liveBook · Manning

Annualized rate of occurrence

As explained in Data-Driven Cybersecurity

Annual rate of occurrence is the estimated frequency or likelihood of a security incident or threat event within one year.

Annualized rate of occurrence (ARO) estimates how often a security incident or threat event is expected in one year. Paired with single loss expectancy (SLE), it helps estimate annualized loss expectancy (ALE): the expected annual loss associated with a risk. section 6.3.2

ARO = Number of incidents / Year

Estimate ARO by expressing the expected number of incidents over one year. section 6.3.2

An event expected every two years

If an incident is expected once every two years, its estimated annual rate is 0.5. That estimate can be combined with SLE to calculate ALE. section 6.3.2

Treat the result as an estimate, not a certainty. Historical incident data may be unreliable, unpredictable events may change the rate, and assumptions must remain representative of the organization’s risk profile. section 6.3.2

How Data-Driven Cybersecurity covers it

How deep it goes
Defines ARO, gives its calculation and a two-year example, then identifies estimation challenges without detailing a forecasting method.
Examples
Uses an incident expected once every two years to illustrate an ARO of 0.5.
What it assumes
Assumes an identified asset and a single loss expectancy for the broader loss calculation; teaches ARO estimation from expected incidents.
What you can do after
Evaluate/understand an estimated annual incident rate and use it with single loss expectancy to calculate annualized loss expectancy.
How it connects
Connects ARO to single loss expectancy, annualized loss expectancy, and historical incident data.
Cover of Data-Driven Cybersecurity
liveBookmanning.com
Read Data-Driven Cybersecurity on liveBook Get the book at manning.com

This explainer was generated by Manning's knowledge graph from the text of Data-Driven Cybersecurity. The section links point to the parts of the book it draws on.