A risk analyst is quantifying the exposure of a customer database to ransomware. Historical data indicates a successful ransomware incident occurs approximately once every four years, and each incident is estimated to cause $800,000 in recovery, downtime, and notification costs. Management asks the analyst to express the risk in a form that supports a cost-benefit comparison against a proposed $150,000-per-year backup and detection solution. Which figure should the analyst present?