A system configured for determining a frequency of cyber risk losses within one or more computing systems composed of computing elements, the system comprising: one or more hardware processors configured by machine-readable instructions to: assess vulnerability by: determining an exposure window for a computing element wherein determining the exposure window comprises determining a number of discrete times within a given time frame when the computing element is in a vulnerable state; wherein determining the number of discrete times comprises determining exploitable vulnerable states and non-exploitable vulnerable states, and wherein the exposure window represents a time window of exposure to exploitation by threat actors; determine a frequency of contact of the computing element with the threat actors; normalize the exposure window by setting each discrete time to a first period of time and setting the given time frame to a second period of time that is longer than the first period of time; normalize the frequency of contact by determining a mean time between contact, wherein the mean time between contact is represented by a number of occurrences of the first periods of time within the second period of time; calculate a loss event frequency by dividing the normalized exposure window by the normalized frequency of contact; and repeat the operations above for multiple computing elements. one or more hardware processors configured by machine-readable instructions to: assess vulnerability by: determining an exposure window for a computing element wherein determining the exposure window comprises determining a number of discrete times within a given time frame when the computing element is in a vulnerable state; wherein determining the number of discrete times comprises determining exploitable vulnerable states and non-exploitable vulnerable states, and wherein the exposure window represents a time window of exposure to exploitation by threat actors; determine a frequency of contact of the computing element with the threat actors; normalize the exposure window by setting each discrete time to a first period of time and setting the given time frame to a second period of time that is longer than the first period of time; normalize the frequency of contact by determining a mean time between contact, wherein the mean time between contact is represented by a number of occurrences of the first periods of time within the second period of time; assess vulnerability by: determining an exposure window for a computing element wherein determining the exposure window comprises determining a number of discrete times within a given time frame when the computing element is in a vulnerable state; wherein determining the number of discrete times comprises determining exploitable vulnerable states and non-exploitable vulnerable states, and wherein the exposure window represents a time window of exposure to exploitation by threat actors; determine a frequency of contact of the computing element with the threat actors; normalize the exposure window by setting each discrete time to a first period of time and setting the given time frame to a second period of time that is longer than the first period of time; normalize the frequency of contact by determining a mean time between contact, determining the number of discrete times comprises determining exploitable vulnerable states and non-exploitable vulnerable states, and wherein the exposure window represents a time window of exposure to exploitation by threat actors; determine a frequency of contact of the computing element with the threat actors; normalize the exposure window by setting each discrete time to a first period of time and setting the given time frame to a second period of time that is longer than the first period of time; normalize the frequency of contact by determining a mean time between contact, wherein the mean time between contact is represented by a number of occurrences of the first periods of time within the second period of time; calculate a loss event frequency by dividing the normalized exposure window by the normalized frequency of contact; and repeat the operations above for multiple computing elements.