How much risk do you have in dollars?

What Each Number Means

• ALE — Annualized Loss Expectancy (Expected Annual Loss): the average value expected to be lost per year due to cyber incidents, combining the probability of an incident with its cost (probability × impact). It is the "average" of the loss distribution — and alone hides the atypical years.
• SLE — Single Loss Expectancy: the estimated cost of a single material incident if it occurs. ALE, in essence, is SLE weighted by the probability of the incident happening in the year.
• 12-Month Probability: the estimated chance of at least one material incident in the next 12 months, given by the sector baseline, security maturity, and scale of exposed assets.
• VaR P90 — Value at Risk (Percentile 90): the level of loss that is exceeded on average once every ten years — the "bad year." Cyber loss is asymmetric; VaR shows the tail of rare and severe events that the average (ALE) does not reveal.
• VaR P99 (Percentile 99): the level of loss exceeded on average once every hundred years — the catastrophic scenario. It is the worst-case reading to size reserves and insurance coverage.
• GDPR fine exposure: the portion of risk tied to an administrative sanction, taken as 4% of revenue and held at the €20 million statutory reference, then adjusted by the probability of an incident and the sensitivity of sector data. GDPR itself applies the greater of the two, so this reading is deliberately the conservative one.
• Sector benchmark: your country base cost multiplied by your sector factor, both from IBM Cost of a Data Breach 2025. It is the market reference that situates your single-loss estimate.