What is quantitative risk analysis?
Quantitative risk analysis measures risk in numbers, usually money and frequency, rather than descriptive ratings. It estimates how much one occurrence of a harmful event would cost and how often the event is expected, then combines the two into an expected loss per year. Because every risk ends up in the same unit, dollars per year, the results can be compared directly, added together and weighed against what controls cost. That makes it the method of choice when a security investment has to be justified to finance.
The core measures
- Asset value (AV): what the asset is worth to the business, counting lost revenue and recovery costs, not just the purchase price.
- Exposure factor (EF): the percentage of that value one event would destroy.
- Single loss expectancy (SLE): the cost of one event, AV multiplied by EF.
- Annualized rate of occurrence (ARO): how many times the event is expected per year; once every ten years is 0.1.
- Annualized loss expectancy (ALE): the expected yearly loss, SLE multiplied by ARO.
A worked example with a control decision
A retailer values its customer database at $4,000,000, counting notification costs, fines, legal fees and lost sales. Analysts estimate that one breach would cost 25 percent of that value and expect a breach about once every ten years.
SLE = $4,000,000 × 0.25 = $1,000,000
ALE = $1,000,000 × 0.1 = $100,000 per year
A database monitoring and access hardening project costs $35,000 a year and is expected to cut the breach rate to once every 25 years, an ARO of 0.04. The new ALE is $40,000, a reduction of $60,000. Taking away the project's $35,000 annual cost leaves a net benefit of $25,000 a year, so the control pays for itself. Some organizations express the same result as a return on security investment (ROSI): the net benefit divided by the control's cost, here about 71 percent.
Strengths and limits
Quantitative results support decisions ratings can't: whether a control is worth its price, which of two projects removes more expected loss, and how large an insurance policy needs to be. The price is effort. Every input is an estimate, and some are thin: asset values depend on assumptions about lost business, and AROs for rare events rest on little history. Harm such as lost customer trust is hard to price and tends to be undercounted. A precise-looking result like $97,310 is only as reliable as its weakest input.
Mature programs handle this by using ranges instead of single values and running Monte Carlo simulations that show the spread of possible yearly losses. Factor Analysis of Information Risk (FAIR), published as an open standard by The Open Group, is a widely used model for that kind of analysis.
Quantitative vs. qualitative risk analysis
| Aspect | Quantitative | Qualitative |
|---|---|---|
| Output | Dollars per event and per year | Ratings such as low to critical |
| Inputs | Asset values, loss estimates, frequencies | Expert judgment on agreed scales |
| Effort | High | Low |
| Best for | Cost-benefit and budget decisions | Ranking many risks quickly |
In practice the two are combined: every risk gets a quick rating, and dollar figures are worked out where a budget decision hinges on them.
Quantitative risk analysis on the CompTIA Security+ exam
SY0-801 objective 5.2 names SLE, ARO and ALE, the measures quantitative analysis uses, though exposure factor is no longer listed by name. Expect to calculate an ALE from a short scenario, convert wording such as once every four years into an ARO of 0.25, and decide whether a control is worth buying by comparing its annual cost with the ALE reduction it delivers, not with the whole ALE. Wording about dollar amounts, cost justification or expected annual loss points to quantitative analysis; ratings, heat maps and expert opinion point to qualitative.