In the last post I claimed that mature security is knowing which doors are worth locking, and being able to show your working on the ones you leave open. That “show your working” bit isn’t a figure of speech. There’s an actual calculation, it’s been in the security syllabus for decades, and it’s one of those rare bits of theory that survives contact with a real budget.
It comes out of the quantitative risk analysis you’ll find in things like the CISSP body of knowledge, and the reason it’s worth knowing isn’t the arithmetic — the arithmetic is trivial. It’s that the calculation forces you to say out loud the numbers you were implicitly guessing at anyway, and then it tells you something genuinely counterintuitive: that spending money to fix a risk is often the wrong answer.
The chain, in plain terms
Start with a single bad event and work out what one occurrence costs you.
- Single Loss Expectancy (SLE) — what it costs you once. It’s the value of the asset multiplied by the fraction of it you’d lose in the event (the “exposure factor”). A database worth £500,000 to the business, in an event that would compromise 40% of that value, gives an SLE of £200,000.
Now ask how often you’d expect it.
- Annualised Rate of Occurrence (ARO) — how many times a year, on average. Once every five years is 0.2. Twice a year is 2. It’s a frequency, and yes, it’s an estimate.
Multiply the two and you get the number that actually drives decisions:
- Annualised Loss Expectancy (ALE) — the expected cost per year.
ALE = SLE × ARO. Our £200,000 event, expected once every five years, is an ALE of £40,000 a year.
That last number is the one to hold onto, because it’s denominated the same way your controls are: per year. Now you can compare like with like.
The bit that changes how you decide
A control isn’t worth its price just because it reduces risk. It’s worth it only if it reduces risk by more than it costs. So:
Value of a control = ALE before − ALE after − annual cost of the control
Work our example. That £40k/year database risk. Suppose better backups and endpoint detection cost £15,000 a year and cut the frequency from once-in-five-years to once-in-twenty (ARO 0.2 → 0.05). New ALE: £200,000 × 0.05 = £10,000. So:
£40,000 − £10,000 − £15,000 = +£15,000 a year of net benefit. Do it. Easy call.
Now change one number. Suppose the only control that helps costs £60,000 a year and removes the same £30k of expected loss:
£40,000 − £10,000 − £60,000 = −£30,000 a year.
You’d be spending sixty grand to save thirty. The control is a worse outcome than the risk it prevents. And this is the case the instinct-driven “more security is always good” answer gets catastrophically wrong — because on the slide, “reduces ransomware risk by 75%” looks like an unambiguous win. The maths says you’re setting fire to £30,000 a year to feel safer.
Four things you can do with a risk (and a dishonest fifth)
Once you can see the numbers, the menu of responses opens up. Fixing it is only one option.
- Mitigate (reduce) — add the control, buy the risk down. Correct when the control’s value is comfortably positive, like the first example.
- Transfer — make it someone else’s financial problem. Cyber-insurance, or a contract that pushes liability to a supplier. If a policy covering that £30k of expected loss costs £8,000 a year, transferring beats the £60k control by a mile. You haven’t made the event less likely — you’ve capped what it costs you when it lands.
- Avoid — don’t do the risky thing at all. Drop the feature, don’t store the data, close the integration. The only response that takes the risk to actual zero, at the price of whatever you gave up to get there.
- Accept — decide, on purpose, to live with it. Rational when the ALE is genuinely small, or when every control and every transfer costs more than the risk itself. This is the mature move that the fortress mindset can’t make.
And the fifth, the one that masquerades as the fourth: ignore. Accepting a risk means a named owner looked at the number, signed it off, and set a date to look again. Ignoring a risk is accepting it without any of that — nobody decided, nobody owns it, nobody will revisit it. The two produce an identical system today and a completely different conversation after the incident. “We accepted this risk in March, here’s the sign-off, here’s the review we had booked” is a defensible position. “Nobody was really looking at that” is not.
Why this is really a decision-making post
The instinctive read of this calculation is that it’s about security. It isn’t, quite. It’s about honesty — the same honesty this blog keeps banging on about. It doesn’t make the decision for you; it makes you state the decision, with the numbers attached, so that “we’ll accept that one” stops being a shrug and becomes a position you can stand behind.
Which is exactly why a risk acceptance belongs in the same place as your architecture decisions. It is an architecture decision — a consequential, hard-to-reverse choice with a rationale that the next person will need and won’t be able to reconstruct. “We accepted this risk, at this ALE, because every treatment cost more than the exposure, owner Jane, review next April” is precisely the road-not-taken that an ADR exists to capture.
The honest caveats
I’d be doing the opposite of showing my working if I pretended the maths was clean.
- The inputs are estimates. Asset values are arguable and AROs are, frankly, guesses dressed as decimals. Garbage in, garbage out — the calculation is only ever as good as the numbers you feed it. Its value is less the precise answer than the argument it forces you to have.
- Some losses don’t fit in the spreadsheet. Reputation, regulatory censure, the erosion of customer trust — real, sometimes existential, and genuinely hard to put a pound sign on. Don’t let a tidy model quietly zero out the things it can’t measure.
- Some risks can’t be transferred. Insurance pays out cash; it doesn’t hand you back your reputation or un-breach your customers’ data. “Transfer it” has limits, and the important risks tend to be exactly the ones that hit those limits.
None of that is a reason to skip the exercise. It’s a reason to treat the number as the start of a grown-up conversation rather than the end of one. Because the alternative — deciding how much security to buy on gut feel and the fear of the post-incident review — is how you end up with both the £60,000 control and the risk you never got round to naming.
Show your working. Even when the working is rough. Especially when it’s rough.