ICT Companies 2023 survey, launched on May 14th , presents crucial data on accessibility and the role of the internet within Brazilian companies. It collected data from 4,057 companies with more than 10 employees in Brazil and was supported by the Ministry of Economy, the Brazilian Institute of Geography and Statistics (IBGE), the Institute for Applied Economic Research (IPEA), and a group of experts from various sectors. Due to the importance of the information, this research is fundamental to understanding the growth of organizations' online presence and their concern with digital security .
The data collection took place from March to December 2023, with the objective of measuring the use and ownership of information technology and the telecommunications processes of companies. In this way, it was possible to obtain a comprehensive overview of how organizations use the internet and how this process has evolved in recent years .
Based on internet usage, it was possible to consolidate information on cybersecurity and digital communication. We have prepared this material with everything you need to know about the recent ICT Companies 2023 survey.
The ICT survey is based on methodological standards and indicators defined internationally in manuals from institutions such as the International Telecommunication Union (ITU). It is also aligned with the methodological frameworks proposed in the manual of the United Nations Conference on Trade and Development (UNCTAD), developed in partnership with the Organisation for Economic Co-operation and Development (OECD) and the Statistical Office of the European Commission (Eurostat) through the multi-stakeholder initiative Partnership on Measuring ICT for Development.
Digital security practices addressed in the ICT Companies 2023 survey
Developed to understand the technological processes and digital behavior of Brazilian companies, the ICT Companies 2023 survey also highlighted fundamental digital security practices to ensure a stronger cybersecurity strategy. Among the main practices addressed, we can mention:
Digital security risk in the employment contract
Considering the immense growth of cyberattacks today, it is crucial to establish the digital security risks in the employment contract. Digital security is a priority in the context of modern companies , mainly due to the increase in remote work and the dependence on digital systems and resources.
In this sense, it is essential that digital security risks be addressed in the employment contract , so that company employees have a broader view of how processes should be carried out and what strategies should be implemented.
Regarding company size, there is a large discrepancy among those interviewed on the topic. Larger companies end up mentioning digital security risks in employment contracts more frequently than smaller companies (31%) , reaching 64% of respondents.
Digital security on meeting agendas
This topic discusses the inclusion of digital security on meeting agendas, highlighting the relevance of these strategies to the company's activities. In this regard, the research also revealed that larger companies tend to address the topic more frequently, reaching 75% of respondents.
While in small businesses, this rate is much lower, at 39%. Data such as this demonstrate that smaller companies show less concern in addressing issues related to cybersecurity.
Incentive to mitigate digital security risks
To keep their networks and devices more secure, companies need to implement effective strategies. For this reason, incentives offered by companies to mitigate digital security risks are fundamental to increasing cybersecurity protection.
These incentives can be implemented through bonus policies, formal recognition for participation, awards, and other resources . Through this strategy, managers can offer rewards to employees who act in favor of cybersecurity, such as creating strong passwords, using digital resources appropriately, alerting the IT team about potential security flaws, among other measures.
Training on digital security risk management
Making your employees understand the importance of implementing more efficient practices to avoid problems related to digital security is one of the most important aspects of your protection strategy. Risk management training is essential for employees to adopt a proactive approach and build a digital culture focused on information protection .
A digital security culture is an approach that should be implemented in the daily operations of all companies . This means that the rules established by the company and the proper use of digital resources that are part of the business should be part of the routine of all employees.
Through this approach, it is possible to raise employee awareness about the main cyber threats, their consequences, and the damage they can cause to the company's structure and image. In this way, employees will be better prepared to identify potential risks and will know the best strategies to overcome these challenges .
Which companies have most adopted digital security practices in Brazil?
Among the many variables evaluated by the research, the profile of the most advanced companies in terms of digital security practices was also analyzed, taking into account the size, location, and sector in which the company operates.
