Enterprise cybersecurity: a complete guide for CIOs and CISOs

Enterprise cybersecurity has stopped being a technical chapter of the IT budget and become a risk variable discussed at board level. The average global cost of a data breach reached US$4.99 million in 2026, 12% higher than the previous year and the highest level recorded since IBM began publishing its annual report. Companies in Latin America also face an attack profile of their own, with well-documented vectors and motivations worth knowing before designing any defence programme.

This guide sets out what a CIO or a CISO needs in order to structure that programme: what enterprise cybersecurity covers, what the regional threat landscape looks like with verifiable data, which reference frameworks help organise the work, which layers make up a modern architecture, and how to resolve operations when specialist talent is scarce.

What is enterprise cybersecurity?

Enterprise cybersecurity is the set of policies, technical controls and operating capabilities with which an organisation protects its data, applications, identities and network infrastructure against internal and external threats. What sets it apart from IT security in the traditional sense is not the tooling but the scope and who decides.

Scope is no longer limited to the corporate network perimeter. Today it includes public and private cloud workloads, internet-facing applications, employee and third-party identities, devices connecting from anywhere, technology supply chains and, in industries such as manufacturing and energy, operational technology. Each of those fronts has its own exposure surface and its own set of controls.

The change in who decides is equally relevant. Version 2.0 of the NIST cybersecurity framework incorporated a specific govern function precisely because, in its own words, cybersecurity is a major source of enterprise risk that senior leadership must consider alongside finance and reputation. That makes the CISO a counterpart to the business rather than merely the owner of a set of platforms.

The threat landscape in Latin America

Verizon's 2026 data breach investigations report publishes a regional cut for Latin America and the Caribbean covering 12,371 analysed incidents, of which 8,426 confirmed data disclosure. Three patterns account for 87% of the region's breaches: system intrusion, social engineering and basic web application attacks.

The regional attacker profile is consistent: 88% of actors are external and 98% act for financial motives. The human element is present in 59% of cases and third parties are involved in 43%, a figure that reinforces why supply chain risk has become a management category in its own right.

Vulnerability exploitation

This is the most frequent initial access vector in the region, at 30% of cases. The reaction window is short: Fortinet observed 122 billion exploitation attempts during 2025 and, in its measurement the previous year, an average of 5.4 days between a vulnerability being disclosed and actively exploited. A monthly patching cycle is not enough for that pace, and that is why prioritisation by real exploitability is gaining ground over prioritisation by theoretical severity.

Credential abuse

This accounts for 20% of regional initial accesses. The problem is industrial in scale: Cloudflare reports that 63% of the login attempts it observes use credentials already compromised on another site, and that 94% of those attempts come from bots. The operational conclusion is that the password has stopped being a sufficient control on its own, even when it meets complexity policies.

Social engineering and phishing

Phishing explains 12% of initial accesses in the region, although its real weight is greater if the 59% of breaches with a human element is taken into account. Sophistication has grown with the availability of generative tools: IBM reports that one in four malicious breaches in 2026 was enabled by artificial intelligence, at an average cost of US$6 million, and that attacks driven by these tools grew 56% year on year.

Ransomware

This remains the threat with the greatest operational impact. It is present in 48% of all breaches analysed globally, up from 44% the previous year. The corporate response has improved: 69% of victims did not pay the ransom and the median payment fell to US$139,875. In parallel, IBM records that 39% of breached organisations suffered at least one ransomware attack, and that the most-used pressure tactics are no longer only data encryption but threats to brand reputation (41%) and exposure of employee data (35%).

Distributed denial of service

Cloudflare mitigated 47.1 million distributed denial-of-service attacks during 2025, a 121% year-on-year rise equivalent to an average of 5,376 attacks per hour. The largest recorded event reached 31.4 terabits per second and lasted 35 seconds, a reminder that mitigation has to be automatic because there is no time for a manual response. The most-attacked sector was telecommunications and service providers, which makes the resilience of the transport network part of the end customer's security problem.

Third-party risk

43% of regional breaches involve a third party, and the growth of that share is one of the most marked trends of the past year. Software vendors, integrators, support platforms and managed services form part of the organisation's attack surface even though they are not under its direct control. The NIST framework has incorporated this as a formal category of supply chain governance.

Reference frameworks for structuring the programme

A security programme is not built by choosing products but by organising capabilities. Four reference frameworks cover different needs and are complementary to one another, not alternatives.

