What does ALE stand for?
ALE stands for Annualized Loss Expectancy. The expected yearly loss from one risk: ALE = SLE × ARO. Use it to compare the cost of a control against the loss it prevents.
ALE is the loss an organization should expect from one risk in a year. It is the single loss expectancy multiplied by the annualized rate of occurrence. Its use is practical: compare the ALE with the yearly cost of a control. If a control costs more per year than the loss it prevents, it is hard to justify on cost alone.
ALE in practice: an example
A lost laptop costs a company 3,000 dollars each time, and it loses about six a year. The ALE is 18,000 dollars. Full-disk encryption and tracking software for the fleet cost 5,000 dollars a year and are expected to cut the loss per incident sharply, so the purchase is easy to defend.
What ALE is confused with
ALE vs SLE: what is the difference?
SLE is the cost of one occurrence. ALE spreads the risk over a year by multiplying SLE by the expected number of occurrences. What SLE stands for
ALE vs ARO: what is the difference?
ARO is how often the event is expected each year. ALE is the money that frequency produces. What ARO stands for
Which exams cover ALE?
ALE is on the official CompTIA acronym list for one of the four exams covered here.
- Security+ SY0-801: 5.2 (Security Program Management and Oversight).
Each number is a CompTIA exam objective and the name in brackets is its domain. The exam puts the term in a scenario; it does not ask you to recite the expansion.
Check yourself: two practice questions
Written by CertSprint for this page. They are not taken from any exam.
1. The SLE of a risk is 10,000 dollars and the event is expected once every four years. What is the ALE?
- 40,000 dollars
- 10,000 dollars
- 4,000 dollars
- 2,500 dollars
Show the answer
D. 2,500 dollars. Once in four years is an ARO of 0.25, and 10,000 times 0.25 is 2,500 dollars.
2. A control costs 12,000 dollars a year and reduces a risk's ALE from 9,000 dollars to 1,000 dollars. What does a cost comparison show?
- The control saves 8,000 dollars a year and costs 12,000, so it costs more than it saves
- The control pays for itself twice
- The ALE is now negative
- The SLE has doubled
Show the answer
A. The control saves 8,000 dollars a year and costs 12,000, so it costs more than it saves. The reduction in expected loss is 8,000 dollars a year, which is less than the 12,000 dollar cost. Other reasons, such as a legal requirement, could still justify it.
Sources: NIST glossary: annualized loss expectancy; NIST IR 8286A, Identifying and Estimating Cybersecurity Risk for Enterprise Risk Management; NIST SP 800-30 Rev. 1, Guide for Conducting Risk Assessments. The acronym and its expansion come from CompTIA's official acronym lists, linked from each exam glossary above. The explanation, example and questions are CertSprint's own, checked against these sources on 11 November 2026.