Every year the World Economic Forum (WEF) publishes its Global Cybersecurity Outlook with Accenture, a survey of how companies and governments rate their own ability to withstand attacks. The 2025 edition carries an uncomfortable message for Latin America, and therefore for anyone running operations or holding assets in Panama.
Latin America's confidence gap in the WEF data
The sharpest regional finding is about critical infrastructure. The table compares how respondents in Latin America and in Europe and North America rate their country's readiness.
| Indicator | Latin America | Europe and North America |
|---|---|---|
| Not confident their country can respond to a major cyberattack on critical infrastructure | 42% | 15% |
| Very confident in their country's preparedness | 4% | not reported |
The same report looks at who is least prepared across its whole survey, and the answer is the state. In the public sector, 38% of respondents report insufficient cyber resilience, against 10% of medium and large private companies.
The talent shortage points the same way. Nearly half of public sector organizations, 49%, say they lack the staff they need, a figure that grew by 33% compared with 2024. In practice, the institutions that run essential services are the ones that feel least ready to defend them.
What the OAS and IDB report adds
The 2025 cybersecurity report of the Organization of American States (Organización de los Estados Americanos, OEA) and the Inter-American Development Bank (Banco Interamericano de Desarrollo, BID) takes a different angle. Prepared with the Global Cyber Security Capacity Centre at the University of Oxford, it assesses the maturity of 30 countries in Latin America and the Caribbean. Its main conclusions are three:
- the region is strengthening its capabilities, but structural gaps persist in funding, talent development and coordination across sectors;
- rapid adoption of artificial intelligence is reshaping the threat landscape, amplifying existing risks and creating new vulnerabilities, so governance frameworks and rules need updating;
- political leadership and institutional capacity make the difference, and countries that build cybersecurity into their development agenda and work through public-private partnerships are better placed to close the gap.
Measured with different methods, the two reports reach the same diagnosis. The problem is not only technology. It is governance, talent and coordination.
How the Oxford maturity model scores countries
The OAS and IDB assessment uses Oxford's Cybersecurity Capacity Maturity Model (CMM). It does not ask only whether a law exists, but how mature and how well applied each capability is. The model looks at five dimensions:
- cybersecurity policy and strategy;
- culture and society, meaning awareness and digital trust;
- education, training and skills, which is where talent is measured;
- legal and regulatory frameworks;
- technology and standards.
Since the 2020 assessment, the region has improved in all five dimensions and the gap between countries has narrowed. Software quality, critical infrastructure protection and the cybersecurity market remain less developed, and investment in research and innovation is limited. The report also warns that AI raises the sophistication of attacks and poses unprecedented challenges for national security and economic stability. The same pressure shows up in telecom networks, as Ericsson's analysis of 5G threats describes.
Why the findings matter for business in Panama
Panama is a financial, logistics and connectivity center for the region. The Canal, international banking, the ports and the submarine cables are critical infrastructure, which also makes them attractive targets. For a foreign investor weighing Panama as a place to invest, three points follow from the reports.
The first is legal. Law 81 of 2019 on personal data protection (Ley 81 de 2019) imposes security and breach notification duties, so an incident can trigger legal liability and not just an IT problem. Its obligations often reach employees and contractors through the kind of clauses covered in the guide to confidentiality agreements in Panama.
The second is policy. Panama has a National Cybersecurity Strategy (Estrategia Nacional de Ciberseguridad) and authorities pushing a digital agenda, and its challenge, like the rest of the region's, is closing the distance between the rules on paper and the real capacity to respond.
The third is the supply chain. The WEF report stresses that risk often enters through suppliers, and for a services hub like Panama, due diligence on third parties is no longer optional.
What organizations can do now
None of this requires waiting for the state to close its gaps. Cybersecurity belongs in the same regulatory compliance program that handles a company's other legal risks, and the steps are concrete:
- Treat cybersecurity as a matter of corporate governance and compliance, not only of the IT department.
- Document a data protection program that meets Law 81 of 2019, including its security and breach notification duties.
- Review supplier contracts for security, liability and notification clauses.
- Prepare for the incident before it happens, with a response plan, named owners and a communication protocol.
The WEF's message is practical rather than alarmist: resilience is built before the attack. For Panama, closing the gap is also a way to stand out as a safe place to invest and operate.