NIST Cybersecurity Framework 2.0

Published in February 2024, it is the most widely used framework for structuring and communicating a security programme, because it describes expected outcomes without imposing technologies. Version 2.0 brought two fundamental changes: it is no longer aimed only at critical infrastructure and now applies to organisations of any sector and size, and it added the govern function as a cross-cutting axis over the other five.

Source: NIST, The NIST Cybersecurity Framework (CSF) 2.0, NIST CSWP 29, February 2024. 

ISO/IEC 27001

This is the best-known international standard for information security management systems, in its third edition since October 2022. Its differential value against the NIST framework is that it is certifiable by an accredited third party, which makes it the usual instrument when the requirement comes from a corporate customer, a tender process or an audit. It describes how to manage, not which technology to use.

CIS Critical Security Controls

These offer a prioritised list of 18 controls in version 8.1, with implementation groups according to the size and maturity of the organisation. It is the most practical framework for answering the question of where to start, because it orders controls by impact rather than by functional area. It works well as a concrete work plan underneath the conceptual structure of NIST.

MITRE ATT&CK

This is a knowledge base of adversary tactics and techniques documented from real-world observations, with matrices for enterprise, mobile and industrial control environments. It is used to validate defensive coverage: it allows you to map which attack techniques the installed platform actually detects and where blind spots remain. It is the natural reference for red team exercises and for evaluating vendor proposals.

The layers of a modern security architecture

With the framework defined, the architecture is assembled in layers. Those that follow currently concentrate most enterprise investment and respond to the vectors documented in the previous section.

Zero Trust

NIST special publication 800-207 defines Zero Trust as a set of evolving paradigms that moves defences from static network-based perimeters towards a focus on users, assets and resources. In practical terms, it means that no access request is considered trustworthy because of where it originates, and that each one is authenticated and authorised against up-to-date identity and context policies.

It is worth being precise about expectations: Gartner insists that Zero Trust is not a product but a set of principles, and projects that by 2026 only 10% of large enterprises will have a mature, measurable programme, up from under 1% today. It is a journey of several years, not an implementation. This subject has enough depth for an article of its own, so it is set out here as the guiding principle for the layers that follow.

SASE

SASE is the architectural model that unifies network connectivity with network security functions on a cloud-delivered platform. It converges SD-WAN with a secure web gateway, a cloud access security broker, data loss prevention, firewall as a service and Zero Trust network access, with centralised management. Its logic is straightforward: if applications and users have left the data centre, the inspection point has to be near them and not at a central site.

Adoption follows that logic. The global SASE market is expected to grow at a compound annual rate of 26% to reach US$28.5 billion in 2028, according to Gartner projections cited by Fortinet. A useful clarification when evaluating proposals: security service edge (known as SSE) is a subset of SASE and is usually the first step in a full deployment.

Denial-of-service protection

Mitigating distributed denial-of-service attacks works in four stages: detection (distinguishing the attack from legitimate high-volume traffic), response (discarding malicious traffic and absorbing the rest), routing (segmenting the remaining traffic into manageable chunks) and adaptation (analysing patterns to harden future defences). The criteria for evaluating a service are scalability, flexibility, reliability and, above all, the size of the network that absorbs the attack. At Liberty Networks we deliver this layer as a managed DDoS protection service over our own regional network, because absorption capacity is the factor that weighs most when an event exceeds 30 terabits per second.

Managed WAF

The web application firewall is a layer 7 defence that filters and monitors HTTP traffic between an application and the internet, operating as a reverse proxy so that requests pass through it before reaching the server. It can work with block lists, allow lists or a hybrid model. What sets the managed model apart is who maintains the rules: provider-managed rule sets protect against known attack techniques and zero-day vulnerabilities, incorporate the implementation of the OWASP core rule set and are updated regularly, without requiring a team dedicated to curating signatures.

Exposure management

Gartner describes it as an integrated, iterative approach to continuously prioritising and refining security posture. Its difference from traditional vulnerability management is decisive: vulnerability management scans and patches published vulnerabilities, whereas exposure management incorporates surfaces that cannot be patched, such as identities, configurations, software-as-a-service offerings and third-party exposure. The same firm projects that by 2026 unpatchable attack surfaces will account for more than half of the enterprise's total surface. Our exposure management offering targets that front, with continuous visibility and prioritisation by real exploitation risk.

