ALE, SLE and ARO Risk Formulas Explained
ALE, SLE and ARO explained with worked examples: the quantitative risk formulas Security+ tests, how to read exposure factor and when a control is worth it.
Most of Security+ is vocabulary and scenarios. Quantitative risk analysis is the one place the exam asks for real arithmetic, and it is a small amount of arithmetic: three multiplications and a subtraction. The trouble is that the acronyms look alike, so students mix them up under time pressure. This post lays out the formulas, works through examples from Encodr's free Security+ exam deck, and covers the questions that turn up around them.
The terms
| Term | Stands for | What it is |
|---|---|---|
| AV | Asset value | The monetary value of the asset, generally its replacement cost plus other measurable impacts such as lost sales or regulatory fines. |
| EF | Exposure factor | The share of the asset's value lost in one occurrence, as a decimal from 0 (no loss) to 1.0 (total loss). |
| SLE | Single loss expectancy | The dollar loss from one occurrence. |
| ARO | Annualized rate of occurrence | How many times per year the event is expected. |
| ALE | Annualized loss expectancy | The expected dollar loss per year. |
The formulas
- SLE = AV x EF
- ALE = SLE x ARO
- ARO = 1 / (years between occurrences)
A risk expected once every 20 years has an ARO of 1 / 20 = 0.05. A risk expected 7 times a year has an ARO of 7. ARO is not limited to whole numbers: fractions are normal for rare events. EF, on the other hand, cannot exceed 1.0, because you cannot lose more than the asset's value in the model.
Four worked examples
Each of these was recomputed with the Security Risk Calculator, and you can plug your own numbers into it.
| Scenario | AV | EF | SLE | ARO | ALE |
|---|---|---|---|---|---|
| Stolen laptops | $1,000 | 1.0 | $1,000 | 7 | $7,000 per year |
| Data center flood | $500,000 | 0.10 | $50,000 | 0.2 (once every 5 years) | $10,000 per year |
| Building fire | $2,000,000 | 1.0 | $2,000,000 | 0.01 (once every 100 years) | $20,000 per year |
| Server cluster cooling fault | $50,000 | 0.25 | $12,500 | 2 | $25,000 per year |
The last two rows make a point the exam likes. The building is worth forty times as much as the server cluster, yet the cluster has the higher ALE: $25,000 per year against $20,000. A frequent, partial loss can cost more per year than a rare, catastrophic one. That is why ALE is the figure to use when ranking risks by expected yearly cost. AV alone, EF alone or ARO alone does not combine severity and frequency.
Is a control worth buying?
The cost-benefit step compares the ALE before and after a control against what the control costs per year:
Net benefit = (ALE before - ALE after) - annual cost of the control
Take the cooling fault. ALE is $25,000 per year (SLE $12,500, ARO 2). A new cooling control costs $8,000 per year and is expected to cut the ARO in half, to 1, with the SLE unchanged at $12,500. The new ALE is 12,500 x 1 = $12,500. The savings are 25,000 - 12,500 = $12,500, and the net benefit is 12,500 - 8,000 = $4,500 per year, so the control is worth buying.
Now a different risk with an ALE of $3,000 per year, and a control that would eliminate it entirely but costs $10,000 per year. The net is 3,000 - 10,000 = -$7,000. On a purely quantitative basis it is not worth buying. The general rule is that a control is not worth its annual cost if that cost exceeds the ALE it eliminates, or the reduction in ALE it produces.
The word "purely" matters. The ALE math does not capture life safety, a regulatory mandate or reputational damage, and any of those can justify a control even when its dollar cost exceeds the ALE it removes.
Working backward
Exam questions often give you the answer and ask for an input. Rearrange the formulas:
- In the stolen-laptop example, ALE is $7,000 and SLE is $1,000, so ARO = ALE / SLE = 7,000 / 1,000 = 7.
- In the flood example, SLE is $50,000 and EF is 0.10, so AV = SLE / EF = 50,000 / 0.10 = $500,000.
Also know the direction of effects. If a control lowers the EF, for instance fire suppression that limits fire damage, and the ARO stays the same, the SLE falls and so does the ALE, in proportion.
Quantitative versus qualitative
Quantitative analysis assigns dollar values so risks can be compared in dollar terms. Qualitative analysis rates risks using descriptive categories, such as a low, medium and high grid or a color-coded heat map. It is faster and less precise, and it does not require reliable dollar figures for asset value, exposure or frequency, which are often hard to get. When a question says an analyst wants to compare two very different risks side by side in dollar terms, the answer is quantitative.
How to practice
Do a few by hand, then check them with the calculator, and do the reverse too: pick an ALE and work out which input would produce it. Quizzing yourself like this beats rereading the formulas, for the reasons in the testing effect. The same chapter belongs to the Security Program Management and Oversight domain covered in Security+ SY0-701 domains explained, and the Security+ practice questions include one ALE question. For a study plan around the whole exam, see how to study for Security+ SY0-701.
Security Risk Calculator (SLE, ALE, ARO)
Enter asset value, exposure factor and annual rate of occurrence to get SLE and ALE, then check whether a control is worth its annual cost.
Try it →Encodr turns this into a habit: study anything in a feed, and it schedules the rest.
Get started free