Security Risk Score
Free Security Risk Score calculator with clear step-by-step results.
About Security Risk Score
Risk is the product of how often something is likely to be attempted, how exposed you are when it is, and how much it costs when it lands. This calculator reports that two ways. The monetary view follows the classic quantitative model: single loss expectancy is asset value times exposure factor, annualised loss expectancy multiplies that by the yearly event rate, and residual ALE applies the fraction of loss your controls actually prevent. The 0-100 composite blends normalised likelihood, vulnerability and impact scores at a 35/30/35 weighting, then damps the total by up to 70 percent for control effectiveness — controls reduce risk substantially but never to zero, which is why a perfectly controlled high-value asset still carries a non-zero score.
Formulas
Single loss expectancy
SLE = asset value x exposure factor%
- exposure factor
- Share of asset value lost in one incident
Residual annual loss
Residual ALE = SLE x events per year x (1 - control effectiveness%)
Composite score
Score = (0.35 x likelihood + 0.30 x vulnerability + 0.35 x impact) x (1 - 0.7 x control effectiveness%)
Worked example
With the default values below, Security Risk Score returns Composite Risk Score (0-100) of 19.0. Change any input above and every figure here is recalculated in your browser.
Inputs used
- Threat likelihood (events per year)accepts 0–365
- 4
- Vulnerability exposureone of 1 — Hardened, patched, monitored, 2 — Minor known gaps, 3 — Several unpatched findings, 4 — Known exploitable weaknesses, 5 — Publicly exploitable, unmonitored
- 3 — Several unpatched findings
- Asset value if fully compromisedminimum 0
- 250,000
- Expected loss per incidentaccepts 0–100 %
- 35 %
- Control effectivenessaccepts 0–100 %
- 60 %
Results
- Composite Risk Score (0-100)
- 19.0
- Risk Band
- Informational — accept and review
- Residual Annual Loss Expectancy
- $140,000.00
- Annual Loss Avoided by Controls
- $210,000.00
Step by step
- 1Values used
- 2Single loss expectancy
- 3Residual annual loss
- 4Composite score
- 5Composite Risk Score (0-100)= 19.0
- 6Risk Band= Informational — accept and review
- 7Residual Annual Loss Expectancy= 140,000.00
- 8Annual Loss Avoided by Controls= 210,000.00
Assumptions and limits
- The result is derived only from the 5 inputs listed above. Anything not among them is not part of the calculation.
- In particular, this calculator does not take inflation, tax or fees or charges into account.
- Figures are rounded for display to 2 decimal places, so totals built from several rounded parts can differ slightly from the unrounded arithmetic.
- This is a planning and prioritisation model, not an actuarial or regulatory assessment. Outputs depend entirely on the estimates you supply and should not be used on their own to set insurance limits, satisfy a compliance obligation, or accept a risk formally. Have quantitative risk figures reviewed by a qualified security or risk professional.
How these calculators are built and tested is described on the Methodology page. If a figure looks wrong, please report it.
This is a planning and prioritisation model, not an actuarial or regulatory assessment. Outputs depend entirely on the estimates you supply and should not be used on their own to set insurance limits, satisfy a compliance obligation, or accept a risk formally. Have quantitative risk figures reviewed by a qualified security or risk professional.
Frequently Asked Questions
Why report both a 0-100 score and a currency figure?
They answer different questions. The currency figure (residual ALE) is what you take to a budget conversation — it is directly comparable to the cost of a control. The 0-100 score is for ranking a register of assets against each other when their values are not all known to the same precision.
Why can the score never reach zero?
Control effectiveness is capped at damping 70 percent of inherent risk. No control set is perfect: patches lag, staff make mistakes, and novel techniques appear. A model that let risk hit zero would encourage treating a controlled asset as one you can stop monitoring.
How do I choose the exposure factor?
Estimate the share of the asset's value you would lose in a single realistic incident, not a worst case. Ransomware on a well-backed-up file server might be 20 to 30 percent (recovery time and response cost); theft of a customer database that triggers regulatory penalties could exceed 80 percent.