An exposure factor (EF) is the percentage of an asset’s value expected to be lost if a specified security incident occurs. It expresses the likely impact of that incident on that asset, rather than the incident’s likelihood. section 6.3.2
Multiply asset value (AV) by EF to estimate single loss expectancy (SLE), the loss from one occurrence. For a production database, the relevant question is how much of its value the specified incident could destroy or impair—not just how severe an associated vulnerability appears. section 6.3.2
The equation shows where EF enters a monetary estimate: SLE = AV × EF. section 6.3.2
Use that loss estimate alongside exploit likelihood, threat intelligence, and existing controls when prioritizing work. A high severity score alone does not establish business risk. section 6.3.2