Regarding company size, it became evident that larger companies show a greater concern for digital security. This difference is more explicitly perceived in relation to the discussion of digital security risks in organizational meetings, with companies with more than 250 employees showing a 75% response rate on the topic, while companies with 10 to 49 employees showed only 39%.
Regarding company location, there are some variables, but nothing that presents a significant difference. An example of this is the implementation of digital security risk management training for employees. While 26% of companies in the Southeast region have adopted this practice, in the Northeast region this rate is 35%, in the Midwest 34%, North 38%, and South 31%.
In terms of target markets, the Information and Communication sector leads the list, with 63% implementing safety-focused training. The sector also leads in other categories, such as discussing safety issues in meetings (80%), mentioning safety requirements in employment contracts (66%), and implementing incentives (43%).
The accommodation and food service sector showed the worst results in the survey, highlighting the cybersecurity vulnerability of companies operating in this market.
Large companies are increasingly concerned about digital security practices
One of the most relevant aspects of the 2023 ICT Companies survey relates to the size of companies that demonstrate greater or lesser concern for digital security practices. The survey showed that the larger the company, the greater its concern for cybersecurity.
Following the same trend, larger companies also responded positively to discussions about digital security risks in organizational meetings, and showed better results regarding the implementation of training and capacity building on digital security risk management.
No significant difference was observed regarding the implementation of performance incentives for employees to reduce digital security risk, making it clear that this measure is not a high priority for organizations.
Information and communication: the market with the most digital security practices
The ICT Companies 2023 survey took into account various markets of operation, such as:
- Manufacturing industry;
- Construction;
- Trade and repair of motor vehicles and motorcycles;
- Transportation, storage and mail;
- Accommodation and food;
- Information and communication;
- Real estate activities, professional, scientific and technical activities, administrative activities and support services;
- Arts, culture, sports and recreation, other service activities.
Due to the need for protection that these sectors present, the information and communication area was the market that showed the highest rate of digital security practices, presenting the best results when considering the four main points of the research, which are:
- Mention of digital security risks in employment contracts
- Discussion about digital security risks in company unit meetings
- Offer performance incentives to employees that reduce digital security risk
- Promote training on digital security risk management, such as online courses, workshops, seminars, conferences, or training offered through internal meetings
Regarding the frequency of discussion of digital security risks in organizational meetings, 80% of respondents in this sector responded positively to this approach, frequently mentioning the topic in the meetings held.
Furthermore, the information and communication sector also showed greater implementation of cybersecurity training and capacity building, with 63% of the companies surveyed.
Following this trend, 66% of information and communication companies report mentioning digital security risks in employment contracts. These numbers demonstrate how advanced the information and communication sectors are in implementing security measures and protection protocols that should be part of the routine of organizations.
The sectors that were most concerned about the digital security of their organizations were the information and communication sector, followed by the real estate sector, professional, scientific and technical activities, administrative activities and support services.
Regarding companies with the lowest level of concern about cybersecurity, the accommodation and food service sector shows the worst results across all four areas of the survey, with only 20% responding positively to the implementation of training and capacity building on digital security.
Implementation of digital security policy in Brazil
A digital security policy, or information security policy, is a document developed to define rules, practices, and responsibilities aimed at protecting a company's information systems . Within a company, this policy should include strategies on how employees should handle confidential information, permitted access levels, the use of mobile devices for task completion, and measures to be implemented in the event of a security breach.
This means that a digital security policy is developed to protect the organization's information , allowing the company to comply with current regulations and remain competitive while protecting its market image. An example of a security policy is an "Internet Access Control Policy ," which can transform your company's security strategy.
Considering the data from the 2023 ICT Companies survey, the implementation of a digital security policy in Brazil is urgent. The survey data shows that many companies still do not understand cybersecurity as a priority, and should adapt to market needs and establish methodologies and guidelines to help protect their information.
