By Anhtony Chavarría
A few years ago, breaching a company’s infrastructure required genuine technical expertise: understanding networks, reading code, knowing vulnerabilities, and knowing how to chain them together. That barrier no longer exists. Today, someone without technical training can ask an artificial intelligence model to explain how to exploit an exposed service, write malware, draft a phishing email in flawless Spanish, and explain what to do after gaining access. The barrier to entry for cybercrime has fallen, and the figures for 2025 and 2026 confirm it.
What the Numbers Tell Us
313 million
Cyberattack attempts in Costa Rica during the first half of 2026.
Costa Rica faced 225.7 million attempted cyberattacks in 2025, according to FortiGuard Labs telemetry cited in its 2026 Threat Landscape Report. In the first half of 2026 alone, the figure had already reached 313 million, indicating that this year’s pace is substantially higher than last year’s.
86%
Of Latin American small and medium-sized enterprises (SMEs) experienced at least one cybersecurity incident in the past year.
The same report records 7,831 confirmed ransomware victims worldwide, a 389% year-over-year increase, and a figure we consider even more relevant for infrastructure administrators: the time between the disclosure of a critical vulnerability and the start of its exploitation fell from 4.7 days to between 24 and 48 hours. There is no longer room to ‘patch it next week.’
US$4,65 M
Estimated average cost of a data breach in Latin America.
In Latin America, IBM’s Cost of a Data Breach 2026 report estimates the average cost of a data breach at US$4.65 million and states that approximately 19% of the malicious attacks analyzed were generated using artificial intelligence. Kaspersky, meanwhile, reports that 86% of the region’s small and medium-sized businesses experienced at least one cybersecurity incident in the past year, with phishing as the most common attack vector (24%).
The region also lags behind on the fundamentals: according to IBM, only 31% of Latin American organizations comprehensively encrypted their sensitive data.
Globally, Verizon’s 2026 Data Breach Investigations Report found that the human element was involved in 62% of breaches, that phishing accounted for 44% of AI-assisted initial access, and that AI-generated text in malicious emails had doubled compared with previous years. The same report describes another growing risk within companies: 45% of employees already use AI tools on corporate devices, and 6% of them do so through personal accounts, outside any organizational oversight.
The finding that best captures this shift comes from an analysis Anthropic published in June 2026 on the malicious use of its own models: 832 accounts blocked between March 2025 and March 2026, 13,873 actions mapped to the MITRE ATT&CK framework, and 482 distinct techniques. The proportion of medium- or high-risk actors rose from 33% to 56% in one year, and the researchers’ conclusion is straightforward: AI can now carry out post-compromise activities (lateral movement, credential dumping, and web shell deployment) on behalf of less sophisticated attackers. One attacker with limited technical skills but effective AI and tool ‘scaffolding’ received the study’s highest risk score.
How our way of working has changed
At Arkkosoft, we develop and operate software for clients who entrust their data and processes to our infrastructure. That responsibility led us to rethink security not as a project, but as an ongoing practice of our Security Department. These are the fundamental changes we have made.
We assume attackers are fast and persistent. If a critical vulnerability can be exploited within 48 hours, our vulnerability management must move at that speed. We shifted from periodic scans to continuous vulnerability assessment across our entire cloud infrastructure, with remediation organized in waves and prioritized by severity and actual exposure, rather than by the number of findings.
We limit the blast radius. We segment our cloud accounts by client and project so that one compromised account does not provide access to everything. An independent security account centralizes telemetry, dashboards, and alerts, while infrastructure is defined as code: every change is version-controlled, reviewed, and auditable, and configurations do not depend on any one person’s memory.
We centralize security visibility. We operate a security information and event management (SIEM) platform that correlates events across servers, applications, identity systems, and the cloud. An AI-assisted attacker moves quickly, but leaves traces; our job is to detect them before they become consequential.
We treat identity as the new perimeter. According to Fortinet, most cloud incidents originate from stolen or exposed credentials. That is why we enforce multifactor authentication, single sign-on through a centralized identity provider, the principle of least privilege, and periodic access reviews across all critical platforms: repositories, project management, cloud services, and collaboration suites. We also review and restrict third-party applications requesting access to corporate data through OAuth, an increasingly exploited channel that many companies do not even monitor.
We train employees through realistic attacks. If the human element is involved in 62% of breaches, annual training is not enough. We conduct regular phishing simulations using scenarios that reflect what AI makes possible today: error-free emails, credible context, and carefully crafted urgency. We measure who reports suspicious messages and who clicks, then use those findings to improve, without punishment.
We govern the use of AI within the company. The risk does not come only from external attackers. We have defined a catalog of approved technologies, criteria for evaluating AI tools before adoption, and clear rules about what information may or may not be shared with an external model. We also use AI to our advantage: it assists us with log analysis, infrastructure-as-code generation, and incident investigation, always with a person responsible for reviewing and making decisions.
We test our own defenses. We conduct penetration tests on our applications, respond to incidents through a documented process, and turn every lesson learned into a new control. Reference frameworks (ISO 27001, NIST CSF, CIS, and PCI DSS in environments where it is required) provide a roadmap, but the real test is whether a control works when someone tries to get past it.
What this means for our clients
AI has not changed the principles of security: visibility, identity, segmentation, patching, and well-prepared people. What has changed is the cost of making mistakes and the time available to correct them. A company that still assumes ‘no one will notice us’ is betting against 313 million attempted attacks in six months.
At Arkkosoft, we have decided that security must be part of how we build and operate software, not an add-on. It is a decision we revisit every day, because our adversaries are learning every day too.
