Lesson 1.55: Putting money on risk
A 1-to-5 score ranks risks, but it can't answer the question every budget meeting asks: is this control worth what it costs? Quantitative risk analysis puts numbers in money. The classic formulas are simple: the single loss expectancy (SLE) is what one incident costs, the annualised rate of occurrence (ARO) is how often it is expected per year, and their product, the annualised loss expectancy (ALE), is the expected loss per year. Methods such as FAIR refine the same idea with ranges instead of single numbers. In the lab you calculate SLE and ALE for five Northwind scenarios and check which proposed controls save more than they cost.
16 min
You will learn to
- Explain SLE, ARO and ALE
- Calculate expected annual loss for scenarios
- Rank scenarios by money, not score
- Compare a control's cost with the loss it removes
- Record a cost-based decision
Key terms
- SLE
- Single loss expectancy: the cost of one occurrence (asset value × exposure factor).
- Exposure factor
- The fraction of an asset's value lost in one incident (0 to 1).
- ARO
- Annualised rate of occurrence: expected number of incidents per year.
- ALE
- Annualised loss expectancy: SLE × ARO, the expected loss per year.
- FAIR
- Factor Analysis of Information Risk: an Open Group standard for quantifying risk with ranges and loss frequency and magnitude.
← Jobs in cybersecurity and your learning path · All lessons · Maturity profiles and a security roadmap →