How much is an IT risk really «worth»? Saying «ransomware is dangerous» does not help to decide how much to invest in defending against it. To make rational security decisions you need to quantify the risk in economic terms, and the standard tool to do so is the ALE (Annualized Loss Expectancy), the expected annual loss. This calculator applies the classic quantitative risk-management model: starting from the asset value to protect, the exposure factor (how much of the asset is lost in an event) and the annual frequency with which the event can happen, it calculates the single loss expectancy (SLE) and the annualized loss expectancy (ALE). It then adds the effect of the security controls, showing the residual risk. The result is a concrete number — how much you expect to lose on average each year for that risk — that allows comparing different risks, justifying the security budget and deciding whether a control is worth its cost. You will discover a counterintuitive principle: the frequency of an event matters as much as its impact. It is a parametric and currency-neutral tool, valid with any risk framework (FAIR, ISO 27005, NIST). This is a quantitative estimate, not a complete security assessment.

What quantitative risk is

In risk management, a fundamental principle is that risk is not only how serious an event is, but the combination of severity and probability. A catastrophic but extremely rare event can be a smaller risk than a moderate but very frequent event. Formally, risk is expressed as the product of two factors: the impact (how much you lose if the event happens) and the probability or frequency (how often it happens). This is the heart of the quantitative approach to risk management, which translates risk into economic numbers instead of vague labels like «high» or «low». Why is it important? Because security decisions are, at bottom, economic decisions: how much to invest, in what, and with what priority. Without numbers, these decisions are based on intuition, fear or the latest alarming news — not on the real risk. With numbers, you can compare different risks on the same scale, allocate the budget where it reduces the risk the most, and justify the security expenses to management with concrete arguments («this control reduces an expected loss of X»). The ALE is the metric that summarizes all this in a single annual number, making the risk comparable with the cost of the countermeasures. It is the backbone of quantitative risk management, used in all the main security frameworks in the world. This is a quantitative estimate, not security advice.

SLE, ARO and ALE: the three key quantities

The classic quantitative model is based on three related quantities, which it is essential to understand. The first is the SLE (Single Loss Expectancy), the expected loss per single event: how much you lose if the event happens once. It is calculated by multiplying the asset value (AV) by the exposure factor (EF), that is the percentage of the asset value that is lost in that event. If an asset is worth 100,000 and an event destroys 40% of it, the SLE is 40,000. The second quantity is the ARO (Annualized Rate of Occurrence), the annual frequency with which the event is expected to happen. It can be greater than 1 (for frequent events, for example 3 successful phishing attempts per year) or less than 1 (for rare events: an ARO of 0.2 means one event every 5 years on average). The third quantity, the one that summarizes everything, is the ALE (Annualized Loss Expectancy), the expected annual loss: it is obtained by multiplying the SLE by the ARO. It is the key number, because it represents how much you expect to lose on average each year due to that risk, taking into account both the impact and the frequency. The ALE is the right metric to compare risks and to decide how much it is worth spending on defense: a control makes economic sense if it costs less than the ALE it eliminates. This calculator starts from AV, EF and ARO to give you SLE and ALE, and then shows how the controls reduce the ALE to the residual risk. This is a quantitative estimate, not security advice.

How it is calculated: the breakdown

The table shows the breakdown in the default case — asset value 100,000, exposure factor 40%, annual frequency (ARO) 0.3, reduction from controls 60%, horizon 5 years:

Follow the logic. You start from the asset value of 100,000. The exposure factor of 40% says that each event destroys 40% of it, so the SLE (loss per event) is 100,000 × 40% = 40,000. The expected frequency is 0.3 events per year (on average one every little more than three years): by multiplying the SLE by the ARO you get the ALE of 40,000 × 0.3 = 12,000, the expected annual loss. This 12,000 represents 12% of the asset value — an indicator of how «heavy» the risk is relative to the value at stake, independent of the scale. Finally, the security controls considered reduce the risk by 60%, lowering the expected residual loss to 4,800 per year. Note how the ALE captures both dimensions: a rare but devastating event and a frequent but light one can produce the same ALE. Change the values with those of your scenario to quantify any risk: increasing the frequency or the impact, the ALE grows; improving the controls, the residual risk drops. This is a quantitative estimate, not security advice.

