Activity 1 · 15–20 minutes

In this activity

Understand the model
Follow the worked example
Use the calculator
Try it yourself

Activity 1 · CySA+ v4

Quantitative risk analysis

Put a monetary estimate on a risk, then explore whether a proposed security control reduces enough expected loss to cover its cost.

01 · Understand

Understand the model

Quantitative risk analysis uses numbers to estimate the likelihood and impact of a risk. This activity uses a simple model for one asset and one threat scenario: estimate the loss from one event, then multiply it by the expected number of events per year.

Asset value · AV

The monetary value exposed to loss in your chosen scenario. Keep the asset scope and currency consistent throughout the calculation.

Exposure factor · EF

The proportion of that value lost in one event. An EF of 40% means losing 40% of the asset value; use 0.40 when multiplying.

Single loss expectancy · SLE

The estimated monetary loss from one event.
SLE = AV × (EF ÷ 100) when EF is entered as a percentage.

Annual rate of occurrence · ARO

The expected number of events per year. An ARO of 0.2 means one event every five years on average; an ARO of 2 means two events per year on average. It is an event frequency, not a percentage.

Annualised loss expectancy · ALE

The estimated average loss per year.
ALE = SLE × ARO

Read the estimate correctly

ALE is a long-term expected average. It does not mean the organisation will lose that exact amount each year, and it is not the maximum possible loss. Record where your estimates come from and test a range of plausible values.

02 · Follow the example

A malware outage

A business estimates that £100,000 of value is exposed to a malware outage affecting a service. An incident would cause a 40% loss, and the estimated frequency is one incident every five years on average.

A proposed security control package costs £2,000 per year. For this exercise, assume it reduces the loss per incident to 20% and the frequency to one incident every ten years on average. These are illustrative estimates, not guaranteed control effects.

Risk estimates for the same service before and after the proposed control. ARO is measured in events per year; ALE is measured in pounds per year.
Measure	Before control	After control
Asset value (AV)	£100,000	£100,000
Exposure factor (EF)	40%	20%
Single loss expectancy (SLE)	£40,000	£20,000
Annual rate of occurrence (ARO)	0.2	0.1
Annualised loss expectancy (ALE)	£8,000	£2,000

Calculate the baseline loss
SLE = £100,000 × 0.40 = £40,000 per event.
ALE = £40,000 × 0.2 = £8,000 per year.
Calculate the residual loss
After the proposed control, SLE = £100,000 × 0.20 = £20,000 per event.
Residual ALE = £20,000 × 0.1 = £2,000 per year.
Compare annual cost and benefit
Gross annual loss reduction = £8,000 − £2,000 = £6,000.
Net annual benefit = £6,000 − £2,000 control cost = £4,000.
Calculate return on security investment
ROSI = (net annual benefit ÷ annual control cost) × 100.
ROSI = (£4,000 ÷ £2,000) × 100 = 200%.

What would you recommend?

Under these assumptions, the control has a positive net annual benefit. Check the evidence behind the impact and frequency estimates before making a decision. Include relevant purchase, setup, training, and maintenance costs on an annual basis, and consider the organisation’s risk tolerance and other requirements.

Quantitative risk calculator

Change the estimates to compare annual expected loss with the cost of a control. Results update as you type.

Before controls

Estimate the current loss for this asset and threat.

Asset value (AV) (£)

The monetary value of the asset exposed to loss.

Exposure factor (EF) (%)

The percentage of asset value lost in one event, from 0% to 100%.

Annual rate of occurrence (ARO) (events/year)

0.2 means once every 5 years on average. Values above 1 mean multiple events per year.

After controls

Use the same asset value and estimate how the control changes impact and frequency.

Exposure factor after controls (%)

The percentage lost per event after the control is applied, from 0% to 100%.

ARO after controls (events/year)

The expected annual event rate after controls. For example, 0.1 means once every 10 years on average.

Annual control cost (£/year)

The total yearly cost of the control. Use 0 for no annual cost; ROSI then has no defined percentage.

Baseline risk

Single loss expectancy (SLE): £40,000.00; SLE = AV × (EF ÷ 100). Expected loss per event.
Annualised loss expectancy (ALE): £8,000.00; ALE = SLE × ARO. Expected loss per year.

Residual risk after controls

Residual SLE: £20,000.00; AV × (EF after controls ÷ 100). Expected loss per event.
Residual ALE: £2,000.00; Residual SLE × ARO after controls. Expected loss per year.

Annual cost and benefit

Gross annual loss reduction: £6,000.00; Baseline ALE − residual ALE.
Net annual benefit: £4,000.00; Gross annual loss reduction − annual control cost.
Return on security investment (ROSI): 200%; (Net annual benefit ÷ annual control cost) × 100.

Amounts are shown in GBP and rounded for display only. ALE is a long-term expected average, not a prediction of loss in a specific year.

03 · Experiment

Try it yourself

Use the calculator to answer each question. Select Reset worked example before starting the next one, then open the answer to check your reasoning.

1. What if the baseline event happens once every two years?

Set the baseline ARO to 0.5. The baseline SLE stays £40,000, but ALE becomes £40,000 × 0.5 = £20,000 per year. Changing frequency changes annual loss, not the loss from one event.

2. At what annual control cost does this example break even?

Set annual control cost to £6,000. It equals the expected annual loss reduction, so net annual benefit is £0 and ROSI is 0%. A higher cost makes net annual benefit negative.

3. What if the proposed control has no effect?

Set the after-control EF to 40% and ARO to 0.2. Both ALE values are £8,000, so the loss reduction is £0. With the £2,000 annual control cost, net annual benefit is −£2,000 and ROSI is −100%.