It might be including the cost of the entire cybersecurity business sector? Salaries of security engineers, security vendors, etc. Not just fallout from hacks.

edit: cybersecurity ventures seems to be the real source for the 10.5T number: https://cybersecurityventures.com/cybercrime-damage-costs-10...

Apparently their methodology is just assume $3T cybercrime cost in 2015, then compound it by 15% annual.