The exposure factor and the asset value

The first two quantities to estimate are the asset value and the exposure factor, and together they determine the impact of an event. The asset value (AV) is how much what you are protecting is worth. Beware: it is not only the purchase or replacement cost, but the overall value for the organization, which can include many components: the value of the data (often the most important and hardest to quantify), the revenues generated by the asset, the recovery cost, the impact on operational continuity, the reputational and legal damages. A customer database can «be worth» much more than the server that hosts it. Estimating the AV well is crucial because the whole calculation depends on it. The exposure factor (EF) is the percentage of the asset value that is lost in a single event. Not all events destroy the asset 100%: a laptop theft can expose only part of the data (low EF); a ransomware that encrypts everything can approach 100%; a data breach can entail the total loss of data confidentiality. The EF captures the severity of the specific threat scenario on the asset. Estimating the EF requires reasoning about what concretely happens in an event: what fraction of the value is lost? It is here that technical controls can intervene, reducing the EF (for example, encryption reduces the exposure of stolen data, backups reduce the impact of ransomware). Together, AV and EF give the SLE, the loss per single event. This is a quantitative estimate, not security advice.

The annual frequency (ARO): the hidden multiplier

Here is the factor that many underestimate and that often makes the difference: the annual frequency (ARO). While the impact (SLE) captures «how much it hurts», the ARO captures «how often it happens», and the two are multiplied. The counterintuitive principle is that frequency matters as much as impact: an event with half the impact but twice the frequency produces the same ALE. The table illustrates it with four threat profiles on the same 100,000 asset:

The table reveals a fundamental truth of risk management. Look at the last row against the second: a major data breach has an enormous impact (EF 90%, almost the whole asset), but being very rare (ARO 0.1) its ALE is only 9,000. A phishing/fraud has a much smaller impact (EF 20%), but being more frequent (ARO 1) produces a more than double ALE, 20,000. In other words, the «everyday» and frequent risk can weigh more than the catastrophic and rare risk, even if the latter is scarier. This is why concentrating only on the worst scenarios (the «black swans») can lead to wrong decisions: you spend a lot on rare risks neglecting the frequent ones that, summed, erode more. The ARO is hard to estimate (it requires historical data, industry statistics, expert judgment), but ignoring or underestimating it completely distorts the priority of the risks. The practical message: when you evaluate a risk, do not ask yourself only «how serious would it be?», but also and above all «how often can it happen?». The ALE, multiplying the two, gives you the correct measure to set priorities. This is a quantitative estimate, not security advice.

Residual risk: the effect of controls

The risk calculated so far — the «gross» ALE — is the inherent risk, that is the one you would have without any protection. But in reality you adopt security controls (technical, organizational, procedural) that reduce the risk. What remains after the controls is the residual risk, and it is this that you must evaluate to decide whether you are protected enough. A control can reduce the risk by acting on one of the two components: it can reduce the frequency (ARO) making events less probable — for example, a firewall and anti-phishing training reduce how often an attack succeeds; or it can reduce the impact (EF) limiting the damage of each event — for example, backups reduce the impact of ransomware, encryption reduces the impact of a data theft, segmentation limits the propagation. Many controls do both. In this calculator, the risk reduction from controls is expressed as an overall percentage of ALE reduction: if your controls reduce the risk by 60%, the residual risk is 40% of the gross ALE. This simplified model is useful to reason about the value of the controls. The correct economic logic is the following: a control is justified if its cost is lower than the ALE reduction it produces. If a control costs 5,000 per year and reduces the ALE by 12,000, it is clearly worthwhile; if it costs 15,000 to reduce the same 12,000, no. Comparing the risk reduction (in ALE) with the cost of the control is the heart of rational security investment decisions. This is a quantitative estimate, not security advice.

