# Annualized Loss Expectancy (ALE) Cyber Risk Calculator > Source: https://netray.co/tools/annualized-loss-expectancy-cyber-risk-calculator > Publisher: Netray (netray.co), AI and integration engineering for ERP and manufacturing systems. > Section: Free Tools ## Short answer Compute SLE, ALE and the net return of a security control so you can justify spend to finance in plain numbers. ## Category compliance-legal ## Industry Manufacturing ## Audience - IT security lead - CISO - Controller ## Tool **Kind:** calculator **Currency:** $ **Inputs:** #### Asset or process value at risk **Key:** asset_value **Type:** number **Default:** 2500000 **Min:** 0 **Step:** 50000 **Unit:** $ **Help:** Replacement cost plus the revenue or margin exposed if it is lost or unavailable. #### Exposure factor **Key:** exposure_factor **Type:** slider **Default:** 40 **Min:** 1 **Max:** 100 **Step:** 1 **Unit:** % **Help:** Share of the asset value lost in one incident. #### Annual rate of occurrence **Key:** aro **Type:** number **Default:** 0.2 **Min:** 0 **Step:** 0.05 **Unit:** per year **Help:** 0.2 means roughly one event every five years. #### Risk reduction from the control **Key:** reduction **Type:** slider **Default:** 60 **Min:** 0 **Max:** 100 **Step:** 5 **Unit:** % **Help:** Reduction in expected loss, from vendor evidence or your own testing. #### Annual control cost **Key:** control_cost **Type:** number **Default:** 90000 **Min:** 0 **Step:** 5000 **Unit:** $ **Help:** Licences, labor, support and amortized capital for one year. **Outputs:** #### Single loss expectancy (SLE) **Key:** sle **Expr:** asset_value * exposure_factor / 100 **Format:** currency #### Annualized loss expectancy (ALE) **Key:** ale **Expr:** sle * aro **Format:** currency **Primary:** true #### ALE after control **Key:** ale_after **Expr:** ale * (1 - reduction / 100) **Format:** currency #### Annual risk reduced **Key:** benefit **Expr:** ale - ale_after **Format:** currency #### Net annual benefit **Key:** net **Expr:** benefit - control_cost **Format:** currency **Primary:** true #### Return on control spend **Key:** roi **Expr:** net / control_cost * 100 **Format:** percent **Chart:** #### ALE before and after the control vs annual rate of occurrence **Type:** line **X:** aro **From:** 0.05 **To:** 1 **Steps:** 20 **Series:** - ale - ale_after **Disclaimer:** Expected-value estimates, not predictions. Inputs are judgment-based, so run low, base and high cases. ## Content **Intro:** ALE turns a vague cyber risk into one annual dollar figure. It is the simplest defensible way to compare a control against the loss it prevents, and finance teams understand it immediately. **Sections:** #### How to use it **Body:** Pick one asset or process, for example the ERP database or a CNC cell network. Enter the value at risk, the share you would lose in one incident, and how often such an incident is plausible. Then enter how much a proposed control cuts the expected loss and what it costs per year. The output shows risk before and after, the net benefit and the return on spend. **Bullets:** - Use one scenario per run, such as ransomware on the ERP host. - Prefer ranges from past incidents or insurer data over gut feel. - Run a pessimistic and an optimistic case and show both. #### The formulas **Body:** Single loss expectancy equals asset value times exposure factor. Annualized loss expectancy equals SLE times annual rate of occurrence. A control that reduces risk by a given percentage lowers ALE by that share, and net benefit is the reduction minus the annual cost of the control. This is the classic quantitative method taught for security risk analysis and it feeds directly into cyber insurance and board conversations. #### Interpreting the sweep **Body:** The chart shows how the gap between the two lines widens as incidents become more likely. When the control only pays back at an occurrence rate you consider unrealistic, the business case is weak. When it pays back even at a low rate, the decision is robust. That framing is more persuasive than a single point estimate. #### Limits of the method **Body:** ALE averages rare, severe events, so it hides tail risk. A one in fifty year plant shutdown can be survivable on paper and fatal in practice. Use ALE to rank and compare, and use scenario analysis and insurance limits for the catastrophic tail. Also avoid double counting when several controls overlap on the same scenario. **Cta:** If your asset values and event history live in ERP and ticketing data, Netray can help pull them into a repeatable risk model that stays inside your network. **Faq:** #### Where do I get the annual rate of occurrence? **Answer:** Use your own incident history first, then industry reports and insurer loss data. If data is thin, state a range such as 0.05 to 0.3 and show the result for both ends rather than a single invented number. #### What is a reasonable exposure factor? **Answer:** It is the fraction of value lost per event. A stolen laptop might be 100 percent of the device but small for the business, while ransomware on the ERP could be a large share of a month of margin. Justify it with a scenario. #### Is a positive net benefit enough to approve a control? **Answer:** It is a good signal, not a decision by itself. Also weigh compliance duties, risk appetite, implementation effort and whether the control addresses a scenario that could end the business. #### Can I include reputational damage? **Answer:** You can if you can defend a figure, such as lost contract revenue after a breach. Keep it separate and labeled so reviewers can accept or reject it without discarding the rest. ## Search terms annualized loss expectancy calculator, ale sle aro calculator, cyber risk quantification calculator, security control roi calculator, single loss expectancy formula, cybersecurity business case manufacturing, exposure factor calculator --- Talk to an engineer: https://netray.co/contact?intent=erp_ai | Machine catalog: https://netray.co/agent/catalog.json