Annualized loss expectancy, or ALE, is the expected loss per year from one kind of event. You get it by multiplying the single loss expectancy (SLE) by the annual rate of occurrence (ARO). It turns a vague worry into a number you can compare with the price of a control.
The three terms
Single loss expectancy is the loss from one occurrence. A common way to build it is asset value multiplied by an exposure factor, the share of the asset you lose when the event happens.
Annual rate of occurrence is how often you expect the event in a year. A value of 1 means once a year on average, 0.1 means once a decade.
Annualized loss expectancy is the product: ALE = SLE x ARO.
A worked example
The textbook example uses an asset worth 100,000 with an exposure factor of 25 percent. The SLE is 25 percent of 100,000, which is 25,000. If the event is expected once a year, the ALE is 25,000. If it is expected three times a year, the ALE is 75,000.
Now give it a security flavor. Say a customer portal is worth 400,000 to the business and a successful account takeover would cost about 10 percent of that, so the SLE is 40,000. You estimate it happens once every two years, so the ARO is 0.5 and the ALE is 20,000.
Comparing a control
Suppose a control costs 6,000 a year and you believe it halves the rate of occurrence. The ARO drops to 0.25 and the new ALE is 10,000. The reduction in expected loss is 10,000. Subtract the 6,000 cost and the net benefit is 4,000 a year. The control pays for itself in expectation.
The same arithmetic shows when not to buy. If the control cost 12,000 for the same effect, the net would be negative, and you would look for a cheaper control or accept the risk.
Where the method breaks
- The inputs are guesses. The ARO for rare events has little data behind it. A range is more honest than a point. See showing uncertainty in risk ratings.
- Averages hide tail risk. A loss of 2 million once in fifty years and a loss of 40,000 once a year can share an ALE and feel nothing alike. Insurers and boards care about the tail.
- Exposure factors are fuzzy. A single percentage cannot capture legal fees, lost customers and downtime together.
- Events are not independent. One flaw in a shared library can trigger many events at once.
For richer treatment, see FAIR loss event frequency and loss magnitude and Monte Carlo simulation for cyber risk.
Try it yourself
Click through it at your own pace, or open it full screen. Look at how findings are ranked, then ask which of them would change your ARO if fixed.
Quick check
What is the ALE if SLE is 25,000 and the event happens three times a year?
75,000 per year, because ALE is SLE multiplied by ARO.
Is a positive net benefit enough to buy a control?
It is a good sign, but check the quality of your inputs and the tail loss, which the average does not show.
Sources
Last reviewed: 19 October 2026.
