The question underneath the formulas#
You run a shop. Every so often somebody steals something. You are looking at a security system that costs a certain amount every year.
Should you buy it? You cannot answer that from how alarming theft feels. You need two numbers: how much theft costs you in a typical year, and how much the system costs in that same year. If the first is bigger than the second, buy it.
That is the whole of quantitative risk analysis. The formulas exist to get you to an annual figure so that two things measured in different units, a rare disaster and a monthly subscription, can be compared on one line.
AV is asset value, what the thing is worth. EF is exposure factor, the share of that value one incident destroys, written as a percentage. SLE is single loss expectancy, the cost of one incident. ARO is annualised rate of occurrence, how many times a year it happens. ALE is annualised loss expectancy, the cost per year.
The three formulas#
There are only two multiplications, and the second uses the answer to the first.
| Formula | In words |
|---|---|
| SLE = AV × EF | One incident costs the asset's value times the fraction destroyed |
| ALE = SLE × ARO | Per year costs one incident times how often it happens |
ARO is where people go wrong, because it is not always a whole number. Once every two years is an ARO of 0.5. Once every ten years is 0.1. Fifteen times a year is 15. If the question gives you a frequency in words, convert it before you multiply.
Worked through, with a file server:
- AV = $200,000. What the server and its data are worth.
- EF = 25%. A flood in that room historically destroys about a quarter of it.
- SLE = 200,000 × 0.25 = $50,000. One flood costs this much.
- ARO = 0.5. It floods about once every two years.
- ALE = 50,000 × 0.5 = $25,000 per year.
So a control costing $10,000 a year that prevents the flooding is clearly worth buying, and one costing $40,000 a year is not, even though flooding is a real problem and the control genuinely works. That second case is the one exams test, because the instinct is to fix the real problem regardless of price.
A second example, where the control only reduces the risk#
Controls rarely eliminate a risk. Usually they lower the frequency, and the comparison gets one step longer.
A company loses laptops. Each is worth $2,000, and a stolen laptop is a total loss, so the exposure factor is 100%.
- SLE = 2,000 × 1.00 = $2,000.
- ARO = 15 laptops lost per year.
- ALE = 2,000 × 15 = $30,000 per year.
A tracking and physical-lock programme costs $12,000 a year and is expected to cut losses to 3 laptops a year. Is it worth it?
| Before | After | |
|---|---|---|
| ARO | 15 | 3 |
| ALE | $30,000 | $6,000 |
The control saves $30,000 − $6,000 = $24,000 a year and costs $12,000, so it returns $12,000 a year net. Buy it.
The rule generalises: compare the reduction in ALE against the annual cost of the control, not the whole ALE against the cost. A control that cuts a $30,000 risk to $6,000 has not saved you $30,000, and treating it as though it had is the most common arithmetic error in this topic.
The $6,000 still sitting there after the control is in place has a name, and it is the next section.
Inherent risk, residual risk, and appetite#
Three pairs of words that Security+ expects you to keep apart.
- Inherent risk is the risk before any controls. The $30,000.
- Residual risk is what remains after controls are applied. The $6,000. It is never zero, and pretending otherwise is itself a finding.
- Control risk is the risk that the control does not work as intended.
And two that get used interchangeably in ordinary speech but not on the exam:
- Risk appetite is how much risk an organisation is willing to take on in pursuit of its goals. It is a deliberate strategic choice, usually described as expansionary, neutral or conservative.
- Risk tolerance is how much variation from that it can actually absorb before something breaks.
The easiest way to hold the difference: appetite is what you are aiming for, tolerance is how far off target you can drift before it is a problem.
A risk register is the document where all of this lives: each identified risk, its likelihood and impact, the owner, the chosen response, and the residual risk after treatment. The risk owner is a named person accountable for it, not a department, because "the business owns it" means nobody does.
The four things you can do about a risk#
Once a risk is measured, there are exactly four responses, and exam questions very often describe one and ask you to name it.
| Response | What it means | Sounds like |
|---|---|---|
| Mitigate | Reduce likelihood or impact with a control | "We deployed encryption and endpoint protection" |
| Transfer (or share) | Move the financial consequence to someone else | "We bought cyber insurance" or "the vendor contract makes them liable" |
| Avoid | Stop doing the activity that creates the risk | "We discontinued the feature entirely" |
| Accept | Acknowledge it, document it, do nothing | "Signed off by the risk owner as within appetite" |
Two cautions that make good distractors:
- Insurance transfers the cost, not the risk. Your data is still breached and your customers are still affected. Reputational harm and regulatory obligations do not transfer.
- Acceptance is only legitimate when it is explicit. A documented decision by an accountable owner is acceptance. Not having noticed is negligence, and the two look identical from outside until someone asks for the paperwork.
Finally, qualitative analysis rates risks as high, medium and low on a heat map, and is used when reliable numbers do not exist. Quantitative analysis produces the currency figures above. Most real programmes use both: qualitative to triage the list quickly, quantitative on the few that justify the effort.
Get everything to an annual number, then compare the reduction in that number against what the control costs per year.
Test yourself in the free Kestrel Exams app
Topic-selectable practice — offline, no ads, no account.
Practice this topic →Frequently asked questions#
What is the formula for SLE, ALE and ARO?
Single loss expectancy is asset value times exposure factor, so SLE = AV x EF. Annualised loss expectancy is single loss expectancy times the annualised rate of occurrence, so ALE = SLE x ARO. The annualised rate of occurrence is how many times a year the event is expected, which can be a fraction: once every two years is 0.5.
How do you decide whether a security control is worth buying?
Compare the reduction in annualised loss expectancy against the annual cost of the control. If a control cuts an ALE from 30,000 to 6,000 and costs 12,000 a year, it saves 24,000 and costs 12,000, so it returns 12,000 net. Comparing the whole ALE against the cost, rather than the reduction, is the most common error.
What is the difference between inherent risk and residual risk?
Inherent risk is the risk before any controls are applied. Residual risk is what remains after they are. Residual risk is never zero, and the organisation has to decide explicitly whether the remainder sits within its risk appetite.
What is the difference between risk appetite and risk tolerance?
Risk appetite is how much risk the organisation is willing to take on in pursuit of its objectives, and it is a deliberate strategic choice. Risk tolerance is how much variation from that it can actually absorb. Appetite is the target, tolerance is the allowable drift from it.
Does cyber insurance transfer risk?
It transfers the financial consequence, not the risk itself. The breach still happens, customers are still affected, and reputational damage and regulatory obligations remain with you. Transfer is a legitimate response, but exam questions often test whether you know its limits.
Something here not clear? A topic you wish we covered? Tell us. We read every message, and a request is the fastest way to get a guide written — several of these exist because somebody asked.