How much risk do you have in Réais?

What Each Number Means

• ALE — Annualized Loss Expectancy (Expected Annual Loss): the average value expected to be lost per year due to cyber incidents, combining the probability of an incident with its cost (probability × impact). It is the "average" of the loss distribution — and alone hides the atypical years.
• SLE — Single Loss Expectancy: the estimated cost of a single material incident if it occurs. ALE, in essence, is SLE weighted by the probability of the incident happening in the year.
• 12-Month Probability: the estimated chance of at least one material incident in the next 12 months, given by the sector baseline, security maturity, and scale of exposed assets.
• VaR P90 — Value at Risk (Percentile 90): the level of loss that is exceeded on average once every ten years — the "bad year." Cyber loss is asymmetric; VaR shows the tail of rare and severe events that the average (ALE) does not reveal.
• VaR P99 (Percentile 99): the level of loss exceeded on average once every hundred years — the catastrophic scenario. It is the worst-case reading to size reserves and insurance coverage.
• LGPD Fine Exposure: the portion of risk related to administrative sanctions under LGPD — up to 2% of revenue, with a ceiling of R$50 million — adjusted by the probability of an incident and the sensitivity of sector data.
• Sector Benchmark: the average cost of a data breach in your sector, published by IBM Cost of a Data Breach 2025 (Brazil). It serves as a market reference to situate your unique cost estimate.