The four risk-management strategies

Once the risk is quantified, there are four fundamental strategies to manage it, and the choice depends on the magnitude of the risk and the cost of the options. The first is to reduce (mitigate) the risk: adopt controls that lower its frequency or impact. It is the most common strategy, but it makes sense as long as the cost of the controls is lower than the risk reduction obtained. The second is to transfer the risk: shift its economic burden to a third party, typically with insurance (cyber insurance is a strongly growing market) or by entrusting the asset to a provider who assumes the risk. The transfer does not eliminate the risk, but converts an uncertain and potentially large loss into a certain and predictable cost (the premium). The third is to avoid the risk: eliminate the exposure at the root, for example decommissioning a vulnerable system, not collecting unnecessary sensitive data, or not entering an activity that is too risky. It is the most effective strategy when the risk is too high and the benefits of the activity do not justify it. The fourth is to accept the risk: consciously decide to live with it, without further actions. It is appropriate when the risk is low (the ALE is small relative to the cost of reducing it) or when the cost of any mitigation would exceed the benefit. The acceptance must be a conscious and documented decision, not an oversight. The ALE is the tool that guides the choice between these strategies: low risks are accepted or monitored, moderate risks are reduced with proportionate controls, high risks are reduced aggressively and/or transferred, critical risks are avoided or transferred. This is a quantitative estimate, not security advice.

Qualitative and quantitative risk

There are two big approaches to risk assessment, and it is useful to understand when to use one or the other. The qualitative approach classifies risks with labels and descriptive scales: probability «low/medium/high», impact «minor/moderate/severe», often combined in a risk matrix (or «heat map») that colors the risks from green to red. It is simple, quick, does not require precise numeric data and is very widespread. But it has important limits: the labels are subjective (what does «medium probability» exactly mean?), they do not allow precise comparisons (two «orange» risks can be very different), and they do not directly connect to costs. The quantitative approach, the one of this calculator, expresses the risk in economic numbers (ALE, SLE). It is more rigorous, allows precise comparisons and direct economic decisions (comparing the ALE with the cost of the controls), and is indispensable to justify important investments. Its limit is that it requires numeric estimates (especially of the ARO and the EF) that can be uncertain. In practice, the two approaches are complementary: the qualitative is excellent for a first quick triage of many risks (identifying which ones deserve attention), the quantitative for deepening the most relevant risks and making founded economic decisions. Many modern methodologies combine the two: the qualitative is used to select, the quantitative to decide. Do not be discouraged by the uncertainty of the quantitative estimates: even approximate estimates, if reasoned, are more useful than vague labels, because they make the assumptions explicit and allow reasoning. This is a quantitative estimate, not security advice.

Quantifying uncertainty

A common objection to quantitative risk is: «how do I know that the frequency is 0.3 and not 0.2 or 0.5?». It is a legitimate but not fatal objection, and understanding how to address it is important. First of all, the uncertainty does not make the quantification useless: on the contrary, it makes it explicit. A number, even uncertain, forces reasoning about what determines it and allows analyses that the qualitative labels do not permit. Secondly, the estimates can be based on concrete sources: historical data (how many incidents of that type have you had?), industry statistics (threat reports, data from insurers and vendors), benchmarks and structured expert judgment. Thirdly, instead of a single number, the advanced methodologies (like the FAIR framework) use ranges and probability distributions: you estimate a minimum, a maximum and a most likely value for each factor, and you calculate the ALE as a distribution (for example with a Monte Carlo simulation) instead of a single number. This gives a more honest result: not «the ALE is 12,000» but «the ALE is probably between 6,000 and 25,000, with a most likely value of 12,000». A sensitivity analysis helps to understand which estimates matter most: if changing the ARO from 0.2 to 0.5 the ALE varies a lot, it is worth refining that estimate; if it matters little, it is not necessary. This calculator uses single values for simplicity, but the correct way to use it is to try multiple scenarios (optimistic, realistic, pessimistic) to see the range of the results. This is a quantitative estimate, not security advice.

