How to Put a Dollar Figure on Cyber Risk
Every security decision is really a spending decision. Buy the fancier backup system? Hire another analyst? Replace the aging firewall? Underneath each question is the same quiet math: how much is this risk actually costing us, and how much is it worth to reduce it?
Most people answer with a shrug — “that feels risky,” “that one’s probably fine.” Gut feel is fast, but it doesn’t survive a budget meeting. Security teams use two broad approaches to size up risk instead, and knowing the difference will change how you argue for a budget.
Two ways to measure a risk
Qualitative assessment uses judgment and labels: you rate a risk high, medium, or low and plot likelihood against impact on the familiar red/yellow/green grid. It’s fast, needs no historical data, and is great for getting a room to agree on priorities. The catch: it’s subjective. My “high” might be your “medium,” and you can’t add up colors to justify a purchase.
Quantitative assessment uses money and numbers. Instead of “high,” you say “$50,000 a year.” It’s objective, comparable across risks, and spoken in the language executives actually fund things in. The catch: it takes real data, and any number is only as good as the estimates behind it.
Most organizations do both — a qualitative pass to find what matters, then a quantitative pass on the few risks big enough to justify the math. The quantitative side is where the useful vocabulary lives, so let’s run the numbers.
The formula, in plain terms
To turn a risk into an annual dollar figure, you need three ingredients:
- Asset value (AV): what the thing at risk is worth. Not just its sticker price — include the cost of downtime, lost customers, and cleanup.
- Exposure factor (EF): the share of that value you’d lose in a single bad event, written as a percentage. A fire might destroy 100% of a warehouse; a data breach might effectively cost you 40% of a database’s value.
- Annualized rate of occurrence (ARO): how many times per year you expect the event. Once a year is 1. Once every four years is 0.25.
From those, two more values fall out:
- Single Loss Expectancy (SLE) = AV × EF — what one incident costs you.
- Annualized Loss Expectancy (ALE) = SLE × ARO — what it costs you per year, on average, over the long run.
That final number, the ALE, is the one that lets you compare a risk directly against the price of fixing it.
A worked example
Say you run an online store. Your customer database is worth about $500,000 once you factor in the revenue, trust, and recovery costs tied to it (AV). A serious breach wouldn’t erase all of that, but it would cost you roughly 40% of it in fines, churn, and cleanup (EF = 0.4).
- SLE = $500,000 × 0.4 = $200,000 per incident.
Looking at your industry’s track record and your current defenses, you estimate an event like this hits about once every four years (ARO = 0.25).
- ALE = $200,000 × 0.25 = $50,000 per year.
Now the decision becomes concrete. A vendor offers a bundle of better backups and monitoring for $20,000 a year that would cut the frequency to roughly once every twenty years (ARO = 0.05).
- New ALE = $200,000 × 0.05 = $10,000 per year.
The control saves you $50,000 − $10,000 = $40,000 a year and costs $20,000. Net gain: $20,000 a year. That’s no longer a hunch — it’s a business case. And if the fix had cost $60,000 to save $40,000, the same math would tell you, just as clearly, to walk away.
What you actually do with the risk
Running the numbers is only step one. Once you know what a risk costs, you have four honest choices for what to do about it:
- Reduce it — add controls that lower the likelihood or the damage (the backup bundle above).
- Transfer it — hand the financial hit to someone else, most often through cyber insurance. Note the risk doesn’t disappear; you’re paying to share the cost.
- Avoid it — stop doing the risky thing entirely. Kill the feature, retire the system, don’t collect the data.
- Accept it — decide the risk is small enough to live with, and document that you chose to. Acceptance is a legitimate decision only when it’s deliberate and written down.
Common mistakes people make
- Treating the numbers as facts. An ALE is an estimate built on estimates. Use it to compare and prioritize, not to pretend you’ve predicted the future.
- Forgetting that “accept” is a real option. Not every risk deserves a fix. Spending $50,000 to prevent a $5,000 loss is its own kind of failure.
- Confusing transfer with elimination. Insurance pays for the damage; it doesn’t stop the breach or repair your reputation.
- Skipping the write-up. An accepted risk nobody documented is just a surprise waiting to happen — and the person who “decided” is rarely the one who remembers deciding.
Quick check
Test yourself before you close the tab:
- A server is worth $80,000. A power surge would destroy 25% of it, and you expect one every two years. What’s the ALE?
- Which risk treatment describes buying cyber insurance?
- Why can’t you add up a set of “high / medium / low” ratings to justify a budget?
(Answers: 1 — SLE = $80,000 × 0.25 = $20,000; ALE = $20,000 × 0.5 = $10,000/year. 2 — Transfer. 3 — Because qualitative labels are subjective judgments, not measured quantities; they rank risks but can’t be summed into a dollar figure.)
The next time someone says a risk “feels” big or small, you now have a way to check. Put a number on it, weigh it against the cost of the fix, and let the math — not the loudest voice in the room — make the call.
Sources & References
- NIST SP 800-30 Rev. 1 — Guide for Conducting Risk Assessments
- ISO/IEC 27005:2022 — Guidance on managing information security risks
Image credit: https://www.rawpixel.com/image/5911981/image-background-public-domain-wooden — cc0 1.0 (via Openverse)
This article is for general educational purposes only and does not constitute professional, legal, or security advice.
