A CFO is shown a heat map with ransomware in the red corner, next to a request for $40,000 a year to pay for a managed detection and response service and immutable backups. She asks one question: how much will this save us? A red square can't answer that. A dollar figure can.
On the CompTIA Security+ SY0-801 exam, objective 5.2 names single loss expectancy, annualized rate of occurrence and annualized loss expectancy among the measures a business uses to weigh risk. Be ready to calculate each one from a short scenario, interpret the result, and decide whether a control is worth what it costs. This lesson works through the formulas with real numbers, then covers the slips that produce the tempting wrong answers.
Quantitative analysis turns a risk into an expected yearly loss
Quantitative risk analysis expresses a risk as money and frequency. It uses five terms:
| Term | Meaning | Unit |
|---|---|---|
| Asset value (AV) | What the asset is worth to the business | Dollars |
| Exposure factor (EF) | Share of that value lost in one event | Percent |
| Single loss expectancy (SLE) | Expected loss from one occurrence | Dollars per event |
| Annualized rate of occurrence (ARO) | Expected occurrences in a year | Events per year |
| Annualized loss expectancy (ALE) | Expected loss over a year | Dollars per year |
Two formulas connect them:
SLE = AV × EF
ALE = SLE × ARO
The SY0-801 objectives list SLE, ARO and ALE but no longer list exposure factor by name. SLE is still calculated from asset value and exposure factor, so a question may give you both and expect the multiplication, or it may hand you the SLE directly.
ALE is an expected value, an average over many years, not a forecast of next year. A risk with an ALE of $25,000 might cost nothing for nineteen years and $500,000 in the twentieth. Keep that in mind when you read the results.
Single loss expectancy is the cost of one occurrence
Asset value is what the business would lose if the asset were entirely gone, not only what it cost to buy. For a laptop, that includes the hardware, the technician's time to build a replacement and the employee's lost working hours. For a system or a data set, it can include lost revenue, recovery labor, legal fees, breach notification costs and fines.
Exposure factor is the fraction of that value one event destroys, from 0 to 100 percent. A stolen laptop is a total loss, so its EF is 100 percent. A flood that damages the ground floor of a warehouse might have an EF of 20 percent.
Three examples:
Laptop theft: AV $2,000 × EF 100% = SLE $2,000
Warehouse flood: AV $2,500,000 × EF 20% = SLE $500,000
Ransomware: AV $1,500,000 × EF 40% = SLE $600,000
In the ransomware line, the asset is the file-server environment together with the order processing that depends on it. The business estimates that one successful attack would cost 40 percent of that value in downtime, incident response, rebuilding and customer credits.
Convert the percentage to a decimal before multiplying: 40 percent is 0.4, and 5 percent is 0.05. Most SLE distractors come from moving that decimal point.