Operations: SOC, MDR and XDR

A security operations centre is the command centre from which the company's information systems are monitored, with functions ranging from asset inventory and continuous monitoring to alert triage, containment, root cause analysis and compliance management. It requires round-the-clock coverage, because an attack can occur at any time of day.

On that basis it is worth distinguishing two acronyms that are often confused. XDR is technology: a platform that correlates telemetry from network, cloud and workstations to optimise detection, investigation and response in real time. MDR is a service: an external team takes on responsibility for detection and response, and frequently does so on top of an XDR platform. They do not compete with one another, they complement each other, and the choice depends less on budget than on the availability of specialist staff.

What to assess when building operating capability

The hardest gap to close is not technological. ISC2's 2025 workforce study found that 95% of professionals in the sector report at least one skills need and that 59% rate it as critical or significant, fifteen points more than the previous year. 33% say their organisation does not have enough staff, 29% that it cannot pay for the talent it needs and 72% that reducing the security team significantly increases the risk of suffering a breach. The most in-demand skills are artificial intelligence (41%) and cloud security (36%).

Cisco's 2025 cybersecurity readiness index, built on 8,000 business leaders across 30 territories, agrees with the diagnosis: only 4% of organisations reach the mature level of readiness and 70% remain at beginner or formative levels. 86% consider the security talent shortage a challenge and 53% have ten or more unfilled positions.

That context explains two decisions that define a CISO's agenda today. The first is automation: organisations using artificial intelligence and automation in their security operations saved US$1.93 million per breach compared with those that do not, and one in four has still not adopted those tools. The second is the operating model: building an in-house operations centre with round-the-clock coverage requires a team of several people per shift, whereas a managed service converts that fixed cost into a service with a measurable service level agreement.

Available budget follows the trend. Gartner projects that global information security spending will rise from US$213 billion in 2025 to US$240 billion in 2026, an increase of 12.5%. IDC estimates that global spending will exceed US$308 billion in 2026 and places Latin America among the fastest-growing regions, with managed security services as the fastest-advancing services segment.

Security as a business decision

The data in this guide points in a single direction. The most frequent entry vectors in the region (unpatched vulnerabilities, compromised credentials and deceiving people) are known and measurable, which means the problem is not one of diagnosis but of sustained execution. The cost of a breach concentrates in detection, escalation and lost business, not in technical remediation, and that is why every day of reduction in detection time has direct financial value: in the 2025 measurement, identifying and containing a breach took an average of 241 days.

For a board, that translates the conversation into three concrete questions. How long does the organisation take to detect an incident, how much of its attack surface does it know precisely, and who responds at three in the morning on a Sunday. All three are better answered with continuous operating capabilities than with one-off purchases. At Liberty Networks we integrate those capabilities into our managed cybersecurity portfolio, with the regional network as its foundation, because protecting applications and protecting the connectivity that sustains them are parts of the same problem.

Sources

• NIST, The NIST Cybersecurity Framework (CSF) 2.0, NIST CSWP 29, February 2024: https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.29.pdf
• NIST, Special Publication 800-207, Zero Trust Architecture: https://csrc.nist.gov/pubs/sp/800/207/final
• Verizon Business, 2026 Data Breach Investigations Report, executive summary with Latin America and Caribbean cut: https://www.verizon.com/business/resources/executivebriefs/2026-dbir-executive-summary.pdf
• IBM, Cost of a Data Breach Report 2026: https://www.ibm.com/reports/data-breach
• Cloudflare, DDoS Threat Report, fourth quarter of 2025: https://blog.cloudflare.com/ddos-threat-report-2025-q4/
• Gartner, Zero Trust Architecture: https://www.gartner.com/en/cybersecurity/topics/zero-trust-architecture
• ISC2, 2025 Cybersecurity Workforce Study: https://www.isc2.org/Insights/2025/12/ISC2-Publishes-2025-Cybersecurity-Workforce-Study
• Cisco, 2025 Cybersecurity Readiness Index: https://newsroom.cisco.com/c/dam/r/newsroom/en/us/interactive/cybersecurity-readiness-index/2025/documents/2025_Cisco_Cybersecurity_Readiness_Index.pdf
• CIS, CIS Critical Security Controls: https://www.cisecurity.org/controls/cis-controls-list
• ISO, ISO/IEC 27001, Information security management systems: https://www.iso.org/standard/27001
• MITRE, ATT&CK: https://attack.mitre.org/
• IDC, Worldwide Security Spending Guide: https://www.idc.com/resource-center/press-releases/wwsecuritysg/