• Two thirds of businesses expect to increase cyber security resources towards tackling attack management, and building greater resilience and recovery.
  • RSM International survey findings warn of “maturity gap” holding businesses in the region back through lack of targeted investment and expertise.
  • Technology experts urge organisations to ensure cyber security controls keep pace with adoption.

Middle market businesses in Latin America are increasing their cybersecurity resources but are lacking technical maturity to maximise their investments, an RSM survey has found.

Drawing on more than 265 responses from business leaders in 18 Latin American countries, the accounting network’s Cybersecurity Survey 2026 found the region is shifting decisively from cyber security awareness towards action.

This is underlined by 69% of businesses surveyed expecting an increase in cybersecurity investment this year.

The survey also highlighted the “maturity gap” between how much organisations invest in cyber security and how well they govern that investment.

RSM found this gap is being driven by factors, which include that only 16% of cybersecurity budgets are owned by a Chief Information Security Officer (CISO. Just 30% of cyber strategies being owned by a dedicated CISO. Half of businesses in the region have two or fewer staff dedicated to data security and privacy.

Top cyber security initiatives that businesses in the region are focusing on include attack surface management, reported by 39% of respondents, resilience and recovery (38%), and securing the cloud (38%).

Luis Gorgona, IT Consulting Partner at RSM in Costa Rica1, said:

“RSM’s survey highlights the cyber agenda is maturing in Latin America, with cybersecurity a more established and recurring part of businesses’ IT investment through greater exposure across cloud and artificial intelligence.

“At the same time, we see that governance remains a key challenge for businesses. It underlines a fundamental point; increased cyber spending does not immediately translate into stronger protection.

“This is due in part to cyber priorities being shaped by operational demand, technology procurement, or compliance pressure, rather than a clear view of risk. This can lead to fragmented spending, duplicated tools, underinvestment in critical controls, or capability gaps that remain unresolved.”

Eileen Turkot, Market Leader in Latin America for RSM International, said:

“Middle market businesses across Latin America are showing real commitment to cybersecurity, and rising budgets prove it.

“The opportunity now is to spend smarter, not simply more. Organisations that connect investment to clear risk ownership, stronger accountability, and disciplined governance will build the resilience that turns security into lasting business confidence and a genuine competitive edge."

 

1.RSM Costa Rica Audit Tax and Consulting Services Sociedad Anonima