Skip to main content
Annual Loss Expectancy (ALE) is the cornerstone metric of the Leverage Cyber platform. Where traditional security tools report severity labels and CVSS scores, Leverage Cyber answers the question that actually drives decisions: “How much could this cost us per year if we leave it unaddressed?” ALE gives every stakeholder — from the security engineer triaging findings to the CFO reviewing the quarterly risk report — a single number that represents the financial exposure of each open issue in your attack surface.

​
The ALE Formula

ALE is derived from two components: Single Loss Expectancy (SLE) and Annual Rate of Occurrence (ARO). The formula is straightforward, and its power comes from grounding both inputs in real-world data rather than theoretical assumptions.
Single Loss Expectancy is the estimated total cost of one successful exploitation of a finding. This is not just the cost to restore a system — it encompasses every downstream expense triggered by a breach event: incident response, forensic investigation, legal and regulatory exposure, customer notification, and business disruption. Annual Rate of Occurrence is the estimated probability that the finding will be successfully exploited within a 12-month period. An ARO of 1.0 means exploitation is expected to occur once per year. An ARO of 0.10 means there is a 10% probability of exploitation in a given year. Leverage Cyber derives ARO from observed threat intelligence data, not statistical guesswork.

​
How Leverage Cyber Calculates ARO

Leverage Cyber’s ARO estimates draw on four data sources, updated continuously as part of your 24/7 monitoring coverage. Industry breach frequency data establishes a baseline probability for each attack type and exposure category. Credential-based attacks, for example, occur at a well-documented frequency that varies by industry sector. Your ARO starts from that empirical baseline and is adjusted for your specific exposure profile. EPSS and CVE exploit likelihood provide finding-level data where a specific CVE is associated with the exposure. The Exploit Prediction Scoring System (EPSS) estimates the probability that a given CVE will be exploited in the wild within 30 days, giving Leverage Cyber a forward-looking likelihood signal beyond static CVSS severity. Active threat campaign intelligence captures whether the attack technique associated with your finding is currently being used by active threat actors. A vulnerability class that is the subject of an active ransomware campaign carries a materially higher ARO than the same class with no known active exploitation. Prior breach history, when available through industry reporting or disclosed incidents, is factored in to reflect whether your organization or sector has previously been targeted using the same attack vector.

​
How Leverage Cyber Calculates SLE

Single Loss Expectancy combines direct and indirect costs to produce a realistic all-in estimate of what one successful breach event would cost your organization. Direct costs are the expenses you can plan for and line-item in a breach budget: incident response retainer activation, digital forensics, legal counsel, regulatory notification requirements, and any applicable regulatory fines. For organizations operating under HIPAA, PCI-DSS, GDPR, or SOC 2 requirements, regulatory fines are scoped to the applicable framework’s penalty structure and the sensitivity of data at risk. Indirect costs are harder to budget but often larger in aggregate: reputational damage measured through customer churn modeling, operational downtime calculated against your revenue-per-hour baseline, productivity loss during recovery, and the long-term cost of rebuilding customer and partner trust. Leverage Cyber uses industry-sector benchmarks to estimate indirect costs where they cannot be directly measured. Both components are calibrated to your organization’s size, sector, and the specific data classification of the exposed asset. A finding on a system that handles regulated healthcare data will produce a different SLE than the same finding on a marketing subdomain with no sensitive data — the formula reflects your actual exposure, not an industry average.

​
Interpreting Your ALE Score

Use the table below to interpret each finding’s ALE and understand the recommended remediation timeline associated with each severity band. Severity bands are not arbitrary thresholds — they map to remediation timelines that reflect the compounding cost of inaction. A Critical finding accumulates over $83,000 in expected exposure for every month it remains open. The 30-day remediation target ensures your organization acts before significant expected loss materializes. For Medium and Low findings, the recommended timelines allow for planned remediation within normal engineering cycles rather than emergency response. This avoids the operational disruption of treating every finding as a crisis while still ensuring lower-impact exposures are systematically addressed.

​
Portfolio ALE

Your Leverage Cyber report presents ALE at two levels. Finding-level ALE is the annual exposure attributed to a single open finding. Portfolio ALE is the sum of all finding-level ALE figures in your current assessment — it represents your organization’s total annual cyber risk exposure across the entire external attack surface. Portfolio ALE is the figure most relevant for board reporting, insurance underwriting, and annual security budget conversations. It gives leadership a single number that represents the financial consequence of your current security posture and allows direct comparison to prior periods as findings are remediated. A declining portfolio ALE over successive quarterly assessments is the clearest evidence of an improving security program.
ALE estimates in your Leverage Cyber report are intentionally conservative and are derived from publicly available breach cost data published by industry research organizations. Actual costs in a breach event may vary based on your specific circumstances, existing insurance coverage, and the speed and effectiveness of your incident response. Use ALE as a planning and prioritization tool, not as a precise actuarial forecast.