Risk calculation drill: SLE, ALE, ARO

Quantitative risk questions are pure arithmetic once you know which formula applies. This drill generates fresh numbers each time and shows the calculation after every answer. The calculator below lets you check your own scenario.

The formulas

• SLE (single loss expectancy) = asset value × exposure factor (EF).
• ALE (annualized loss expectancy) = SLE × ARO (annual rate of occurrence).
• Control benefit = ALE before − ALE after − annual cost of the control. A positive result means the control pays for itself.

Worked example. A server worth $100,000 loses 25% of its value in one incident, so the SLE is $25,000. If the incident is expected twice a year, the ALE is $50,000. A control that cuts the rate to 0.5 a year leaves an ALE of $12,500, saving $37,500 a year before its own cost.

The difference between this and qualitative scoring is explained in qualitative vs quantitative risk. Written practice is in the risk practice questions, and the topic appears in Security+ SY0-801.