From Regulation to Strategy: Why Chile Needs a Strategic Approach to Cybersecurity

Chile is in the process of consolidating its cybersecurity institutions, but the global landscape demands more than mere regulatory compliance. In light of the “militarization” of cyberspace and the pre-positioning of powers in critical networks, the country must transition from incident management to a strategic approach to its digital security.

Over the past decade, Chile has made significant progress in establishing an institutional and regulatory framework to address the risks associated with cyberspace. This process reflects a paradigm shift in understanding the issue, as cybersecurity is not only seen as a technical matter related to the protection of computer networks but also as an area directly linked to national security, state resilience, and the protection of critical infrastructures.

Among the most relevant advancements is the Framework Law on Cybersecurity and Critical Information Infrastructure of 2024[1], the creation of the National Cybersecurity System, and the National Cybersecurity Agency (ANCI), which serves as the governing body responsible for coordinating prevention, management, and response to incidents affecting essential services and critical operators. This legal framework is aligned with the second version of the National Cybersecurity Policy (2023–2028)[2], which aims to establish a resilient infrastructure, protect individuals’ rights on the internet, and promote a culture of cybersecurity. Concurrently, the defense sector is consolidating its own strategic architecture, highlighting that the National Cyber Defense Policy recognizes cyberspace as a relevant operational domain for national security.

The implementation of this institutional framework has begun to yield concrete results. Internationally, Chile has significantly improved its positioning in various cybersecurity indicators. In the National Cybersecurity Index, developed by the E-Governance Academy Foundation of Estonia[3], the country advanced from 53rd place in 2023 to 25th in 2026, achieving first place in Latin America. Similarly, in the Global Cybersecurity Index by the ITU[4], Chile currently ranks among the countries in a stage of “consolidation,” positioning itself among the top in the Latin American region. Regionally, the 2025 cybersecurity report from the IDB and the OAS[5] places Chile in first place among 30 countries in Latin America and the Caribbean, achieving the highest score in the study and obtaining outstanding results in more than half of the evaluated indicators. Domestically, the National Cybersecurity Agency, in its management report from last year[6], reported on the strengthening of incident management, the increase in critical operators under supervision, and the consolidation of protection standards in state networks.

However, these advancements occur in an international context where cyberspace has become a central arena for strategic competition among states, challenging traditional notions of sovereignty and security. An example of this is the Gridtide operation, analyzed by Google and Mandiant[7], which identified a cyber espionage campaign targeting government entities and vital sectors of economies across multiple regions. Such operations, characterized by their persistence and ability to maintain prolonged access to sensitive systems, demonstrate how state actors seek to position themselves within critical networks, reinforcing the need for countries like Chile to strengthen their early detection capabilities and protection of essential infrastructures.

In this context, these dynamics translate into concrete challenges for countries like Chile. A first challenge arises from the increasing use of cyber operations as part of the means employed in current conflicts. Attacks attributed to major powers against critical digital systems illustrate how cyber dominance is increasingly integrated into military and intelligence operations planning. This has direct implications for states like Chile. Although the country does not participate in these disputes, global digital interdependence increases exposure to collateral damage. A notable case was the NotPetya attack in 2017—initially directed against Ukraine and later attributed to actors linked to the Russian state—which ended up affecting companies and infrastructures in multiple countries, demonstrating that digital crises originating from distant conflicts can impact highly interconnected economies, reinforcing the need for the country to enhance its preparedness against systemic disruptions.

The persistence of state actors within foreign networks through “strategic pre-positioning” represents a second challenge. Espionage operations and latent presence have become common practices in the competition among powers. A paradigmatic case is the “Volt Typhoon” operation, detected in 2024, where agents of a state actor managed to silently infiltrate energy, water, and transportation networks in the U.S. Unlike traditional cyberattacks, these actions do not seek immediate data theft but rather maintain access that allows for the sabotage of essential services in the event of a future conflict.

A third challenge emerges from the growing geopolitical dimension of digital infrastructure. The recent debate in Chile regarding submarine connectivity projects involving foreign companies has highlighted how these communication channels can become points of geopolitical pressure. According to the ITU, submarine telecommunications cables carry over 99% of international data traffic[8], making them critical assets. For this reason, various powers have begun to consider these infrastructures from a national security perspective, evaluating not only their economic viability but also their strategic implications and the integrity of the technological supply chain.

In the face of these challenges, Chile should advance toward a comprehensive vision that articulates public security, national defense, and policies in the technological realm. This could be realized through the institutionalization of national cyber crisis exercises that integrate various actors[9], expanding initiatives already developed in the country and projecting them toward a permanent system of preparedness for the protection of critical infrastructures; the creation of evaluation mechanisms from a national security perspective for technology providers in sensitive sectors; the development of intelligence capabilities to monitor threats that combine digital and economic dimensions; and greater and more agile coordination and exchange of strategic information at the ministerial level to anticipate risks in an increasingly competitive international environment.

These proposals ultimately point to a greater challenge: the State of Chile should advance from a cybersecurity policy to a proper national cybersecurity strategy. While a policy establishes general principles, a strategy defines priorities in the face of concrete threats, sets operational objectives, and guides the use of state capabilities. This strategy should be integrated into the broader framework of national security, aligning with the institutional architecture responsible for security, to ensure coherence in decision-making, resource allocation, and response to threats that transcend the strictly technological realm. In particular, it should focus on three central objectives: protecting the country’s critical digital infrastructure; strengthening the economy’s resilience against technological disruptions; and developing capabilities to prevent, deter by denial, and respond to hostile operations in cyberspace.

In an international scenario where digital dominance has become a space of geopolitical competition among states, advancing toward a strategic approach to cybersecurity is a necessary condition for achieving national security objectives.

---

---

Download pdf

---

[1] https://www.bcn.cl/leychile/navegar?idNorma=1202434

[2] https://anci.gob.cl/documents/4430/Pol%C3%ADtica_Nacional_de_Ciberseguridad_2023-2028.pdf

[3] https://ncsi.ega.ee/ncsi-index/?order=rank

[4] https://www.itu.int/epublications/publication/global-cybersecurity-index-2024

[5] https://publications.iadb.org/en/2025-cybersecurity-report-vulnerability-and-maturity-challenges-bridging-gaps-latin-america-and

[6] http://www.dipres.cl/597/articles-406737_doc_pdf.pdf

[7] https://cloud.google.com/blog/topics/threat-intelligence/disrupting-gridtide-global-espionage-campaign

[8] https://www.itu.int/digital-resilience/submarine-cables/

[9] Among others, to ministries, Armed Forces, Law Enforcement and Security Forces, ANCI, critical operators designated by ANCI, and academic and research institutions related to cybersecurity.