Cybersecurity in Mexico: The challenge ahead of 2026

Cyberpeace Tech
Jan 6
3 min read

Mexico is at a turning point in strengthening its cybersecurity, after the federal government announced progress in developing a National Cybersecurity Plan and a possible General Law on the subject.

Both initiatives are being promoted by the Agency for Digital Transformation and Telecommunications (ATDT) and seek to respond to the rapid growth of digital threats affecting both the public and private sectors.

Although the announcement has been well received, various specialists agree that it is a belated reaction to a problem that has been growing for years. The digitization of services, procedures, and business operations has advanced faster than defense capabilities, leaving significant gaps in the protection of critical information and systems.

The current cybersecurity challenge in Mexico

According to industry analysis, the country is going through one of its most complex periods in terms of digital attacks. Threats such as ransomware, phishing, and credential theft remain the most frequent and have a significant economic impact, with losses that can reach millions of pesos per incident.

The problem is intensified by the high level of technology adoption: most large companies and a considerable proportion of small and medium-sized companies use the internet constantly in their daily operations.

This scenario increases the attack surface and requires more robust and coordinated security measures.

Experts warn that the increase in attacks targeting the public sector could accelerate in the coming months, driven mainly by internal weaknesses and a lack of robust technical controls.

Institutional advances: prevention, not just reaction

One of the main objectives of the plan presented by the ATDT is to shift from a traditional reactive approach to a preventive one. To this end, it envisages the creation of bodies such as a National Cybersecurity Operations Center and a national CSIRT to respond to incidents, issue early warnings, and assess risks on an ongoing basis.

This approach represents a significant advance for cybersecurity in Mexico, but there are still doubts about its effectiveness if it is not accompanied by a clear structure of responsibilities, defined coordination processes, and monitoring mechanisms.

Regulatory gaps and non-mandatory standards

Among the main criticisms of the bill is the lack of precision in the assignment of roles. The framework proposes the participation of government agencies, coordinated bodies, private initiative, and academia, but without establishing sanctions or clear accountability schemes.

Furthermore, although the use of international security standards as a reference is promoted, these would not be mandatory.

This could lead many organizations to maintain minimum levels of protection, which are insufficient in the face of increasingly sophisticated threats.

International experiences, such as that of Chile, show that a combination of mandatory technical standards, independent audits, and clear sanctions can lead to sustained improvements in digital security posture. This model can serve as a reference for strengthening Mexico's strategy.

Budget: progress that still falls short

The budget allocated to the ATDT for 2026 represents a significant increase over previous years. However, these are not resources exclusively for cybersecurity, which limits the real scope of the planned actions given the magnitude of the digital risk.

In other countries, cybersecurity spending is focused specifically on protecting critical infrastructure, early threat detection, training specialized talent, and collaborating with the private sector. These elements remain key areas of opportunity for Mexico.

The legal and technical capabilities challenge

Although there are criminal offenses related to cybercrime, the effective prosecution of complex attacks remains low. The lack of specialized training in judicial, forensic, and investigative bodies limits the state's ability to respond to incidents involving international networks or critical infrastructure.

The real challenge of cybersecurity in Mexico is not only to have new laws or plans, but to develop technical, operational, and human capabilities that allow these strategies to be executed effectively and measurably.

At Cyberpeace, we believe that timely information and constant preparation are key to addressing today's digital risks. Understanding the cybersecurity landscape allows for better decision-making and strengthens the protection of data, systems, and infrastructure. If you want to continue learning about cybersecurity, digital threats, and best practices, we invite you to follow our social media accounts and stay one step ahead.