Average Annual Loss (AAL)
Average Annual Loss (AAL) is the mean of the annual loss distribution produced by cyber risk quantification, representing the loss an organization would expect to incur per year over a long time horizon.
What AAL Actually Represents
AAL is the expected value of annual cyber losses. If the same organization, with the same controls and exposure, ran through many possible years, AAL is the average of the loss outcomes across those years.
In practice AAL comes out of Monte Carlo simulation across many synthetic years, each representing a possible combination of events and impacts. The mean of those simulated years is AAL.
Why AAL Alone Is Not Enough
AAL is a useful headline number but hides the shape of the exposure. A distribution with a low AAL and a heavy tail can still produce catastrophic outcomes in bad years. That is why AAL is typically reported alongside Loss Exceedance Curve data, which shows the full shape, and specific return period figures like the 1:100 annual loss.
Boards need both. AAL tells them what to expect. The tail figures tell them what to prepare for.
AAL and Insurance Language
AAL comes originally from actuarial and insurance modeling, where it has long been the standard metric for annualized loss expectation. Its adoption in cyber reflects the broader convergence of cyber quantification with actuarial methods.
How Kovrr Approaches AAL
Kovrr's CRQ Platform reports AAL as a standard output alongside the full LEC and return period markers, so boards see both the expected loss and the tail exposure. See what is cyber risk quantification (CRQ).
Related Terms
Turn Cyber Risk Into Financial Exposure the Board Can Act On
Security leaders are being asked to defend budgets, prioritize controls, and report cyber risk in the same terms as every other enterprise risk. Kovrr's CRQ Platform models loss scenarios, benchmarks control performance, and gives the C-suite a defensible view of where cyber sits on the balance sheet.