The rise in cyberattacks demonstrates that the more prepared a company is on how tasks should be performed, prioritizing data protection, the more protected its information will be. According to data from Check Point Research , in the second quarter of 2023, approximately one in 44 companies worldwide suffered a ransomware attack per week.
Factors influencing the scope of digital security policy
As we saw earlier, a digital security policy is an indispensable set of actions within today's companies . The scope of this policy should consider the roles and responsibilities regarding risk management in relation to digital security, including processes for cooperation and training of employees.
In addition, this policy should also include:
- Processes to enable cooperation through information sharing within the organization: the security policy establishes processes and procedures to facilitate cooperation and information sharing between different departments and stakeholders within the company.
- Audit review and improvement cycle: this policy defines processes for conducting regular audits, reviews and vulnerability analyses, ensuring that security measures are up-to-date and effective.
- Risk assessment: establishing guidelines for assessing digital security risks, such as identifying and analyzing potential threats, vulnerabilities, and associated impacts, is also part of the security policy.
- Processes for deciding how much risk should be assumed, reduced, transferred, and avoided: based on the risk assessment performed, the security policy allows managers to establish processes for deciding the acceptable level of risk for the organization.
- Selection of digital security measures: the policy allows the establishment of criteria for the selection and implementation of digital security measures appropriate to the specific needs and risks of the organization.
- Business continuity and resilience: defining plans and procedures to ensure business continuity and operational resilience in the event of security incidents.
- Digital security risk transfer: the security policy establishes rules and guidelines for transferring digital security risk through insurance or other forms of risk mitigation.
- Awareness and training: inclusion of awareness and training programs to educate employees about safe digital security practices.
Although there is no significant difference regarding the factors studied during the research, it is important to elucidate the importance of adherence to national security policy . All these processes contribute to the organization being able to adapt more intelligently and efficiently to security measures.
The National Cybersecurity Policy . Its objective is to provide guidance and a basis for cybersecurity-related activities in the country, representing a major step in the current cybersecurity strategy.
90% of large companies have a digital security policy
A very significant finding of the research is that 90% of large Brazilian companies already have a digital security policy implemented . However, this data is concerning with regard to smaller companies.
In contrast, smaller companies demonstrated weak adherence to digital security policies. This lack of adherence may be a direct reflection of a lack of resources, knowledge, or the perception that they are not susceptible to cyberattacks due to their size or visibility. However, it is crucial that even small and medium-sized enterprises adopt a digital security policy to increase information protection and ensure business continuity.
Market segment with the highest adherence to digital security policy
Regarding the sector of activity, there are some fluctuations that should be highlighted. Both the information and communication sector and the real estate, professional, scientific and technical activities sectors showed more positive results regarding the implementation and adherence to a digital security policy, when compared to the sectors with the worst results, such as the Accommodation and Food sector and the Construction sector.
This difference is mainly due to the sensitive nature of the data handled and stored by these companies . While the information and communication sector has a rate of 86% of companies with a digital security policy, the real estate, professional, scientific and technical activities sector has 72% of companies with an implemented policy.
The accommodation and food services sector showed a result of 39%, and the construction sector 46%, which, although they also handle sensitive data, do not have a direct impact on the handling of information. These numbers show that the type of information collected has a direct impact on the implementation of a Digital Security Policy.
As elucidated in other aspects of the research, the accommodation and food service sector showed the lowest adherence rate to the Digital Security Policy, at 39%. The other sectors, however, presented superior results, as shown below:
- Transportation, storage and mail, 53%
- Arts, culture, sports and recreation, other service activities, 52%
- Manufacturing industry, 52%
- Trade and repair of motor vehicles and motorcycles, 50%
- Construction, 46%
Adoption of new technologies by Brazilian companies
In conclusion, the ICT Companies-2023 survey also provided relevant data on the adoption of new technologies by companies. Although technological advancement has been considerable in recent years, many companies still show low adoption of certain resources , such as the Internet of Things and artificial intelligence.
