Abstract. Rockfall risk analysis for mitigation action design requires evaluating the probability of rockfall events, the spatial probability and intensity of impacts on structures, their vulnerability, and the related expected costs for different scenarios. These tasks were integrated in a quantitative risk assessment procedure supported by 3D rockfall numerical modelling performed by the original code HY-STONE. The case study of Fiumelatte (Varenna, Italy), where a large rockfall in November 2004 resulted in 2 casualties, destruction of several buildings and damage to transportation corridors, is discussed. The numerical model was calibrated by a back analysis of the 2004 event, and then run for the whole area at risk by considering scenarios without protection (S0), with a provisional embankment (S1), and with a series of long-term protection embankments (S2). Computed impact energy and observed damage for each building impacted in 2004 were combined to establish an empirical vulnerability function, according to which the expected degree of loss for each element at risk was computed. Finally, costs and benefits associated to different protection scenarios were estimated, in order to assess both the technical performance and the cost efficiency of different mitigation options.