What is SLE?
Single loss expectancy (SLE) is the amount of money an organization expects to lose each time a specific risk event happens once: one stolen laptop, one flood, one successful ransomware attack. It is the first figure calculated in quantitative risk analysis, and it feeds the annualized loss expectancy (ALE), which puts the risk on a yearly basis.
SLE is measured in dollars per event. It says nothing about how often the event happens; that is the job of the annualized rate of occurrence (ARO).
The SLE formula
SLE = asset value (AV) × exposure factor (EF)
- Asset value is what the asset is worth to the business if it were completely lost. That is more than the purchase price: it includes replacement labor, lost revenue while the asset is down and recovery costs, and for data, legal fees, breach notification and fines.
- Exposure factor is the share of that value one event destroys, from 0 to 100 percent. A stolen laptop is usually a total loss, an EF of 100 percent. A fire that damages one floor of a warehouse might have an EF of 25 percent.
Convert the percentage to a decimal before multiplying: 25 percent is 0.25 and 5 percent is 0.05.
Worked SLE examples
| Event | Asset value | Exposure factor | SLE |
|---|---|---|---|
| Laptop stolen | $2,500 | 100% | $2,500 |
| Warehouse fire | $4,000,000 | 25% | $1,000,000 |
| Ransomware on order servers | $800,000 | 40% | $320,000 |
In the ransomware row, the asset value covers the server environment and the order processing that depends on it. The business estimates that one attack would cost 40 percent of that value in downtime, incident response, rebuilding and customer credits, so each occurrence is priced at $320,000.
From SLE to ALE
SLE becomes far more useful once it is combined with frequency: ALE = SLE × ARO. If the ransomware attack above is expected once every four years, the ARO is 0.25 and the ALE is $320,000 × 0.25 = $80,000 a year. That yearly figure is what gets compared with the annual cost of a control.
SLE still matters on its own. A risk with a modest ALE but a large SLE, such as a rare fire with a $1,000,000 single loss, can arrive as one very bad year. Large, rare single losses are a common reason organizations buy insurance, which transfers part of the financial impact.
SLE vs. ARO vs. ALE
| Measure | Meaning | Unit |
|---|---|---|
| SLE | Cost of one event | Dollars per event |
| ARO | Expected events per year | Events per year |
| ALE | Expected cost per year | Dollars per year |
The quickest way to tell them apart in a question is the unit it asks for. Cost per incident is SLE, a frequency is ARO, and expected cost per year is ALE.
SLE on the CompTIA Security+ exam
SLE is one of the quantitative risk measures in SY0-801 objective 5.2. Questions typically give an asset value and the percentage lost in one event and ask for the SLE, or give the SLE directly and ask you to continue to ALE. Wording such as "loss from a single incident" or "each time the event occurs" points at SLE. The usual traps are moving the decimal point (treating 30 percent as 0.03 or as 3), multiplying by the frequency when only one event was asked about, and choosing the ALE when the question wanted a per-event figure. If a scenario rates risks as high, medium and low instead of in dollars, it is describing qualitative analysis, and SLE does not apply.