Skip to main content

Annual Loss Expectancy

Also known as: ALE, Annualised Loss Expectancy

The expected annual cost of a risk scenario in financial terms, calculated as Loss Event Frequency multiplied by Loss Magnitude, expressed as a probability distribution rather than a point estimate.

Written by Askara Solutions editorial team · Updated

Annual Loss Expectancy is the headline output of a quantitative risk analysis. In FAIR terms it is Loss Event Frequency multiplied by Loss Magnitude. In a Monte Carlo simulation it is a distribution; the question "what is our ALE for ransomware?" is properly answered with a range (90th percentile, median, 10th percentile) rather than a single number.

The framing matters because boards make capital allocation decisions, not heatmap colour decisions. A scenario with an ALE distribution that has a 10% chance of exceeding 5 million euros annually is a different conversation than the same scenario filed as "high impact, medium likelihood". The former lets a CFO compare it to the cost of mitigation, an insurance premium, or the loss of a major contract; the latter does not.

ALE figures should always be reported with their uncertainty intact. A median ALE of 800,000 euros with a 90th-percentile of 4 million tells a different operating story than an 800,000 euro point estimate. Quantitative risk done well preserves the spread; quantitative risk done badly collapses it back to a single number that gets argued over instead of acted on.

Related terms

Where this connects.

  • FAIR

    Quantitative risk-analysis methodology that expresses cyber risk as financial loss exposure rather than ordinal severity scores, by decomposing it into loss event frequency and loss magnitude.

  • Threat Event Frequency

    The expected number of times per year that a threat actor will attempt the action that could lead to a loss event, before any consideration of whether the attempt succeeds.

  • Loss Event Frequency

    The expected number of times per year that a threat actor's action will succeed and produce a loss, calculated as Threat Event Frequency multiplied by Vulnerability (the probability of success).

  • Monte Carlo Simulation

    Computational technique that samples input variables from their probability distributions and aggregates the outcomes, producing a distribution of plausible results rather than a point estimate.

  • Risk Register

    The single source of truth recording every identified risk, its assessment, the control treatment chosen, the owner, and the review date.

Authoritative sources

Where to read more.

Back to Risk ManagementBack to glossary