Although there was a 21% to 29% increase in the use of new technologies by medium-sized companies between 2021 and 2023 , this data needs to be evaluated more thoroughly . This is because this growth occurred mostly due to the increased use of security devices, such as smoke detectors, alarms, and cameras.
The use of AI and IoT is not widespread in Brazilian companies
The use of artificial intelligence is led by the Information and Communication sector, with a result of 40%. In contrast, the Accommodation and Food sector showed the lowest result, representing only 6% of the companies surveyed.
Regarding the implementation of automation tools through the Internet of Things, the results are similar. Leading the research is the Information and Communication sector (37%), as well as the largest companies (36%). The construction sector showed the lowest results, with 9% of the companies surveyed.
The research also considered how Artificial Intelligence is applied, raising the following questions:
- Marketing or sales;
- Production processes;
- Organization of business administration processes;
- Business management;
- Logistics;
- Digital security;
- Human resources management or recruitment.
Automation focused on digital security is led by the arts, culture, sports and recreation sector, other service activities , which showed a result of 70%, while the trade, repair of motor vehicles and motorcycles sector and the real estate activities, professional, scientific and technical activities, administrative activities and support services sector showed a result of 39%.
The research also considered companies that used smart devices or the Internet of Things, according to type, highlighting the use for facility security, such as alarm systems, smoke detectors, door locks, and smart security cameras . In this category, companies of all sizes showed similar results, ranging between 84% and 85%.
According to the sector, the category is led by companies in real estate activities, professional, scientific and technical activities, administrative activities and support services, and transport, storage and mail, with a result of 88%. The other sectors also showed good results, such as the Information and Communication sector (80%) and the Manufacturing industry (85%).
The use of emerging technologies, such as artificial intelligence and smart automation sensors, is still quite limited, being more frequently used by larger companies. Technological advancement has become quite prevalent among larger companies, mainly due to the use of artificial intelligence solutions in performing daily tasks.
Automation has been widely used in simpler tasks, such as chatbots for customer service. The trend is that, over the years, there will be an expansion of the automation of tasks and workflows, allowing for the performance of even more complex services.
It is expected that the growth in commercial offerings and the further development of these technologies will allow companies in all sports to implement such resources into their routines.
Increased use of the cloud for data storage
According to data collected by the research and information provided by the companies themselves, the lack of use of these resources is mainly due to a lack of specialized teams to handle this technology, the cost of acquisition, and even a lack of knowledge about these functionalities.
Regarding cloud computing technology, according to research, one in three companies already uses this resource. While in 2019 approximately 23% of companies used cloud computing, this number reached 33% in 2023. The practicality and availability that this technology offers has made it one of the most widely used resources by organizations.
The research showed that in recent years, there has been a slight increase in the percentage of companies that recognize the importance of investing in security software services . Faced with the growing threat of cyberattacks and the constant evolution of technologies, companies are increasingly aware of the need to protect their data.
Given the significant increase in the use of technologies to optimize processes and improve results, it is necessary to adopt advanced tools to protect corporate networks against external and internal threats. These tools allow companies to control internet access, block unwanted content, protect their confidential data, and monitor network usage in real time.
Whether geared towards a small business concerned with controlling employee internet access or a large corporation seeking protection against more sophisticated and damaging cyberattacks, this type of tool can be a valuable ally in the organization's cybersecurity strategy.
Conclusion
The 2023 ICT Companies survey provided valuable insights into the use of information technology in Brazilian companies and highlighted the importance of robust digital security practices. It is evident that large companies are more advanced in implementing security policies, but there is an urgent need for awareness and adoption of these practices in small businesses as well.
Implementing a digital security culture, promoting continuous training, and investing in protection technologies are fundamental steps to ensure data security and business continuity. Regardless of size or sector, all companies must be aware of cyber threats and adopt preventive measures to mitigate risks and protect their operations .
