Technology risk in annual dollars. The unit your CFO already uses.
Annualized Loss Expectancy (ALE) quantifies your technology risk exposure in dollars per year. It is the same unit your CFO uses for everything else. Some mid-market companies have never calculated theirs. Preside targets a baseline within 30 days, then tracks the reduction quarterly.
The Formula
ALE = SLE × ARO
A quantitative risk expression: single loss expectancy times annualized rate of occurrence. A dollar-loss formula of this kind appears as far back as FIPS PUB 65 (1979, since withdrawn). NIST's current risk guidance describes estimating likelihood and impact but does not prescribe this formula. We use it because it turns each risk into annual dollars a CFO can compare.
SLE
Single Loss Expectancy
The dollar impact of one occurrence of a given risk event, including recovery, downtime, and remediation.
ARO
Annualized Rate of Occurrence
How often the event happens per year. Once every five years = 0.20. Roughly once every seven years = 0.15.
ALE
Annualized Loss Expectancy
Example: one risk0.15 × $400,000 = $60,000/yr
How to Read the Figure
Example: one risk in annual dollars
The formula is the easy part. The hard part is the inputs: which events belong on the list, what each one would cost your company, and how often it can realistically happen given the controls you have today. The same event can carry a very different figure at a different company.
EXAMPLE · ONE RISK
Example: ransomware affecting an ERP system
| Risk | SLE | ARO | ALE |
|---|---|---|---|
| Ransomware (ERP downtime) | $400k | 0.15 | $60k |
A figure like this lets a board compare a control that costs money against the annual loss it is meant to reduce.
The register behind a real baseline is built from your own contracts, systems, and incident history during an engagement. It is specific to your company, and it is not something a generic list can produce.
Why It Matters Now
ALE can grow whether you manage it or not
Technology risk builds as a company grows. Some companies have no dollar figure for it. Preside targets a first figure within 30 days.
Why risk builds over time
Technology risk can compound as the technology footprint, dependencies, threat exposure, and regulatory obligations grow. Every new SaaS platform, integration, regulatory change, and AI tool adds to exposure.
Why a number helps
Some mid-market organizations operate without a calculated ALE. Risk-matrix colors and "high / medium / low" labels can be hard to defend when a board, an auditor, or a buyer asks for a number.
Time to baseline with Preside
Our target is a full ALE calculation within the first 30 days of an engagement, with the first quarterly change reported inside the first quarter.
By Industry
Where ALE can concentrate by sector
The risks that matter most differ by sector. Examples:
Financial Services
Vendor breach exposure, legacy authentication in older banking stacks, PCI-DSS compliance, customer data exfiltration. Largest areas: third-party risk and compliance.
Biotech & Pharma
IP exfiltration, regulated data handling, FDA compliance posture, AI-aided research data flows. Largest areas: IP protection and regulatory.
Energy & Utilities
NERC CIP compliance, OT/IT boundary exposure, legacy SCADA encryption, regulatory penalties. Largest areas: NERC CIP and the OT/IT boundary.
Professional Services
Client data exfiltration, shadow AI exposure (legal/finance), email-based wire fraud, vendor compromise. Largest areas: client data and wire fraud.
How Preside Reduces ALE
A four-step quarterly cycle
The same loop runs every quarter: baseline, prioritize, reduce, report. Each cycle builds on the prior one.
Baseline
Full risk register built from your own contracts, systems, and incident history. SLE and ARO estimated per risk, with assumptions stated. Total ALE in dollars.
Prioritize
Rank by ALE contribution and remediation cost. Highest dollar-impact, lowest effort risks first.
Reduce
Targeted controls. Preside may execute directly or manage specialists.
Report
Quarterly ALE change in dollars to leadership and sponsors. Clear figures with stated assumptions, ready for board review.
References
Methodology and citations
ALE is not a Preside invention. The underlying idea is decades old. We apply it to mid-market technology risk.
Put a number on technology risk.
Our target is a baseline within 30 days of engagement, then quarterly tracking.