Calculate SLE, ALE and safeguard value with the standard risk formulas. Build an asset inventory, model controls, export a PDF report. Free, browser-based.
This quantitative risk analysis tool implements the standard asset-based risk arithmetic taught in CISSP, CISM, and NIST SP 800-30 training and used in real risk registers: single loss expectancy, annualised loss expectancy, and the net value of a proposed safeguard. You build an asset inventory, attach loss scenarios to each asset, then model controls against those scenarios and see whether each control is worth more than it costs.
It is built for risk analysts, vCISOs, GRC practitioners, and anyone studying for a security certification who wants to work real numbers rather than exam questions. Work is saved automatically in your browser, a bar chart compares annualised loss before and after safeguards, and the whole analysis exports to a PDF report with asset, scenario, and safeguard tables.
Quantitative risk analysis rests on a short chain of arithmetic. The tool applies it exactly as written, with no hidden adjustments.
SLE = AV × EF
Single loss expectancy is asset value multiplied by exposure factor. Asset value is the total value of the asset including replacement cost, revenue impact, and intangible value. Exposure factor is the proportion of that value destroyed by a single occurrence of the scenario, expressed as a percentage.
ALE = SLE × ARO
Annualised loss expectancy is single loss expectancy multiplied by the annual rate of occurrence. An ARO of 1.0 means once a year; 0.5 means once every two years; 4.0 means quarterly. ALE is the figure that belongs in a budget conversation, because it is already expressed per year and therefore directly comparable to an annual control cost.
Safeguard value = ALE₁ − ALE₂ − ACS
The value of a safeguard is the annualised loss before the control, minus the annualised loss after, minus the annual cost of the safeguard. A positive result means the control pays for itself in expected-loss terms. The tool labels this column ROI, but note precisely what it is: a net dollar figure per year, not a percentage ratio. If you want a ratio, divide the risk reduction by the annual cost yourself.
Take a customer database valued at $2,000,000, covering replacement, revenue impact, and reputational value.
Now model a safeguard: immutable off-site backup plus endpoint detection and response, at $95,000 per year. It does not eliminate the scenario, but it reduces both terms. Exposure factor drops to 15%, because a clean restore limits the damage. ARO drops to 0.25, because EDR intercepts a share of attempts before encryption.
The control returns $430,000 of expected annual value against $95,000 of cost. Crucially, the model shows why: risk reduction of $525,000 came from cutting both exposure and frequency, and either alone would have delivered roughly half. That decomposition is what makes a quantitative model more useful than a red-amber-green rating — it tells you which lever to pull.
Your work persists in browser local storage, so you can build an analysis across several sessions without an account.
The arithmetic is trivial; the inputs are the hard part, and honest sourcing is what makes a quantitative analysis survive review.
Exposure factor should reflect what one occurrence actually destroys. Total loss of an asset is rare. A ransomware event against a system with working backups might have an exposure factor of 20–40%, dominated by downtime rather than data loss. A full database exfiltration of regulated records may exceed 100% of the database’s replacement cost once notification and fines are counted — in which case value the asset to include that exposure rather than pushing the exposure factor above 1.0.
Annual rate of occurrence is where most analyses become guesswork. Anchor it in published incidence data where you can. Verizon’s 2025 Data Breach Investigations Report, drawn from more than 22,000 incidents and 12,195 confirmed breaches, found ransomware present in 44% of breaches, rising to 88% of breaches at small and medium businesses, with third-party involvement doubling year on year to 30% and vulnerability exploitation now behind 20% of breaches. IBM’s Cost of a Data Breach Report 2026 found 39% of breached organisations had experienced at least one ransomware attack, up from 24% in 2023. Those are population frequencies, not your frequency — but they bound the plausible range, and citing them makes an ARO defensible in a way that “we thought once every three years” is not.
Asset value for data assets can be sized from breach cost research. IBM’s 2026 report put the global average breach cost at $4.99M and the US average at $11.5M across 602 organisations breached between March 2025 and February 2026, with healthcare highest at $6.64M. If you want a per-organisation figure built from your own record counts and industry, the data breach cost calculator produces one.
State your assumptions alongside your results. A quantitative model with documented inputs can be argued with productively; one presented as a black box invites rejection of the whole analysis.
Quantitative analysis gives you dollars, which compare directly against control costs and insurance premiums. It demands numeric estimates you may not have. Qualitative analysis — likelihood and impact on ordinal scales — is faster and works when data is thin, but its scores cannot be added, averaged, or compared to a budget. Most mature programmes run both: a risk matrix to triage the register quickly, then quantitative analysis on the handful of risks that reach the top of it. Once you have an ALE, the cybersecurity ROI calculator extends the safeguard comparison to multi-year NPV and payback.
Single loss expectancy is the cost of one occurrence. Annualised loss expectancy is that cost multiplied by how often it is expected per year. ALE is the budgeting figure, because it is already annual and therefore comparable to an annual control cost.