Risk frameworks and standards around the world

Risk quantification is not an arbitrary invention: it is codified in internationally recognized frameworks and standards, which the calculator reflects. The table summarizes the main ones:

The table shows that quantitative risk management is a global standard, not a local practice. The ISO/IEC 27005 standard is part of the ISO 27000 family on information security and is the international reference for the risk management process (identification, analysis, evaluation, treatment). The NIST SP 800-30, published by the US body NIST, is a guide very followed also outside the USA for conducting risk assessments in a structured way. The FAIR (Factor Analysis of Information Risk) is the best-known quantitative framework: it decomposes the risk into factors (frequency of loss events, magnitude of the loss) and uses probability distributions instead of single numbers, for a more rigorous analysis of the uncertainty — it is at the base of many modern «cyber risk quantification» tools. OCTAVE (developed at Carnegie Mellon) is a methodology oriented to self-assessment by the organization. Finally, the qualitative risk matrix (probability × impact on a colored grid) is the simplest and universally widespread approach, used as a first tool in practically every context. The concepts of this calculator — asset, exposure, frequency, expected loss — are common to all these frameworks: wherever you are and whatever standard you follow, the quantitative logic remains the same. This is a quantitative estimate, not an opinion on the specific frameworks.

How to use the ALE to decide

The practical value of the ALE lies in helping to make concrete security decisions. Here is how to use it. The first use is to set priorities among the risks: calculate the ALE for your main threat scenarios and order them from highest to lowest. The risks with a higher ALE deserve more attention and budget — and, as seen, they are not always the ones that are scariest (frequency matters). The second use is to justify security investments: compare the cost of a control with the ALE reduction it produces. A control that costs 5,000 per year and reduces the ALE by 15,000 offers a clear return; presenting this comparison to management transforms the budget request from «it is needed for security» to «it reduces an expected loss of X at a cost of Y». The third use is to allocate the budget efficiently: with a limited budget, invest first in the controls that reduce the ALE most per euro spent, maximizing the overall risk reduction. The fourth use is to decide on insurance: compare the ALE of the residual risk with the premium of a cyber policy — if the premium is reasonable relative to the loss it covers, the transfer is worthwhile. The fifth is to communicate the risk in an understandable way to non-technical people: an economic number speaks to management much more than a list of vulnerabilities. Remember that the ALE is a decision-support tool, not an oracle: the estimates must be reviewed periodically and integrated with judgment. This is a quantitative estimate, not security advice.

Common mistakes in risk quantification

In risk quantification some typical mistakes recur. The first, the most widespread, is to ignore or underestimate the frequency: to concentrate only on the impact (the worst scenarios) and neglect how often the events happen, distorting the priorities in favor of the rare and dramatic risks. The second is to estimate the asset value badly, considering only the replacement cost and forgetting the value of the data, the revenues, the reputation. The third is to use false precision: to present an ALE as «12,437» when the starting estimates have a ±50% uncertainty, giving an illusion of exactness; better to use round figures and ranges. The fourth, opposite, is to reject the quantification because «the numbers are uncertain», giving up a useful reasoning tool: even approximate estimates are better than none. The fifth is to forget the uncertainty: to use a single number without exploring alternative scenarios (optimistic/pessimistic). The sixth is to overestimate the effectiveness of the controls: to assume that a control reduces the risk more than it actually does. The seventh is to calculate the ALE once and forget it: the risk evolves (new threats, changes in the asset), and the quantification must be updated. The eighth is to confuse the ALE with a certain prediction: the ALE is an expected average, not what will surely happen every year — in a specific year you might suffer no loss or a very large one. The defense against these mistakes is to use the quantification as an honest reasoning tool, with reasoned estimates, ranges and periodic reviews. This is a quantitative estimate, not security advice.

