Without a cybersecurity legal framework, Brazil remains Latin America's easiest target

I've worked with boards of directors long enough to know that security budget doesn't come from a CTO's good will. It comes from risk that turns into a number on the balance sheet, or from a law that turns into a fine. Brazil has neither one nor the other at sufficient scale, and that explains why the country accounts for more than half of Latin America's cyberattacks, according to Kaspersky's 2025/2026 Threat Landscape report, presented on November 10, 2026, in Praia do Forte, in the Brazilian state of Bahia. Whoever builds systems feels this vacuum every day, even without knowing how to name it.

The vacuum that becomes technical debt, not just legal debt

Brazil has had a National Cybersecurity Policy since December 2023, but it was created by decree, not by law. The original text from the Gabinete de Segurança Institucional (Brazil's presidential institutional security office) called for a national agency; what came out was a committee, without the same oversight and penalty powers. For engineering, the difference is concrete: without a law defining sector-specific obligations, incident notification deadlines, and penalties for technical negligence, the board has no external reason to prioritize the security budget over any other line on the roadmap.

The government itself admits the gap. In May 2026, GSI's cybersecurity director was direct:

We still don't have a General Security Law in Brazil that establishes the sectors, each one's obligations, the cooperation models.

Luiz Fernando Moraes da Silva, cybersecurity director at GSI

The numbers Kaspersky brought from Praia do Forte

The report covers the period from September 2025 to September 2026 and puts Brazil at the top of nearly every attack category in the region, including per capita, which rules out the argument that the country only leads because it has more people connected.

The preferred target isn't the financial sector, it's the State itself: government agencies accounted for 26.5% of attacks, double the second-place sector (retail and wholesale). Add to that the theft of US$6.3 billion from Binance by hackers linked to North Korea, the attack that shut down supermarket freezers in France, and, in Brazil, the attack on the Mercado Bitcoin exchange and the glitches suspected of being a cyberattack at the Port of Santos (Brazil's largest port): this isn't a hypothetical scenario, it's last week.

The bill that has been stalled since September

Bill PL 4.752/2025, which establishes the Cybersecurity Legal Framework and creates a national authority for the sector, was approved by the Senate's Constitution and Justice Committee in December 2025. Since then, it has been stalled in the Science and Technology Committee, with no vote scheduled. The last movement was on September 4, 2026, when amendments were sent to the rapporteur, Senator Jorge Seif (PL-SC). Fabio Assolini, Kaspersky's lead security researcher for the Americas, sums up the pattern:

Politicians have done little to change that. We only see a reaction when one of the politicians or someone prominent becomes a victim of an attack like this.

Fabio Assolini, Kaspersky's lead security researcher for the Americas

The lesson from Chile, read through the eyes of a systems architect

Chile operated at a level of protection similar to the rest of the region until 2018, when the Lazarus group, linked to North Korea, stole US$10 million from Banco de Chile. The episode became a national embarrassment, and only after that did Chilean senators and the private sector pass strict cybersecurity laws, with sector-specific obligations and an active agency. Chile is now cited by Kaspersky itself as a regional model. Assolini sums up the Brazilian pattern in one sentence: "Brazil is slow to pass these things, and usually it only moves after the milk has been spilled."

The counterargument I take seriously

It would be naive to say that a law solves security. A law doesn't write secure code, doesn't fix an open bucket configuration, doesn't replace threat modeling. Brazil already has the LGPD (Brazil's data protection law), and a large part of the market treated compliance as a checklist, not as a real architectural change. A Cybersecurity Legal Framework passed in a hurry, without technical clarity in sector-specific obligations, runs the same risk: becoming paper a CISO shows at an audit without changing a single line of infrastructure.

This risk is real, but it doesn't cancel out the opposite problem. Without a legal obligation, the decision to invest in security remains optional for the board, and optional loses to delivery deadlines every time. The committee created by the 2023 decree doesn't have the same power as a body with legally defined penalties. The question isn't law versus good engineering; it's whether good engineering will keep depending solely on the luck of the board understanding the risk before the incident.

What I would ask the CTO before the bill leaves the drawing board

While the Senate doesn't vote, whoever builds systems in Brazil doesn't need to wait for the law to settle the questions it should mandate:

• What is the actual incident notification deadline the company practices today, and would it withstand a public audit?
• Does the contract with the cloud provider or third-party software vendor include a liability clause for security failures, or does the risk stay solely on the client's side?
• Is the security budget tied to the estimated cost of an incident (ransomware, leak, downtime), or is it a generic percentage of the IT budget?
• Is there an incident response plan tested this year, or does it only exist on paper since the last certification?

Brazil won't stop being Latin America's easiest target just because a bill moved through committee. But as long as it stays in the drawer, each company's security bar remains the internal bar set by its own engineering team, and that's not much against 583 million phishing attempts a year knocking at the door. Fonte: Exame