Critical Infrastructure Shields: Collaboration and Intelligence

Leaders from Instituto de Salud EDOMEX, Nacional Monte de Piedad, Group-IB, and Everpure say protecting Mexico’s critical infrastructure requires cross-sector collaboration built on responsible threat intelligence sharing. That means moving from indicators of compromise to indicators of attack and sharing lessons without exposing sensitive data.

Collaboration across sectors has become a strategic requirement for protecting critical infrastructure in Mexico, but it depends on responsible information sharing, prepared teams, and recovery strategies tested before an attack occurs, according to leaders from the health, financial, and technology sectors. Speaking at the Mexico Cybersecurity Summit 2026 in Mexico City, executives from Instituto de Salud EDOMEX, Nacional Monte de Piedad, Group-IB, and Everpure agreed that interconnected operations make any organization’s breach a risk for others.

“Businesses are interconnected, so an attack on one sector can have repercussions across others. We must work together because we are all connected within the same society,” says Kenneth Navarro, Territory Account Executive, Everpure.

Collaboration has evolved rapidly but unevenly, says Carlos Rincón, Head of the Information and Communications Technology Unit, Instituto de Salud EDOMEX. He identifies progress in three areas: secure, layered architectures and constant monitoring by people or AI; communication and awareness protocols among staff; and continuously updated crisis recovery plans. The financial and commercial sectors interoperate daily and show broad maturity, while government and security agencies remain in earlier stages and are less willing to information because of the risks involved, he says.

The volume of shared intelligence must be matched by responsibility, explains Ismer David Dorado, Pre Sales Manager Latam, Group-IB. “Industries are becoming increasingly collaborative, sharing indicators of different attacks and solutions. As companies, we all have a responsibility when sharing these indicators with one another,” he says. Dorado urges organizations to move beyond indicators of compromise, such as IP addresses, domains, or hashes, toward indicators of attack, which add context on the threat actor, the malware involved, and the attack vector.

Héctor Medina, CISO, Nacional Monte de Piedad, adds that communication must also include educational institutions. “The public and private sectors must communicate to prepare future generations for what lies ahead. Extending that communication to users is essential to ensure everyone is informed,” he says.

Mexico and Latin America remain reluctant to disclose incidents because having one is still stigmatized, which limits collective learning, explains Lesly Colmenares, CTO, Seguros Monterrey New York Life. The concern extends beyond the panel: at the same summit, a UNODC representative argued that companies sharing breach information with peers and supply chain partners strengthen collective defense, reports MBN .

Connecting legacy industrial systems to the network adds another layer of risk. Industrial systems were developed individually by each institution and were never expected to interact remotely across sites, says Medina, so the challenge is to interconnect them securely without halting operations. “We cannot afford to stop operations. They must continue while being managed as a risk, with measures in place to prevent failures and contain their impact if they occur,” says Rincón, who explains that his institution builds layers that interact with vulnerable systems so that other applications present the information they need to . Ideally, those systems would be replaced, but resources do not always allow it, he adds.

Navarro recommends identifying assets, segmenting networks, and limiting access for long-lived technologies in sectors such as energy and manufacturing. “Having a data recovery strategy is essential. Organizations need to know their recovery point and how long it will take to restore their operations,” he says. Dorado supports a consolidated view across on-premises and cloud environments, but warns the trade-off. “Today, we all want to monitor threats collectively, but achieving that goal comes with responsibility. We must carefully assess the risks associated with creating this interconnectivity,” he says, recommending continuous vulnerability scanning and microsegmentation depending on each company’s maturity. The risk is tangible: 58% of cyber-physical system operators experienced a cyberattack affecting operational environments in the past year, according to Claroty .

On sharing during an active incident, Rincón says companies should build a culture of timely communication focused on learning from root causes rather than punishing those responsible. Medina draws a clear line on disclosure. “Sharing an incident does not mean disclosing what information was compromised or the full extent of the breach. It means sharing lessons that can help our peers,” he says, explaining that how, when, and what was affected can help colleagues recognize similar symptoms.

Preparation is at the center. Dorado compares incident readiness to overcoming fear through practice, recommending red team exercises, penetration testing, and realistic simulations involving senior leadership. Navarro says teams should know their roles before an attack arrives, as bureaucracy can delay responses when they are most needed. Medina recommends drills that include scenarios in which the leader is absent or staffing is minimal, so teams are empowered to act. Rincón adds that knowing there are plans B, C, and D, even if operations must temporarily run on paper, prevents panic.

Organizations should not fear acknowledging attacks and to monitor early signals such as brand impersonation or mentions in suspicious forums, Dorado says. Colmenares urges leaders to take three takeaways: collaboration is a strategic capability rather than an isolated initiative, resilience must be designed and practiced, and organizations should assume an incident will happen and ask whether they are ready to face it.