The landscape, without alarmism

The attacks that affect mid-sized Mexican companies concentrate in three categories: fraud via corporate email impersonation, ransomware that enters through stolen credentials or exposed remote access, and data leaks from misconfigurations in cloud services.

None of the three requires an advanced attacker. All are largely prevented with known, moderately priced controls.

The right order of priorities

With a limited budget and no dedicated team, this is the order that removes the most risk per peso invested:

  1. Multi-factor authentication on everything. Email, VPN, cloud access, and administrative systems. It's the single measure that stops the most real attacks, and it's usually included in licenses the company already pays for.
  2. Tested, isolated backups. A backup that was never restored isn't a backup. It must be out of reach of the same credentials that administer the systems.
  3. Access management. Review who has access to what, remove accounts of people who left, and eliminate admin permissions nobody uses. It's free and almost never done.
  4. Up-to-date patching. Operating systems, servers, and internet-facing applications.
  5. Phishing training. Short, periodic, and with simulations. Email is still the dominant entry point.

Before buying toolsMost mid-sized companies that suffer an incident had a security budget; they had it invested in products with no one to operate them. A tool with no owner is an expense, not a control.

The fraud that costs the most money

Business email compromise — an attacker posing as an executive or a supplier to divert a transfer — causes larger losses than ransomware at many companies, and requires no malware.

The defense is as procedural as it is technical: verification through a second channel for any change to a supplier's bank details, dual authorization for transfers above a threshold, and correct configuration of email authentication records (SPF, DKIM, and DMARC) so no one can send messages impersonating your domain.

What your customers will already require

If you sell to enterprises, banks, or healthcare companies, security stopped being an internal topic and became part of the buying process. Expect questionnaires about data handling, access policies, an incident-response plan, and — increasingly — formal certifications.

Having those answers documented before the first meeting shortens the sales cycle tangibly. Improvising them lengthens it by weeks.

Compliance and personal data

Mexican data-protection rules require reasonable security measures and notification of breaches that significantly affect the rights of data subjects. Beyond the fine, the real cost of a mishandled incident is reputational and contractual: corporate customers usually have clauses triggered by a leak.

A reasonable 90-day plan

  • Days 1–30: inventory of systems and access, MFA activation, review of privileged accounts.
  • Days 31–60: isolated backups and a restore test; SPF, DKIM, and DMARC configuration; patching of internet-facing assets.
  • Days 61–90: a written incident-response plan, phishing training, and defining who is responsible for security, even part-time.

It's not a complete security strategy. It's what prevents most of the incidents that actually happen.