What our cyberattack cost calculator actually measures (and its limits)

No invented shock figure to scare anyone — the real method behind the calculator, sourced public data, and why a single number never replaces a real audit.

October 24, 2026 · SunuCyberSecurity Team

Source: SunuCyberSecurity cyberattack cost calculator, production code constants as of October 24, 2026

Our cyberattack cost calculator was built on one rule: real, sourced public data, not invented numbers meant to impress. Here's exactly what it calculates, where the figures come from, and — just as important — what a single number can't tell you about your own actual risk.

The method: a cost per compromised record, not an invented number

The calculator multiplies the number of customer records you enter by a unit cost of 96,000 FCFA — derived directly from the average cost per compromised record published in the IBM Cost of a Data Breach Report 2025 ($160), converted at an indicative rate of about 600 FCFA to $1. This is a deliberately simple linear approximation: it gives an order of magnitude in a few seconds, not a precise actuarial assessment of your actual exposure.

The calculation is deliberately transparent: you pick a sector and a bracket of potentially exposed records, the result appears instantly, and the conversion rate plus the sources are spelled out right under the result — no black box.

The benchmarks used — and why only one is African

Three real averages from the same IBM report serve as comparison points. The South Africa average ($2.37M, 1.42 billion FCFA) is the only African data point published in that report — deliberately chosen as the primary benchmark instead of the much higher Middle East figures. The global average ($4.44M, 2.66 billion FCFA) provides a second reference. For the finance sector specifically, the calculator also shows the Middle East average ($10.67M, 6.40 billion FCFA) — the costliest sector in IBM's report, in its costliest region — labeled explicitly as a Middle East figure, not disguised as an African estimate.

Two concrete examples

An e-commerce SME with 1,000 to 10,000 customer records (median bracket used: 3,000) gets an estimate of 288,000,000 FCFA — about 608 times the annual cost of the SunuEssential subscription (474,000 FCFA/year).

A bank with 10,000 to 100,000 records (median bracket: 20,000) gets 1,920,000,000 FCFA — about 4,051 times the subscription. For this sector, the calculator adds a separate panel: BCEAO has already issued pecuniary sanctions of up to 300 million FCFA against WAEMU-zone banks for governance failures, including information systems security (Instruction No. 009-06-2015) — a real regulatory risk, on top of the direct incident cost, and not included in the headline estimate itself.

What this number doesn't capture

An average cost per record is a linear approximation. In reality, a significant share of an incident's cost is fixed — forensic investigation, legal notification, crisis communication — and doesn't scale proportionally with the number of records. The calculator therefore tends to underestimate very small incidents (where fixed costs dominate), giving an order of magnitude, not an invoice.

South Africa is not WAEMU or West Africa. It's the only African data point IBM publishes in this report — not a West African regional average, which doesn't exist in any public source we're aware of. Economic, monetary and regulatory realities differ substantially from one market to another.

The FCFA conversion rate (≈600 FCFA/$) is indicative, not today's rate. And the 300-million-FCFA BCEAO sanction cited was issued for governance failures, including information systems security — we're not claiming it specifically targeted a particular data breach, which isn't publicly established.

Methodology

Constants taken directly from the SunuCyberSecurity calculator's production code (96,000 FCFA/record, 474,000 FCFA/year SunuEssential subscription, South Africa/global/Middle East finance benchmarks) — not a separate sample or survey. Original sources: IBM Cost of a Data Breach Report 2025; BCEAO, disciplinary and pecuniary sanctions (2023-2025), Instruction No. 009-06-2015. Indicative FCFA conversion rate (≈600 FCFA/$), not a real-time exchange rate. Data as of October 24, 2026.

Related reading

Put this into practice

A free scan, in a few minutes, no credit card.