SunuBarometer: what our scans reveal about cybersecurity in francophone Africa

Not a survey, not an annual vendor report — a live calculation on our own scan results, recomputed on every request. What it shows right now, and what moved over the past eight weeks.

October 24, 2026 · SunuCyberSecurity Team

Source: SunuBarometer, computed live from our real scans — data as of October 24, 2026

SunuBarometer is neither a survey nor an annual vendor report — it's a live calculation on the real results of scans run through the SunuCyberSecurity platform, recomputed on every request over a 90-day rolling window, with no caching at all. Since late August 2026, a weekly snapshot has also been archived, which for the first time makes it possible to look at a real trend instead of a single snapshot. Here's what the 190 targets in the current window show — and what eight weeks of history reveal.

The current state, as of October 24, 2026

Across the 190 targets with at least one completed scan in the last 90 days, missing HSTS remains the most common gap: 53% don't have this header correctly configured. Next come DMARC (46% absent) and SPF (42% absent) — two email protections that, combined, determine how easily an attacker can spoof the domain for phishing. 34% have no CDN/WAF in front of their infrastructure, directly exposing the server's real IP address. 26% have an SSH port reachable from the internet, a prime target for brute-force attempts.

22% have an invalid or expired SSL/TLS certificate. The least-bad signal: among the 121 targets with a network audit deep enough to check this specific point, only 12% have a database (MySQL, MongoDB, Elasticsearch) exposed with no authentication — the most severe of the seven indicators individually, but also the rarest.

What changed over eight weeks

Since early September 2026, a Barometer snapshot has been archived every week, on top of the live calculation shown above. Comparing the first available snapshot (August 29) with the most recent one before writing this article (October 21, eight weeks later) gives a real trend, not an impression.

Six of the seven indicators got worse over the period — not an isolated blip on a single number. The sharpest move: invalid or expired SSL/TLS certificates, up from 15% to 21% (+6 points, a 40% relative increase). DMARC absent climbed from 44% to 49% (+5 points), SSH exposed from 22% to 26% (+4 points), HSTS misconfigured from 49% to 53% (+4 points), SPF absent from 40% to 44% (+4 points), no CDN/WAF from 34% to 36% (+2 points). Only exposed databases improved slightly, from 15% to 14% — a one-point move that stays within statistical noise rather than a real improvement.

What we know — and what we don't

The Barometer isn't a fixed panel. The 90-day rolling window drops old scans and admits new ones on every request — today's 190 targets aren't the same 226 from August 29 re-tested, but a partially-renewed set. A rising indicator could reflect real backsliding among targets already in the window, or simply a different mix of targets entering it — for instance, new free-scan users with less mature baseline hygiene than regulars. The current data can't distinguish between the two.

The sample size itself moved: 226 targets on August 29, 200 on October 21, 190 on October 24 — a real decline, not an artifact. A smaller sample makes every percentage more sensitive to noise, especially since the lowest indicator (exposed database) already rests on only 121 targets.

This isn't a representative sample of cybersecurity across francophone Africa broadly — it's the panel of targets actually scanned on our platform, mostly via the free scan and our demos, with the selection bias that implies.

Methodology

Indicators computed live by SunuBarometer's public API, from the real results of scans run through the SunuCyberSecurity platform — no external sample, no survey — over a 90-day rolling window recomputed on every request, with no caching. A weekly snapshot has been archived automatically since August 29, 2026, enabling the trend analysis shown here. See sunucybersecurity.com/en/africa-cybersecurity-barometer for the full methodology. "Current state" section: data as of October 24, 2026. "Trend" section: archived snapshots from August 29 and October 21, 2026.

Related reading

Put this into practice

A free scan, in a few minutes, no credit card.