Cybersecurity threats to Latin American SMEs

Discussions regarding regional cybersecurity resilience have highlighted the growing vulnerability of small and medium-sized enterprises (SMEs), particularly in Latin America. During the LATAM CISO Summit, officials emphasized the necessity of regional cooperation to address digital threats that transcend borders, focusing on areas such as artificial intelligence, cloud security, and critical infrastructure protection. Subsequent data from a Kaspersky study confirms these vulnerabilities, reporting that 86% of SMEs with fewer than 500 employees experienced at least one security incident in the past year. In Latin America, these attacks have resulted in significant economic losses, business process disruptions, and service suspensions. Specifically, 31% of affected SMBs reported direct economic losses, 27% faced disruptions to internal business processes, and 25% had to suspend customer-facing services. In Brazil, research from the Markets Innovation & Technology Institute indicates that digital maturity is at an intermediate stage, with a 58% adherence rate to cybersecurity best practices. Experts from ARX CYBER note that many organizations struggle to translate technical information into strategic decisions, often focusing on tools rather than a consolidated view of processes and risks. The landscape is further complicated by emerging technologies. While the primary drivers of incidents remain phishing, ransomware, and weak credentials, executives at Sensedia warn that the adoption of autonomous AI agents introduces “exponential security risks compared to traditional APIs,” necessitating stricter governance and control over AI implementation. Recent findings extend these concerns to the retail sector, where approximately 36% of surveyed organizations reported financial losses following their most severe incident in the last year. Beyond direct costs, 30% of these companies reported the theft of intellectual property or R&D data, and 30% suffered reputational damage. Key vulnerabilities include a lack of centralized IT control (40%) and the use of outdated software or hardware (31%).