Start with your own incident history, then bound it with published incidence rates for your sector and threat type. Express it as a decimal: 0.25 for once in four years, 2.0 for twice a year. If you can only give a range, run the analysis at both ends and report the spread rather than a false point estimate.
The tool accepts up to 100%. If a single event would cost more than the asset’s stated value — likely once regulatory fines and notification are counted — raise the asset value to include that exposure rather than pushing the exposure factor higher. Keeping EF within 0–100% preserves the meaning of the formula.
No. It is the net annual dollar value of the safeguard: risk reduction minus annual cost. A result of $430,000 means the control is expected to save that much per year net of its own cost. For a ratio, divide risk reduction by annual cost.
Model it against each scenario separately with its share of the annual cost, or model it once against the scenario it most affects and note the additional coverage. Counting the full cost against each scenario would understate its value; counting the full benefit in each would overstate it.
No, it complements it. Qualitative scoring triages a large register quickly. Quantitative analysis is worth the effort on the small number of risks that matter enough to justify sourcing real numbers.
No. Everything runs in your browser and persists in local storage on your own device. Clearing site data removes it, so export the PDF before you rely on it.
Usually an overstated exposure factor or an ARO above 1.0 applied to a rare event. Check that the exposure factor reflects partial rather than total loss, and that the rate of occurrence is expressed per year rather than per decade.
Quantitative risk analysis assigns numerical values — dollar amounts, probabilities, and expected losses — to security risks, enabling data-driven decisions about security investments. Unlike qualitative risk assessment (which uses subjective scales like High/Medium/Low), quantitative analysis calculates the expected monetary impact of threats, allowing direct comparison between the cost of security controls and the losses they prevent.
The FAIR (Factor Analysis of Information Risk) framework is the most widely adopted quantitative risk analysis model in cybersecurity. It decomposes risk into measurable factors: threat event frequency, vulnerability, and loss magnitude, producing dollar-denominated risk estimates that executives and boards can act on.
| Metric | Formula | Description |
|---|---|---|
| SLE (Single Loss Expectancy) | Asset Value x Exposure Factor | Expected loss from a single incident |
| ARO (Annualized Rate of Occurrence) | Historical frequency or estimated probability per year | How often the threat is expected to occur |
| ALE (Annualized Loss Expectancy) | SLE x ARO | Expected yearly loss from a specific threat |
| Risk Reduction | ALE (before control) - ALE (after control) | Annual savings from implementing a control |
| ROI | (Risk Reduction - Control Cost) / Control Cost | Return on security investment |
| Factor | Value |
|---|---|
| Asset value (customer database) | $5,000,000 |
| Exposure factor (data breach) | 40% |
| Single Loss Expectancy | $2,000,000 |
| Annualized Rate of Occurrence | 0.2 (once every 5 years) |
| Annualized Loss Expectancy | $400,000/year |
| Proposed control cost (DLP system) | $150,000/year |
| Risk reduction with control | 70% |
| Residual ALE | $120,000/year |
| Annual savings | $280,000/year |
| ROI | 87% |
Quantitative risk analysis uses numerical values and formulas to measure risk in monetary terms. Key formulas include: Single Loss Expectancy (SLE) = Asset Value x Exposure Factor, and Annualized Loss Expectancy (ALE) = SLE x Annual Rate of Occurrence (ARO). This approach helps organizations make data-driven decisions about security investments.
Safeguard ROI is calculated as: (ALE before safeguard - ALE after safeguard) - Annual Cost of Safeguard (ACS). A positive result means the safeguard is cost-justified. This tool automatically computes ROI and shows the breakeven point where security investment pays for itself.
SLE (Single Loss Expectancy) represents the monetary loss from a single occurrence of a threat event. ALE (Annualized Loss Expectancy) accounts for how often that event occurs per year by multiplying SLE by the Annual Rate of Occurrence (ARO). ALE gives you the expected yearly cost of a specific risk.
Exposure Factor (EF) is the percentage of an asset that would be lost if a threat is realized, expressed as a value between 0% and 100%. For example, if a server worth $50,000 would be 60% damaged by a flood, the EF is 0.6 and the SLE would be $30,000.
Quantitative analysis uses specific dollar amounts and probabilities, producing concrete financial metrics like ALE. Qualitative analysis uses subjective ratings (High/Medium/Low) and risk matrices. Quantitative is more precise but requires more data; qualitative is faster but less precise. Both are covered in CISSP Domain 1.
Create risk matrices and calculate risk scores. Prioritize risks by likelihood and impact. Free privacy-first risk assessment tool.
Calculate return on investment for cybersecurity initiatives by quantifying risk reduction, avoided breach costs, compliance savings, and operational efficiencies. Build business case for security investments.
Build comprehensive threat models using STRIDE decomposition and DREAD scoring methodology. Walk through application profiling, threat identification, risk scoring, and mitigation planning with auto-generated threat lists and prioritized recommendations.