Definition
The Annualized Rate of Occurrence (ARO) is a metric used in risk management to estimate how often a specific threat or vulnerability is likely to occur within a one-year period. It quantifies the expected frequency of a negative event, helping organizations understand the potential for repeated impacts. By assigning a numerical value, ARO provides a standardized way to assess risk likelihood. For instance, a system might have an ARO of 0.5, meaning a specific failure is expected to happen once every two years. This contrasts with the impact or consequence of an event, which measures the severity of the damage when it does occur, not its frequency. Understanding ARO is crucial for prioritizing security controls and resource allocation, and it frequently appears on exams like Security+, CySA+, and CISSP.