Work out annualised loss expectancy instantly with clear inputs, formula shown and shareable results.
Quantitative risk analysis multiplies asset value by exposure factor to get the single loss expectancy, then by the annual rate of occurrence to get the annualised loss expectancy. ALE is directly comparable with the annual cost of a control, which is what makes the method useful for budget arguments: a control costing more than the ALE it removes is not worth buying on risk grounds alone.
ALE
SLE = asset value x exposure factor; ALE = SLE x ARO; control is justified when ALE > annual control cost
Incident history, industry breach data and threat intelligence. It is the weakest input in the model, so run the calculation across a range rather than a single point estimate.
Yes — regulatory mandates, contractual obligations and controls that reduce several risks at once. ALE informs the decision rather than making it.