Limits of the calculation

This calculator provides a quantitative estimate of the risk according to the classic SLE/ARO/ALE model, useful to reason, compare risks and support decisions, but it does not replace a complete security assessment nor a professional risk-management consultancy. Several aspects are simplified. The model uses single values for each factor, while the advanced methodologies (FAIR) use probability distributions and simulations to capture the uncertainty: the correct way to use this tool is to try multiple scenarios, not to trust a single number. The quality of the result depends entirely on the quality of the input estimates (AV, EF, ARO): wrong estimates give a wrong ALE («garbage in, garbage out»). The reduction from controls is modeled as a single percentage, while in reality the controls act differently on frequency and impact and interact with each other. The calculation considers a single asset-threat scenario at a time; the overall risk of an organization is the aggregation of many scenarios, with possible correlations. The ALE is an expected average, not a prediction of what will happen in a specific year. It does not consider important qualitative aspects (regulatory obligations, risk tolerance of the organization, cascade effects). Use the result therefore as support to reasoning and decision, with honest estimates and periodic reviews, not as an absolute truth. For the risk management of important systems, rely on security professionals and structured frameworks. This is not professional advice.

Risk levels: from estimate to action

Once the ALE and the risk on the asset value are calculated, the practical question is: what do I do? The table translates the risk levels (as % of the asset value) into typical strategies:

This scale, based on the ALE as a percentage of the asset value, is useful because it is scale-independent: it works for both a small asset and a large one, because it measures how much the risk «weighs» relative to the value at stake. A low risk (below 5%) is usually accepted and monitored: the cost of further controls would exceed the benefit, but surveillance is maintained because the conditions can change. A moderate risk (5-20%) justifies a reduction with targeted controls, following the golden rule (a control is worthwhile if it costs less than the ALE reduction it produces). A high risk (20-50%) requires an aggressive reduction and often also the transfer (cyber insurance) for the residual part. A critical risk (over 50% of the value every year) is unsustainable and requires urgent action: drastically reduce the exposure and the frequency, and seriously consider avoiding the risk (eliminating the asset or the activity) or transferring it. Remember that the thresholds are indicative: risk tolerance varies from organization to organization, and must be defined based on the context, the regulatory obligations and the ability to absorb the losses. This is a quantitative estimate, not security advice.

Cost of the risk versus cost of the control

The real value of the ALE emerges when it is used to decide whether a security control is worthwhile, comparing the cost of the control with the risk reduction it produces. The principle is economic rationality: it makes no sense to spend more on a control than the risk it reduces is worth. Let us make a few concrete examples. Suppose an ALE (inherent risk) of 20,000 per year. A control that costs 4,000 per year and reduces the ALE by 70% (that is by 14,000) is clearly worthwhile: you spend 4,000 to avoid on average 14,000, an excellent deal. A control that costs 12,000 per year but reduces the ALE only by 40% (8,000) is not worthwhile: you spend more than you save. In this second case, the alternatives are to look for a cheaper control with similar effectiveness, accept the residual risk, or transfer it with insurance (if the premium is lower than the ALE it covers). This reasoning, formalized, is at the base of the concept of return on security investment: a control generates value if the ALE reduction it produces exceeds its cost. An important aspect is that controls have diminishing returns: the first controls (the basic measures) reduce the risk a lot at low cost; the subsequent controls reduce ever less risk at increasing cost (bringing the risk from 5% to 1% costs much more than bringing it from 50% to 20%). This is why there is an optimal point of investment beyond which spending more is not worthwhile: the goal is not to zero the risk (impossible and uneconomical), but to bring it to an acceptable level at the lowest cost. The ALE is the tool that makes this balance visible. This is a quantitative estimate, not security advice.

