TechKnowSurge
CompTIA Security+ 5.2 ISC2 CISSP 1.9 CompTIA SecurityX 1.3 NIST CSF GV.RM-06 NIST CSF ID.RA-04
TechKnowSurge Catalog Videos Annualized Loss Expectancy (ALE) and Annual Rate of Occurrence (ARO)
VideoSecurityFree

Annualized Loss Expectancy (ALE) and Annual Rate of Occurrence (ARO)

Annualized Loss Expectancy (ALE) combines the cost of a single risk event with how frequently that event is expected to occur, giving organizations a consistent annual figure for budgeting and risk planning. Understanding ALE and Annual Rate of Occurrence (ARO) allows security professionals to quantify risk exposure across different threat frequencies.

⚑ Complete this video to capture a CTF flag worth 1 point.

About this video

Annualized Loss Expectancy (ALE) is a quantitative risk calculation that gives organizations a standardized way to estimate the yearly financial impact of a specific threat. While Single Loss Expectancy (SLE) captures what a single occurrence of a risk event would cost, it does not account for how often that event is likely to happen. ALE closes that gap by incorporating the Annual Rate of Occurrence (ARO), which expresses threat frequency as a numerical value — for example, 1 for an event expected once per year, 2 for twice per year, or 0.25 for an event anticipated once every four years. The formula is straightforward: ALE equals SLE multiplied by ARO. If a risk event carries an SLE of $100,000 and is expected to occur once every four years, the ARO is 0.25 and the resulting ALE is $25,000. That figure represents the average annualized cost an organization should plan for, even though actual losses in any given year may be zero or may spike to the full SLE amount. In practice, risk occurrence is inherently unpredictable. A threat projected to strike once every four years might not appear for six years, or it might occur in two consecutive years. The ALE does not eliminate that uncertainty, but it provides a defensible, repeatable basis for risk-based decision-making — enabling security teams and business stakeholders to prioritize controls, justify security investments, and build realistic budgets around the risks most likely to affect the organization over time.

What you'll learn

What's covered

Annualized Loss Expectancy (ALE)

Aligned to

CompTIA Security+
5.2 Explain elements of the risk management process.
ISC2 CISSP
1.9 Understand and apply risk management concepts
CompTIA SecurityX
1.3 Explain the importance of risk management for an enterprise.
NIST CSF
GV.RM-06 A standardized method for calculating, documenting, categorizing, and prioritizing cybersecurity risks is established and communicated.
ID.RA-04 Potential impacts and likelihoods of threats exploiting vulnerabilities are identified and recorded.

Key terms

Single Loss Expectancy
SLE
Single Loss Expectancy is the expected monetary loss from a single occurrence of a risk event, calculated by multiplying the asset value by the exposure factor for that threat.
Annualized Rate of Occurrence
ARO
Annualized Rate of Occurrence is an estimate of how frequently a specific threat event is expected to occur within a given year, used in quantitative risk calculations.
Annualized Loss Expectancy
ALE
Annualized Loss Expectancy is a risk metric representing the expected yearly monetary loss from a threat, calculated by multiplying the Single Loss Expectancy by the Annualized Rate of Occurrence.
Risk
The potential for loss or harm resulting from a threat exploiting a vulnerability.

Topics

Annualized Loss Expectancy Annual Rate Of Occurrence Single Loss Expectancy Quantitative Risk Analysis Risk Management Cybersecurity Risk

Transcript

A single loss expectancy can really help us determine what a risk level is for any single risk, but it's not the full picture. Sometimes we need to be analyzing what's the annual rate of occurrence: how often is this going to happen? So for instance, something could happen every year, something could happen two times a year, five times a year, 100 times a year, or maybe it's only going to happen every other year, or maybe every five years. We need to know how often this is going to happen and factor that into our equation.

Annualized loss expectancy

Our annualized loss expectancy, or ALE, is just another equation. It takes in a single loss expectancy and then factors in how often this happens.

Annual rate of occurrence

The annual rate of occurrence, or ARO, is how often something's going to happen. So for instance, if it's every year, we're just going to use an ARO of 1. If it's twice a year, it's an ARO, it's an annual rate of occurrence, it's annually reoccurring twice a year. Or three, if it's happening three times a year, then we use three for the equation. Or if it's four, you get the point there.

So also what could happen is maybe it's every other year, so then there's a 50% chance that it happens this year, so then we use 50%. Or maybe it's every 3 years, so now we have a 33% chance that it's going to happen any particular year. Or if it's every four years, then there's a 25% chance that it's going to happen within the year. So you kind of factor in how often do you expect this to occur, and then you use one of these numbers to do the calculation.

An example

Here's an example. Let's say we have a single loss expectancy: if something were to happen, we expect that it's going to cost about 100,000 to recover from that. Now, not only that, but we have to factor in how often does it happen. We figure that the chances of this happening, it's probably going to happen every four years, so we've got to plan for it every four years. We don't know where in there, but it's going to happen every four years. So we're going to use, there's a 25% chance that this is going to happen every year. Now we multiply these together, and so we kind of figure that the ALE is going to be around 25,000 here. So our annualized loss expectancy is going to be 25,000.

What this looks like in reality

But what does this look like in reality? Think of when you're rolling a dice. If I'm rolling the dice, let's say it's a six-sided dice, what are the chances that I'm going to roll a six? Well, it's going to be a one in six every time I roll it. So I could get it the first time I roll it, I could get a six, or it could be the 12th time I rolled it I get a six. We just don't quite know. But on average, I'm probably going to get a six about every six rolls.

So that's the same thing when we're dealing with risk here. What we could see is nothing happens in year one, then we've got this big $100,000 bill in year two, and then nothing maybe for a couple years, then maybe there's a couple back-to-back years where we have it again. And so it's really unpredictable when it comes to reality. But what this does do is help us prepare for these specific risks.

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →