What is ALE?
Annualized loss expectancy (ALE) is the average amount of money a risk is expected to cost an organization each year. It combines the cost of one event, the single loss expectancy (SLE), with how often the event is expected per year, the annualized rate of occurrence (ARO). Because every ALE is in dollars per year, very different risks can be ranked, added up and compared with the cost of controls.
The ALE formulas
SLE = asset value (AV) × exposure factor (EF)
ALE = SLE × ARO
Example: a ransomware attack on a company's file servers would cost $600,000 in downtime, recovery and customer credits, which is the SLE. The company expects one successful attack every five years, an ARO of 0.2. The ALE is $600,000 × 0.2 = $120,000 a year.
ALE is an expected value, an average over many years, not a forecast. A risk with an ALE of $120,000 may cost nothing for four years and $600,000 in the fifth.
Using ALE for cost-benefit analysis
The main job of ALE is to judge whether a control pays for itself. Compare how much ALE the control removes with what it costs per year:
Value of control = (ALE before - ALE after) - annual cost of control
| Step | Figure |
|---|---|
| ALE before: $600,000 × 0.2 | $120,000 |
| ALE after EDR and immutable backups: $300,000 × 0.1 | $30,000 |
| Reduction in ALE | $90,000 |
| Annual cost of the controls | $40,000 |
| Net yearly value | $50,000 |
The controls remove $90,000 of expected loss for $40,000 a year, so on the numbers they are worth buying. The $30,000 that remains is the residual risk expressed in dollars. A one-time purchase has to be spread over its expected life first: a $90,000 appliance that lasts three years, with $10,000 a year in support, costs $40,000 a year.
What ALE does not tell you
Every input is an estimate, so a precise-looking ALE is only as good as its weakest assumption. ALE also hides the shape of a risk. Losing twelve $2,000 laptops a year and a once-in-twenty-years $480,000 flood both have an ALE of $24,000, but the laptops are a predictable running cost while the flood arrives as one large loss, which is why rare, severe risks are often insured. Harm that is hard to price, such as lost customer trust, tends to be undercounted.
The math also never overrides the law. If a regulation or contract requires a control, it is implemented even when its cost exceeds the ALE reduction it delivers.
ALE vs. SLE
SLE is per event; ALE is per year. When the event happens less than once a year, the ALE is smaller than the SLE, and when it happens several times a year, the ALE is larger. If a question asks for expected annual loss, the answer is the ALE, even when the SLE figure also appears among the options.
ALE on the CompTIA Security+ exam
ALE is one of the quantitative risk measures in SY0-801 objective 5.2. Expect a short scenario with an asset value, a percentage lost per event and a frequency, and be ready to compute the SLE and then the ALE. Wording such as "expected annual loss" or "how much the risk costs per year" points at ALE. The common traps are inverting the frequency (once every 4 years is an ARO of 0.25, not 4), forgetting to convert a percentage to a decimal, comparing a control's cost with the whole ALE instead of the reduction it delivers, and comparing a one-time price with a yearly figure. When the numbers say not to buy a control but a regulation requires it, the regulation wins.