Annualized Loss Expectancy (ALE) Cyber Risk Calculator
ALE turns a vague cyber risk into one annual dollar figure. It is the simplest defensible way to compare a control against the loss it prevents, and finance teams understand it immediately.
Your numbers
Replacement cost plus the revenue or margin exposed if it is lost or unavailable.
Share of the asset value lost in one incident.
0.2 means roughly one event every five years.
Reduction in expected loss, from vendor evidence or your own testing.
Licences, labor, support and amortized capital for one year.
Your results
Expected-value estimates, not predictions. Inputs are judgment-based, so run low, base and high cases.
ALE before and after the control vs annual rate of occurrence
Sweeps Annual rate of occurrence from 0.05 to 1, holding your other inputs fixed.
Cyber business case review
Optional review of your ALE assumptions before they go to finance.
Optional. The tool and every export work without this. No spam.
How to use it
Pick one asset or process, for example the ERP database or a CNC cell network. Enter the value at risk, the share you would lose in one incident, and how often such an incident is plausible. Then enter how much a proposed control cuts the expected loss and what it costs per year. The output shows risk before and after, the net benefit and the return on spend.
- Use one scenario per run, such as ransomware on the ERP host.
- Prefer ranges from past incidents or insurer data over gut feel.
- Run a pessimistic and an optimistic case and show both.
The formulas
Single loss expectancy equals asset value times exposure factor. Annualized loss expectancy equals SLE times annual rate of occurrence. A control that reduces risk by a given percentage lowers ALE by that share, and net benefit is the reduction minus the annual cost of the control. This is the classic quantitative method taught for security risk analysis and it feeds directly into cyber insurance and board conversations.
Interpreting the sweep
The chart shows how the gap between the two lines widens as incidents become more likely. When the control only pays back at an occurrence rate you consider unrealistic, the business case is weak. When it pays back even at a low rate, the decision is robust. That framing is more persuasive than a single point estimate.
Limits of the method
ALE averages rare, severe events, so it hides tail risk. A one in fifty year plant shutdown can be survivable on paper and fatal in practice. Use ALE to rank and compare, and use scenario analysis and insurance limits for the catastrophic tail. Also avoid double counting when several controls overlap on the same scenario.
Frequently Asked Questions
Where do I get the annual rate of occurrence?
Use your own incident history first, then industry reports and insurer loss data. If data is thin, state a range such as 0.05 to 0.3 and show the result for both ends rather than a single invented number.
What is a reasonable exposure factor?
It is the fraction of value lost per event. A stolen laptop might be 100 percent of the device but small for the business, while ransomware on the ERP could be a large share of a month of margin. Justify it with a scenario.
Is a positive net benefit enough to approve a control?
It is a good signal, not a decision by itself. Also weigh compliance duties, risk appetite, implementation effort and whether the control addresses a scenario that could end the business.
Can I include reputational damage?
You can if you can defend a figure, such as lost contract revenue after a breach. Keep it separate and labeled so reviewers can accept or reject it without discarding the rest.
If your asset values and event history live in ERP and ticketing data, Netray can help pull them into a repeatable risk model that stays inside your network.
Related Tools
Cyber Risk Register with ALE Worksheet
Log cyber risks for a plant or company, compute expected annual loss before and after controls, and export a ranked register to Excel.
Compliance & ContractsCyber Insurance Retention Tradeoff Calculator
See whether taking a higher retention for a lower premium saves money at your expected incident frequency and size.
ERP OperationsRansomware Recovery Time Objective Calculator
Estimate realistic hours to restore a plant after ransomware from data volume, restore speed, server rebuilds and validation.
Compliance & ContractsMFA Rollout Risk Reduction Calculator
Model how many account takeovers extending MFA to more users prevents, and whether the licence and support cost is justified.
More Compliance & Contracts tools
See all- ISO 14001 Internal Audit Checklist
- Environmental Compliance Obligations Register Worksheet
- AI Governance Policy Template for Manufacturers
- AI Acceptable Use Policy Template for ERP Users
- IEC 62443 Security Levels and Parts Reference
- NIST CSF 2.0 Categories Reference for Manufacturers
- OT Vendor Remote Access Hardening Checklist
- OT Network Segmentation Maturity Assessment
- SAP SoD Residual Risk Score Calculator