Which metric is used to estimate the annualized cost of security breaches?

• A. ALE
• B. ARO
• C. TCI
• D. Life cycle cost

Answer: (A)

The main concept is estimating the yearly financial impact of security breaches by combining how much is lost per incident with how often such incidents are expected to occur in a year. The metric that does this is the annualized loss expectancy, which multiplies the loss from a single breach by the expected number of breaches per year. This gives the expected cost per year due to security incidents and is useful for comparing how different controls reduce potential losses. The other metrics don’t capture annualized breach cost in the same way: frequency alone (how often breaches happen) doesn’t include the monetary loss per incident; loss per incident alone doesn’t account for how often breaches occur; life cycle cost looks at total cost over the system’s lifetime rather than annualized yearly losses; and TCI is not a standard term for this purpose.