Cyber insurance: when to transfer the risk

The transfer of the risk through cyber insurance is an increasingly important strategy, and the ALE is the right tool to evaluate it. Insurance does not eliminate the risk, but shifts its economic burden to the insurer in exchange for a premium: it converts an uncertain and potentially enormous loss into a certain and predictable cost. When is it worthwhile? The logic is similar to that of the controls: insurance makes sense if the premium is reasonable relative to the ALE of the residual risk it covers. If a risk has a residual ALE of 30,000 per year and a policy covering it costs 8,000 per year, the transfer can be worthwhile, especially because it protects from the extreme events (the «tail» of the distribution) that, though rare, could be devastating for the organization. Insurance is particularly suited to the risks with low frequency but high impact (like a major data breach): rare events that do not justify very expensive controls but that, if they happened, would be unsustainable. Some practical considerations. Cyber policies have limits, deductibles and exclusions: they cover only up to a certain amount, and not all scenarios; read carefully what is covered. Many insurers require a minimum level of controls (multi-factor authentication, backups, etc.) as a condition for the policy — so insurance and mitigation go together, not as alternatives. Insurance covers the economic losses, but does not «cancel» the reputational or operational damage. In summary: use the ALE to understand how much the risk is worth, reduce what is economical to reduce, and transfer with insurance the residual part that is too costly to mitigate but too large to accept. This is a quantitative estimate, not insurance advice.

Aggregating risks: from the single scenario to the overall picture

This calculator analyzes a single scenario at a time (an asset, a threat), but the real risk of an organization is the sum of many scenarios, and understanding how to aggregate them is important. In first approximation, the overall annual risk is the sum of the ALEs of the single scenarios: if you have a ransomware risk with ALE 15,000, a phishing risk with ALE 10,000 and a device theft risk with ALE 5,000, your aggregated ALE is about 30,000 per year. This sum is a good starting point to size the overall security budget. But reality is more subtle for two reasons. The first is that some scenarios can be correlated: a single attack can trigger multiple consequences (a ransomware can cause both data loss and operational interruption and reputational damage), and naively summing the ALEs of correlated events can lead to double counting or, conversely, to underestimates if the effects amplify. The second is that some controls reduce multiple risks simultaneously: staff training reduces both phishing and other human errors; a good backup mitigates both ransomware and hardware failures and deletions. When you allocate the budget, these «cross-cutting» controls often offer the best return because they reduce the aggregated ALE on multiple fronts. For a complete picture, therefore, list your main risk scenarios, calculate the ALE of each, sum them for the overall risk, and look for the controls that reduce the total ALE most per euro spent. It is the risk portfolio approach, which the advanced methodologies formalize with simulations. This is a quantitative estimate, not security advice.

Beyond cyber: risk quantification in every sector

Although this calculator is designed for IT risk, the SLE/ARO/ALE model is universal and applies to risk quantification in any sector. The logic «impact × frequency = expected annual risk» is the same that underlies insurance actuarial science (insurers calculate premiums by estimating frequency and severity of claims), reliability engineering (the failure risk of a system is the probability of failure times its consequence), occupational safety (the risk of a hazard is probability × severity of the harm), financial risk management and many other areas. You can use this calculator, with the right interpretation of the parameters, for any quantifiable risk: the «asset value» becomes the value of what is at risk, the «exposure factor» the fraction lost in an event, the «annual frequency» how often the event happens. For example, to evaluate the risk of flooding of a warehouse: value of the goods as AV, percentage of goods damaged in a flood as EF, expected frequency of floods as ARO. The result — the expected annual loss — is comparable with the cost of preventive measures (drainage, elevation, insurance). This universality is the strength of quantitative risk thinking: once the model is understood, it can be applied wherever one must rationally decide between the cost of a protection and the risk it reduces. The challenge, in every area, remains the same: to estimate the parameters well, to be honest about the uncertainty, and to use the numbers as a guide to reasoning, not as absolute truths. This is a quantitative estimate, not professional advice.

Frequently asked questions

What is the ALE (Annualized Loss Expectancy)?

It is the expected annual loss: how much you expect to lose on average each year for a given risk. It is calculated by multiplying the single loss expectancy (SLE) by the annual rate of occurrence (ARO). The ALE is the key metric of quantitative risk management, because it combines impact and frequency into a single economic number, comparable with the cost of the countermeasures.

How are SLE, ARO and ALE calculated?

