Cybersecurity is no longer an exclusive concern for specialists and IT departments. With the publication of the National Cybersecurity Strategy (E-Ciber 2025), the Brazilian government demonstrates that the entire society shares responsibility for digital protection. The document, which replaces the 2020 version, is not solely directed at the State but also calls upon companies, universities, and citizens to act jointly for the nation's digital sovereignty.
“E-Ciber 2025 is a milestone because it expands the discussion beyond technical circles. It calls us to a collective responsibility, something that until now was seen as a task for the government or large corporations,” states Michele Nogueira, PhD in Computer Science from Sorbonne University and professor at the Federal University of Minas Gerais (UFMG).
This is because digital risks are growing faster than our protective capacity. The World Economic Forum, in its Global Cybersecurity Outlook 2025, report, indicates that two-thirds of companies already anticipate the impact of Artificial Intelligence (AI) on digital security. However, only 37% possess tools to assess these risks.
Among small and medium-sized enterprises (SMEs), the scenario is even more concerning: 69% lack secure mechanisms for adopting AI. The new Brazilian strategy acknowledges this vulnerability. SMEs are frequent targets and, when attacked, can compromise entire supply chains.
“If the small gears fail, the entire system can collapse. SMEs are easy targets because they generally lack specialized teams. Attacking them is the easiest entry point to compromise entire chains,” explains Michele Nogueira.
The Strategy's Pillars
E-Ciber 2025, proposed by the National Cybersecurity Committee (CNCiber), which now includes the business sector and civil society, is structured around key points:
- National governance: the strategy establishes that the CNCiber will be the coordinating body, with mechanisms for regulation, oversight, and control.
- Technological sovereignty: the goal is to stimulate the development of national solutions to reduce dependence on foreign technologies.
- Inclusion and diversity: the document directs special attention to vulnerable groups, such as children, adolescents, and neurodivergent individuals.
- Cyber maturity: it proposes certification standards to raise the security level across all sectors.
- Innovation: it encourages development and security in SMEs and startups, recognizing their importance in critical sectors.
Cybersecurity in Practice
The strategy envisions concrete measures, such as requiring cyber due diligence in merger and acquisition operations. This process allows security flaws to be detected before finalizing a deal, preventing financial losses.
“Cyber due diligence is essential. The attack on C&M Software, which exploited leaked credentials and affected 293 financial institutions, is a practical example of how critical failures can cost billions. The new strategy proposes response protocols and contingency plans to prevent similar situations,” emphasizes Michele Nogueira.
Education is also a pillar of E-Ciber 2025. The document advocates for training teachers and administrators to disseminate security concepts from basic education onwards. Another point is the protection of vulnerable groups. Alarming data shows that more than 60% of internet crime reports involve child abuse. The strategy emphasizes that this protection must be at the core of digital policies.
“E-Ciber invites us to overcome the ‘minority status of cybersecurity,’ adopting a critical and responsible stance. The strategy's effectiveness, however, will depend on collective engagement. No guideline stands alone. Cybersecurity must be lived in practice, in the daily life of every citizen,” concludes the computer scientist.
