Free tool
Work out single loss expectancy and annualized loss expectancy from asset value, exposure factor and annualized rate of occurrence, then test whether a security control is worth its annual cost.
Built for CompTIA Security+Replacement cost plus other measurable impacts, such as lost sales or regulatory fines.
A decimal from 0 (no loss) to 1.0 (total loss) for one occurrence.
Times per year. Once every 20 years is 1 / 20 = 0.05. Leave blank to use the years field below.
Enter the risk values.
SLE, ALE and ARO are the one place Security+ asks for real arithmetic. Encodr keeps the formulas and the control cost-benefit logic on a spaced-repetition schedule so they are automatic on exam day.
Get started freeSLE = AV x EF is the dollar loss from a single occurrence. ALE = SLE x ARO is the
expected loss per year. ARO is how many times per year the event is expected, so a risk expected once every 20 years
has an ARO of 1 / 20 = 0.05, and one expected 7 times a year has an ARO of 7. EF runs from 0 to 1.0 and
cannot exceed 1.0.
To judge a control, compute the ALE before and after, take the difference, and subtract the control's annual cost. If that net is negative, the control costs more than the loss it removes. Non-financial factors such as life safety, a regulatory mandate or reputational damage can still justify a control that fails the dollar test.
Worked example: a $50,000 server cluster with EF 0.25 and ARO 2. SLE = 50,000 x 0.25 = $12,500 and ALE = 12,500 x 2 = $25,000 per year. A cooling control costs $8,000 per year and cuts ARO to 1, so the new ALE is 12,500 x 1 = $12,500. Savings are 25,000 - 12,500 = $12,500, and the net benefit is 12,500 - 8,000 = $4,500 per year, so the control is worth buying on dollars alone. The full set of examples is in the ALE, SLE and ARO formulas explained, and the whole exam is in the free Security+ deck.
ALE, SLE and ARO explained with worked examples: the quantitative risk formulas Security+ tests, how to read exposure factor and when a control is worth it.
What each of the five SY0-701 domains covers, how much of the exam it is worth, and how to split your study time across them.
How to study for CompTIA Security+ SY0-701: what is recall and what is scenario judgment, the few calculations, the common traps, and a week-by-week plan.
Security+ SY0-701 practice questions with answers: 12 scenario questions from 12 course units, each with the reasoning, from Encodr's free exam deck.
Get the mask, network and broadcast address, host range and usable host count for any IPv4 address and prefix - built for Security+ exam prep.
Open tool →Convert whole numbers between binary, octal, decimal and hexadecimal with the place-value working shown, plus 8, 16 and 32-bit two's complement.
Open tool →See whether a property policy met its coinsurance requirement and exactly what it pays on a loss - built for P&C license exam prep.
Open tool →Split a medical bill between you and the plan through the deductible, coinsurance, copay, and out-of-pocket maximum, step by step.
Open tool →Split a real estate commission between the listing and buyer brokerages, then between each broker and agent, with the math shown.
Open tool →