Annualized Loss Expectancy (ALE)

Annualized Loss Expectancy is a risk assessment metric that estimates the total monetary loss an organization can expect from a specific threat over one year.

It is calculated by multiplying the Single Loss Expectancy (SLE)—the cost of a single incident—by the Annualized Rate of Occurrence (ARO)—how often the threat is expected to happen annually.

For example, if a data breach would cost $100,000 (SLE) and is expected to occur once every five years (ARO = 0.2), the ALE would be $20,000. This means the organization should budget approximately $20,000 annually to address this risk through preventive measures, insurance, or accepted losses.

ALE is fundamental to cybersecurity risk management because it helps organizations prioritize security investments and make informed decisions about risk mitigation strategies. By comparing the ALE of different threats, security professionals can focus resources on the most financially impactful risks and justify security expenditures to leadership in business terms.