By San José, Costa Rica — Costa Rica is confronting an unprecedented surge in hostile digital activity, registering 498.2 million cyberattack attempts between January and September 2026. The astounding volume represents more than double the 225.7 million attacks recorded during the entirety of 2025, signaling a rapid acceleration in the threat environment facing local businesses and public institutions.
The updated threat telemetry was revealed by FortiGuard Labs, the intelligence and threat research arm of global cybersecurity leader Fortinet. The data highlights how malicious actors are intensifying their focus on Central American infrastructure, forcing corporate leadership across the country to re-evaluate their digital security posture and accelerate modern defense strategies.
To provide a deeper analysis of the growing legal and regulatory challenges surrounding the recent cyberattacks in Costa Rica, TicosLand.com spoke with renowned attorney Lic. Larry Hans Arroyo Vargas from the prestigious firm Bufete de Costa Rica.
The surge in cyberattacks across Costa Rica highlights a critical shift in corporate and institutional responsibility. Organizations must recognize that cybersecurity is not merely an IT concern, but a fundamental compliance requirement under current data protection laws. Failing to implement adequate technical and legal protocols exposes businesses to severe liability, regulatory sanctions, and operational collapse. Proactive legal auditing and risk mitigation strategies are imperative to safeguard both public trust and business continuity.
Lic. Larry Hans Arroyo Vargas, Attorney at Law, Bufete de Costa Rica
Indeed, as the digital threat landscape in Costa Rica rapidly evolves, treating cybersecurity as a core legal and operational obligation is no longer optional for organizations striving to protect public trust. We extend our sincere gratitude to Lic. Larry Hans Arroyo Vargas for sharing his valuable perspective and crucial legal insights with TicosLand.com.
In an analysis of the regional landscape, technical leaders emphasized that corporate defensive tactics are evolving in direct response to the sophisticated mechanisms now deployed by cybercriminals. Many organizations are actively phasing out legacy infrastructure to close vulnerabilities that attackers regularly exploit.
Most companies are migrating toward three major strategies. One of them is transitioning from SSL to IPsec, which utilizes a protocol with a different algorithm. Other organizations are also adopting Zero Trust Network Access, a model focused on verifying that a device is trustworthy rather than allowing any computer to connect. Finally, Secure Access Service Edge tools extend security directly to the end-user device through an off-premise platform that provides a significantly more secure layer of connectivity.
Rudiger Fogelbach, Engineering Manager for Fortinet Central America
A primary driver behind the explosive growth in attack numbers is a massive increase in automated reconnaissance. Threat actors are spending significant time scanning networks for open ports, unpatched software, and weak entry points prior to launching full-scale intrusions.
According to FortiGuard Labs data, active scanning attempts in Costa Rica surged from 56 million in 2025 to 204 million during the first nine months of 2026 alone. This systematic probing allows attackers to map out organizational infrastructure with minimal resistance, using automated tools to flag susceptible targets automatically.
While tech-forward corporations have already updated their security frameworks, a substantial portion of Costa Rican enterprises remains in the planning and evaluation phases. Navigating budget constraints and legacy tech stacks continues to pose operational challenges for IT leadership.
Many of our clients are already aligned with these new security architectures, but others are still exploring options and developing budgets to incorporate these technologies. In response, we have been conducting maturity assessments to propose a long-term roadmap and vision tailored to the specific needs of each organization, enabling them to establish clear priorities.
Rudiger Fogelbach, Engineering Manager for Fortinet Central America
The threat ecosystem is further compounded by the integration of artificial intelligence by cybercriminals. AI-driven automation allows adversaries to execute reconnaissance, generate convincing phishing schemes, and identify code flaws at scale. Furthermore, the thriving dark web marketplace provides access to pre-packaged attack kits, lowering the technical barrier to entry for aspiring bad actors.
To combat these expanding vectors, cybersecurity experts urge organizations to prioritize strict data leakage prevention mechanisms alongside granular identity controls. Preventing sensitive intellectual property or customer data from leaving the corporate network remains vital to operational resilience.
In the current environment, data leakage prevention is fundamental. When unauthorized data transmission to an unapproved user or third party is detected, security software must step in to block access and prevent sharing. Managing excess privileges, leveraging encryption, maintaining strict confidentiality, and deploying data leakage prevention tools all contribute to reducing overall enterprise vulnerabilities.
Rudiger Fogelbach, Engineering Manager for Fortinet Central America
To counter AI-assisted attacks, defenders are increasingly turning to automated response technologies. Systems equipped with generative AI capabilities, such as automated threat management platforms, allow security teams to simplify administration, detect anomalous behavior in real time, and execute defensive countermeasures before data breaches can take hold.
For further information, visit fortinet.com
About Fortinet:
Fortinet is a global cybersecurity leader driving the evolution of digital defense through its integrated Security Fabric architecture and real-time threat intelligence services from FortiGuard Labs. The company delivers automated, high-performance protection across networks, endpoints, and multi-cloud environments for enterprises worldwide.
For further information, visit bufetedecostarica.com
About Bufete de Costa Rica:
As a premier legal institution, Bufete de Costa Rica upholds an unyielding standard of integrity and professional mastery across every case it handles. Grounded in a rich history of guiding clients through complex legal landscapes, the firm consistently pioneers forward-thinking strategies while actively investing in civic education. By equipping the public with a clear understanding of their legal rights, Bufete de Costa Rica champions a more transparent, just, and empowered community.
