Operational and cybersecurity maturity in Brazil

Brazilian companies are demonstrating low levels of maturity across different operational and technical sectors.

In terms of general business management, a study titled ‘Maturidade da Gestão Empresarial Brasileira 2026’ indicates that only 4.1% of medium-sized companies have reached optimized management levels. The average management maturity score declined from 2.64 in 2024 to 2.24 in 2026, with nearly 60% of surveyed businesses remaining in the two lowest maturity levels. Small and medium business owners often face difficulties balancing product development with administrative and financial tasks.

This lack of advancement extends to digital transformation within micro and small enterprises (MPEs). A study by Fundação Getúlio Vargas (FGV) and the Agência Brasileira de Desenvolvimento Industrial (ABDI) found that 66% of surveyed MPEs are at initial levels of digital maturity, with an average score of 40.77 out of 100. Despite MPEs representing over 90% of Brazilian businesses and contributing roughly 30% of the GDP, the adoption of technologies like cloud computing remains limited. Key barriers to digital progress include insufficient investment, a lack of technical knowledge, and a shortage of qualified professionals or suppliers.

Parallel challenges exist in cybersecurity, where only 5% of Brazilian companies have reached a mature level of readiness. Even publicly traded companies on the B3 exchange show limited maturity, averaging a score of 4.9 out of 10. This lack of maturity is attributed to companies prioritizing tool purchases over comprehensive risk diagnosis. Additionally, legal uncertainty and a lack of specific regulatory guidance for emerging security models create friction between technical and legal departments.