Annualized Loss Expectancy (ALE) — Quantitative Risk Metric

Quick Answer

Annualized Loss Expectancy is the most commonly used quantitative risk metric because it distills two separate pieces of information, how bad a single incident would be and how often that incident is expected to happen, into one dollar figure that decision-makers can actually act on. ALE is built from Single Loss Expectancy, the expected financial impact of one occurrence of a risk event, multiplied by the Annualized Rate of Occurrence, the expected frequency of that event happening per year. The result is a single, comparable number expressed in the same unit organizations already use to make every other budgeting decision: money. That comparability is what makes ALE so useful in practice; a security team can weigh the annualized cost of a risk against the annual cost of a proposed control and make a straightforward return-on-investment argument, something a purely qualitative rating like High or Medium can't support nearly as precisely. This is especially valuable for something like a new cloud application, where stakeholders outside the security team, such as finance or executive leadership, need risk expressed in terms they can weigh against other business priorities. Qualitative methods remain useful when hard numbers aren't available, but whenever a question specifically asks for a quantitative metric used to calculate and compare risk in monetary terms, ALE is the standard answer, built on top of SLE and ARO.