Skip to content
ENExplore Calculators

Risk Reduction Calculator

Quantify the annual loss expectancy removed by a remediation programme and the return on the money it costs.

About Risk Reduction Calculator

This is the standard expected-loss model: multiply the cost of one incident by how often you expect it, and the difference between the before and after figures is the value of the work. The honesty of the output rests entirely on the probability estimates, which is why the calculator makes you state both explicitly rather than hiding them inside a single 'risk score'. Security work competes with every other capital request, and 'this removes £324,000 of annual loss expectancy for £205,000' is an argument a CFO can act on where 'this fixes a critical' is not.

Formulas

Risk Reduction

ALE = single loss expectancy × annual probability. Risk reduction = ALE before − ALE after. ROSI = (reduction − first-year cost) ÷ first-year cost.

SLE
Cost of one incident, all-in
ALE
Annual loss expectancy
first-year cost
One-off remediation plus one year of operating cost
ROSI
Return on security investment as a percentage

Payback period

Payback period in months = first-year cost ÷ (annual reduction ÷ 12).

Worked example

With the default values below, Risk Reduction Calculator returns Annual Risk Reduction of $324,000.00. Change any input above and every figure here is recalculated in your browser.

Inputs used

Single loss expectancyaccepts 0–1,000,000,000 currency
1,200,000 currency
Annual probability before remediationaccepts 0–100 %
35 %
Annual probability after remediationaccepts 0–100 %
8 %
One-off remediation costaccepts 0–1,000,000,000 currency
180,000 currency
Ongoing annual costaccepts 0–1,000,000,000 currency
25,000 currency

Results

Annual Risk Reduction
$324,000.00
Risk Removed
77.1%
ALE Before
$420,000.00
ALE After
$96,000.00
Return on Security Investment
58.0%
Payback Period
7.6 months
Business Case
Positive — pays back in 7.6 months

Step by step

  1. 1Values used
  2. 2Risk Reduction
  3. 3Payback period
  4. 4Annual Risk Reduction= 324,000.00
  5. 5Risk Removed= 77.1
  6. 6ALE Before= 420,000.00
  7. 7ALE After= 96,000.00
  8. 8Return on Security Investment= 58.0
  9. 9Payback Period= 7.6 months

Assumptions and limits

  • The result is derived only from the 5 inputs listed above. Anything not among them is not part of the calculation.
  • In particular, this calculator does not take inflation or tax into account.
  • Figures are rounded for display to 2 decimal places, so totals built from several rounded parts can differ slightly from the unrounded arithmetic.

How these calculators are built and tested is described on the Methodology page. If a figure looks wrong, please report it.

Frequently Asked Questions

How is Risk Reduction calculated?

ALE = single loss expectancy × annual probability. Risk reduction = ALE before − ALE after. ROSI = (reduction − first-year cost) ÷ first-year cost. This is the standard expected-loss model: multiply the cost of one incident by how often you expect it, and the difference between the before and after figures is the value of the work. The honesty of the output rests entirely on the probability estimates, which is why the calculator makes you state both explicitly rather than hiding them inside a single 'risk score'.

Why does Risk Reduction matter?

Security work competes with every other capital request, and 'this removes £324,000 of annual loss expectancy for £205,000' is an argument a CFO can act on where 'this fixes a critical' is not.

What values do I need to enter?

This calculator takes 5 inputs: Single loss expectancy, Annual probability before remediation, Annual probability after remediation, One-off remediation cost, Ongoing annual cost. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.

Where do the probabilities come from?

Industry breach frequency data for your sector and size, adjusted by your own incident history and exposure. Give a range rather than a point estimate and run the calculation at both ends — if the case holds at the pessimistic end, it is robust.

Why only count the first year of operating cost?

To keep payback comparable across proposals. For a multi-year decision, discount several years of reduction against several years of cost; single-year ROSI flatters cheap one-off fixes and penalises platforms that keep paying back.

Related Calculators

Risk Reduction Calculator – Calculate Annual Risk Reduction