Annual Loss Expectancy (ALE): Formula, Calculator & Examples

What annual loss expectancy is

Annual loss expectancy (ALE) is the expected financial loss from a specific cybersecurity risk over a one-year period. It's the foundational unit of quantitative risk analysis: a single dollar figure that turns "this risk is high" into "this risk costs us approximately $300,000 per year on average."

The point of ALE is to make risk decisions defensible in the language executive teams already use. Boards and CFOs allocate budget in dollars. Risk committees evaluate trade-offs in dollars. Cyber insurance carriers underwrite in dollars. A risk register with severity tiers (critical, high, medium, low) cannot answer the question "should we spend $200K on this remediation?" An ALE-based register can: if the ALE is $500K and the remediation is $200K, the math is straightforward.

The ALE formula

The basic ALE formula is straightforward enough to fit on one line:

Three inputs do all the work:

• Asset Value (AV) — total replaceable value, including replacement cost, lost revenue during outage, remediation/recovery cost, and (where applicable) regulatory fines and customer notification costs.
• Exposure Factor (EF) — percentage of asset value lost per occurrence (0.0 to 1.0). Ransomware encrypting a file server typically has EF 0.4–0.8; a single account compromise typically has EF 0.05–0.20.
• Annualized Rate of Occurrence (ARO) — number of times per year the event occurs. Can be fractional: 0.5 means once every two years; 2.0 means twice per year. Sourced from historical data, threat intelligence feeds, or industry benchmarks.

Worked ALE calculator (3 examples)

The mechanics become clearer with examples. Three scenarios common to mid-market and enterprise organizations:

How to use ALE in practice

1. Prioritize remediation

Build your risk register with ALE as the primary sort column. Highest-ALE risks get worked first. This is the cleanest operational use of ALE — it produces a defensible work queue that the security team, engineering owners, and executive sponsors can all reference.

2. Justify security investments

Every security control reduces ALE by some amount — typically by lowering ARO, lowering EF, or both. Compute pre-remediation ALE and post-remediation ALE; the difference is the dollar risk reduction. Divide by the cost of the control to get ROI. CFOs accept this math because it matches how they evaluate any other investment.

3. Defend security budget

When the CFO asks "why $2M for cybersecurity?", ALE-based answers work where severity-based answers don't. "We have $8M of measured ALE across our risk register; the proposed program reduces it to $3M; the $5M reduction at $2M cost is positive expected value." This frames cybersecurity as risk-adjusted investment rather than insurance against the unknown.

4. Communicate with the board

Boards understand dollars. ALE-driven risk reporting maps cleanly to the board materials boards already consume. Quarterly ALE trend lines (total ALE rising, falling, by category) translate cybersecurity progress into a metric directors can govern against — replacing the heat-map dashboards they don't trust.

Limitations of basic ALE

Basic ALE has a known weakness: it uses point estimates for inputs. You don't actually know that Exposure Factor is exactly 0.6 — you know it's somewhere between maybe 0.4 and 0.8 depending on which day, which system, which attacker. Treating uncertain values as precise produces ALE numbers that look more confident than they are.

Three failure modes commonly arise:

• False precision. ALE = $300,000 looks definitive but is sensitive to input assumptions that may vary by 50% in either direction. Decision-makers can over-rely on the number.
• Anchor bias. The first ALE estimate gets anchored as "the answer," even when the underlying assumptions are revisited and changed.
• Tail-risk blindness. ALE captures expected loss, not catastrophic-case loss. A risk with $50K expected loss but a 5% chance of $50M outcome looks small in ALE terms — but the tail risk is what kills companies.

The graduation path from basic ALE is FAIR-based modeling with Monte Carlo simulation. Instead of point estimates, FAIR uses probability distributions for each input — and the simulation runs thousands of scenarios to produce a loss distribution rather than a single number. The output is typically expressed as percentile loss (e.g., "50th percentile annual loss is $300K, 95th percentile is $2.5M"), which captures both expected loss and tail risk.

This is the methodology vCSO.ai's Theodolite implements — every finding from CSPM, DSPM, sensitive data discovery, and risk-based vulnerability management feeds into a Monte Carlo loss model that produces both expected and tail-risk estimates. The platform was built to close the gap between "we know basic ALE" and "we have audit-grade probabilistic risk quantification."

vCSO.ai is the operator-led cybersecurity advisory firm of Nick Shevelyov, former 15-year Chief Security Officer at Silicon Valley Bank. Theodolite, vCSO.ai's security platform, implements FAIR-based Monte Carlo risk quantification across CSPM, DSPM, sensitive data discovery, and risk-based vulnerability findings — translating technical findings into both expected loss and tail-risk estimates a board, CFO, or insurance underwriter can act on. Nick's book on cybersecurity strategy, Cyber War…and Peace, draws on three decades of operator experience.