Risk Calculator: SLE, ALE and ARO
Enter the value of an asset, the share of it you would lose in one event and how often the event happens. You get the single loss expectancy (SLE) and the annualized loss expectancy (ALE), with the working shown. Tick the comparison box to test a control: enter the cost of the control and what it does to the exposure and the rate, and see whether it saves more than it costs. Everything runs in your browser.
The formulas
| Term | Meaning | Formula |
|---|---|---|
| AV, asset value | What the asset is worth, in money | Given |
| EF, exposure factor | The share of the asset lost in one event, from 0% to 100% | Given |
| SLE, single loss expectancy | The money lost in one event | SLE = AV x EF |
| ARO, annualized rate of occurrence | How many times a year the event is expected | Given. Once in 4 years is 0.25 |
| ALE, annualized loss expectancy | The expected loss per year | ALE = SLE x ARO |
Worked examples
These are our own examples, not exam questions. You can type each into the calculator to check it.
- Server room flood. Equipment worth 30,000. A flood would destroy 60% of it and floods happen about once in 5 years. SLE = 30,000 x 0.60 = 18,000. ARO = 1 / 5 = 0.2, so ALE = 18,000 x 0.2 = 3,600 a year. Choose "Once every N years" and enter 5.
- Laptop theft. A laptop worth 2,000, stolen laptops are a total loss (EF 100%) and 6 are stolen a year. SLE = 2,000, ALE = 2,000 x 6 = 12,000.
- Customer database breach. Asset value 250,000, EF 25%, ARO 2. SLE = 62,500, ALE = 125,000.
- Is a control worth it? Asset value 100,000, EF 40%, ARO 0.5 gives SLE 40,000 and ALE 20,000. A control that costs 8,000 a year and cuts EF to 10% and ARO to 0.25 leaves an ALE of 2,500. It removes 17,500 of expected loss a year, so the net benefit is 17,500 minus 8,000 = 9,500 a year.
Reading the results
- A control is usually worth buying when the ALE it removes is larger than its annual cost. Compare the ALE before and after, as the calculator does.
- ALE is an average. A once-in-ten-years event with ALE 100,000 does not cost 100,000 every year, it costs 1,000,000 in one bad year.
- ALE is a single estimate, and the inputs are estimates too. Use ranges or a few scenarios when the numbers are uncertain.
- Quantitative analysis puts money and probabilities on risk, as here. Qualitative analysis ranks risks with labels such as low, medium and high. Both appear in risk analysis.
Where the terms come from
The CompTIA Security+ SY0-701 exam objectives (version 5.0), objective 5.2 "Explain elements of the risk management process", list under risk analysis: qualitative, quantitative, single loss expectancy (SLE), annualized loss expectancy (ALE), annualized rate of occurrence (ARO), probability, likelihood, exposure factor and impact. The objectives name the terms and do not print the formulas, so the formulas above are the standard ones used with those terms. NIST uses the same two measures: NIST IR 8286A, section 2.2.4, describes expressing impact as the loss for each occurrence (the single loss expectancy, SLE) or as the total loss over an annual period (the annualized loss expectancy, ALE), and the NIST Computer Security Resource Center glossary has an Annualized Loss Expectancy entry that cites NIST IR 8286A, 8286B and 8286D.
Study and related tools
Risk analysis is part of the CompTIA Security+ and CySA+ objectives. See the Security+ SY0-701 objectives guide, the CySA+ CS0-004 objectives guide, the free Security+ SY0-701 practice test and the free tools page.
Risk calculator FAQ
What is the difference between SLE and ALE?
SLE is the loss from one event. ALE is the expected loss per year, which is SLE multiplied by how many events you expect a year.
What is exposure factor?
The percentage of the asset's value that one event destroys. A fire that wrecks half of a building has an EF of 50%. An EF of 100% means a total loss.
How do I find ARO?
Use your own incident history, industry reports or an insurer's data. If something happens once every N years, ARO is 1 divided by N. Once every 10 years is 0.1 and twice a year is 2.
Can ARO be more than 1?
Yes. ARO is a count per year, so 12 means once a month.
Can EF be above 100%?
No. One event cannot destroy more than the whole asset, so the calculator rejects it. Costs that go beyond the asset, such as fines, belong in a separate loss estimate.
Terms: CompTIA Security+ SY0-701 Exam Objectives version 5.0, objective 5.2 (comptia.org). NIST IR 8286A, Identifying and Estimating Cybersecurity Risk for Enterprise Risk Management, section 2.2.4 (doi.org/10.6028/NIST.IR.8286A), and the NIST CSRC glossary entry Annualized Loss Expectancy (csrc.nist.gov/glossary/term/annualized_loss_expectancy), all checked on 8 November 2026. Results are exact decimal arithmetic rounded to the nearest cent, tested on 8 November 2026 against hand calculations and Python fractions.