The SLE (Single Loss Expectancy) is the loss for a single event: asset value × exposure factor (the % of the asset lost per event). The ARO (Annualized Rate of Occurrence) is the expected annual frequency of the event (can be <1 for rare events). The ALE is SLE × ARO. Example: asset 100,000, exposure 40% → SLE 40,000; frequency 0.3 → ALE 12,000.

Why does the frequency (ARO) matter as much as the impact?

Because ALE = impact × frequency: the two are multiplied. An event with half the impact but twice the frequency produces the same ALE. It is counterintuitive: a devastating but rare data breach can have a lower ALE than a frequent but modest-impact phishing. Concentrating only on the worst scenarios, ignoring the frequency, distorts the priorities.

What is the exposure factor (EF)?

It is the percentage of the asset value that is lost in a single event. Not all events destroy the asset 100%: a laptop theft can expose only part of the data (low EF), a ransomware that encrypts everything can approach 100%. The EF captures the severity of the specific scenario. Technical controls (encryption, backups) can reduce the EF, limiting the damage of each event.

What is residual risk?

It is the risk that remains after applying the security controls. The risk calculated initially (the «gross» ALE) is the inherent risk, without protections. The controls reduce it by acting on frequency or impact. In this calculator, you indicate the overall percentage of reduction: the residual risk is the ALE minus that reduction. It is the value you must evaluate to decide whether you are protected enough.

When is it worthwhile to invest in a security control?

The economic rule is simple: a control is worthwhile if its cost is lower than the ALE reduction it produces. If a control costs 5,000 per year and reduces the ALE by 12,000, it is clearly worthwhile; if it costs 15,000 to reduce the same 12,000, no. Comparing the risk reduction (in value) with the cost of the control is the heart of rational security decisions.

What are the risk-management strategies?

Four: reduce (mitigate with controls that lower frequency or impact), transfer (shift the risk to a third party, e.g. with cyber insurance), avoid (eliminate the exposure, e.g. decommissioning a system) and accept (consciously live with the risk, if low or too costly to reduce). The ALE guides the choice: low risks are accepted, moderate ones are reduced, high ones are reduced/transferred, critical ones are avoided.

What is the difference between qualitative and quantitative risk?

The qualitative classifies risks with labels (probability/impact low/medium/high, colored matrices): simple but subjective and imprecise. The quantitative (this calculator) expresses the risk in economic numbers (ALE, SLE): more rigorous, allows comparisons and economic decisions, but requires numeric estimates. The two are complementary: the qualitative for quick triage, the quantitative for deepening the relevant risks.

How do I handle the uncertainty of the estimates?

Uncertainty does not make the quantification useless, it makes it explicit. Base the estimates on historical data, industry statistics, benchmarks and expert judgment. Instead of a single number, try multiple scenarios (optimistic, realistic, pessimistic) to see the range of the results. Advanced methodologies like FAIR use probability distributions and Monte Carlo simulations. A sensitivity analysis shows which estimates matter most.

What is the FAIR framework?

FAIR (Factor Analysis of Information Risk) is the best-known quantitative risk framework. It decomposes the risk into factors (frequency of loss events, magnitude of the loss) and uses probability distributions and ranges instead of single numbers, calculating the risk as a distribution (often via Monte Carlo simulation). It is at the base of many modern «cyber risk quantification» tools. This calculator uses the classic SLE/ARO/ALE model, compatible with FAIR.

Is the ALE a prediction of how much I will lose this year?

No. The ALE is a long-term expected average, not what will surely happen in a specific year. In a particular year you might suffer no loss, or suffer one much larger than the ALE. The ALE is useful to compare risks, set priorities and budget over many years and scenarios, not as a point prediction. Confusing it with a certainty is a common mistake.

Does this calculator replace a professional security analysis?

No. It provides a quantitative estimate according to the classic SLE/ARO/ALE model, useful to reason and support decisions, but it uses single values (not distributions), considers a single scenario at a time, and the quality depends on your estimates. For the risk management of important systems, rely on security professionals and structured frameworks (ISO 27005, NIST, FAIR), and remember that the risk must be reassessed periodically.

Updated July 2026