas and RFC/IEEE definitions, computed locally in your browser — nothing you type is sent anywhere.

Your numbers