Single Loss Expectancy (SLE) quantifies the expected monetary loss from a single occurrence of a risk event, calculated by multiplying an asset's value by its exposure factor (EF). Understanding SLE is essential for quantitative risk analysis and feeds directly into calculating Annualized Loss Expectancy (ALE).
Single Loss Expectancy (SLE)
When we're using quantitative risk analysis, one thing that we could be using is a single loss expectancy, or SLE, and exposure factor, or EF.
When we're dealing with risk and analyzing risk, what we want to know is how much this is going to cost us every single year, and we call that an annualized loss expectancy. There's an equation for that, and part of that equation is the single loss expectancy.
Let's break apart what a single loss expectancy is. First of all, there's the expectancy: that's what we expect, what we're going to estimate, what we're thinking is going to happen. The loss is the monetary value that we're going to lose, that we're not going to have any longer once this happens. And a single occurrence, so just one occurrence of this. In this example, it's just when one person gets scammed; what is the expected loss of that?
Single loss expectancy is just an equation. To calculate single loss expectancy, we take the asset value and multiply it by the exposure factor. The asset value in this example is 200,000, so we have some value of the asset itself. Now if it were to get stolen, that would be 100%, or one; the exposure factor in this case is 50%, so we're estimating that we're going to lose half the value of that asset.
The asset value, which I cover more in depth in another video, is just the monetary value of anything that you have. The exposure factor is just how much we would expect to lose if the risk happened. So in this case maybe we have a monetary amount of $100 and we lose 50 of those dollars, and so now we have $50, so the exposure factor in that case is 0.5. Whatever the reduction of that asset value is, is going to be that exposure factor.
If you're studying for a certification or talking to others, this is the going explanation of how to calculate single loss expectancy. But I feel like this is a terrible equation. It really is not applicable in a lot of situations, or maybe even most situations, and I don't like either side of this equation.
The asset value seems like a terrible measurement to me. Number one, because a lot of times we're not dealing with a specific asset. Maybe it's not necessarily, let's say, a server that got stolen, but maybe it's the data that was stolen from the server, and we actually still have the data, we haven't lost that data. So the asset is still there, but now we have to clean it up because customers' data was stolen, and there's a lot that goes into cleaning all of that up. So using asset value really doesn't make any sense to me. Even if it was a specific asset that was stolen or something happened to it, we still have to look at redeploying or fixing it, or whatever goes into fixing whatever issue it was. Not to mention, if it had data on it, in this case servers were stolen, then there are a lot of the other notifications and legal fees and reputation loss and revenue that we still have to calculate for. We still have to understand that impact. So really, this side of the equation, the asset value, is a terrible thing to use for a single loss expectancy.
On the other side of this we have the exposure factor, and I really can't stand this either. Let's take a little different scenario. Let's say one of these servers breaks and we call in a repair person to fix this, and maybe the repair person costs us $2,000 to fix whatever was broken on that server. How are we going to calculate the exposure factor? What we're going to do is take the cost of this server, so maybe the server costs $220,000, and we're going to divide how much the repair is by how much the server cost, and then the exposure factor here is going to be 0.10, it's 10%, essentially of the cost of the server. Then we times that by the asset value, so the asset value is $20,000, so you multiply that together, and the single loss expectancy for this particular thing is $2,000. That is the cost of the repair; that's the single loss expectancy that it took to repair the server. So this equation really just seems like a really goofy equation to me, but for some reason this is the standard equation.
TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.
Explore free tools and programs →