Risk Reduction Calculator

ALE = single loss expectancy × annual probability. Risk reduction = ALE before − ALE after. ROSI = (reduction − first-year cost) ÷ first-year cost. This is the standard expected-loss model: multiply the cost of one incident by how often you expect it, and the difference between the before and after figures is the value of the work. The honesty of the output rests entirely on the probability estimates, which is why the calculator makes you state both explicitly rather than hiding them inside a single 'risk score'.

Security work competes with every other capital request, and 'this removes £324,000 of annual loss expectancy for £205,000' is an argument a CFO can act on where 'this fixes a critical' is not.

This calculator takes 5 inputs: Single loss expectancy, Annual probability before remediation, Annual probability after remediation, One-off remediation cost, Ongoing annual cost. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.

Industry breach frequency data for your sector and size, adjusted by your own incident history and exposure. Give a range rather than a point estimate and run the calculation at both ends — if the case holds at the pessimistic end, it is robust.

To keep payback comparable across proposals. For a multi-year decision, discount several years of reduction against several years of cost; single-year ROSI flatters cheap one-off fixes and penalises platforms that keep paying back.