São Paulo's Cybersecurity Awareness Plummets as Phishing Attacks Accelerate

Cybersecurity awareness in Brazil has taken a sharp turn for the worse. The national score fell to 54 points in 2025, dipping below the global average of 57, according to research published in Frontiers in Computer Science. The drop was driven largely by a decline in 'privacy awareness,' which hit just 48 points.

The numbers are a wake-up call for São Paulo, a city that hosts 80% of Brazil’s national data-center capacity and the majority of the country’s tier-one incident-response teams. Yet even with this infrastructure, small and medium businesses in the region often lack the resources to make cybersecurity a priority, government analysts warn.

What the data reveals about local risks

Only 13% of Brazilians know how to properly secure a home Wi-Fi network. The ability to identify phishing sites dropped from 34% in 2024 to 27% in 2025, a decline of seven percentage points in a single year. Phishing and social engineering attacks exploit human vulnerabilities, and in Brazil, approximately 80% of cybercrime involves social engineering, affecting 24 million Brazilians with virtual scams and fake bills.

These figures come from a combination of academic analysis in Frontiers in Computer Science, industry reports by Mordor Intelligence, and cybersecurity briefings from Brazil’s Institutional Security Office. Together, they paint a picture of a workforce unprepared for the threats targeting it every day.

How São Paulo is responding

The São Paulo State Government conducts mandatory Cyber Risk Assessments (ARC) to identify vulnerabilities and promote cybersecurity training for public agents and society. Local webinars have been organized to emphasize a simple message: 'consciousness protects the operation.' The assessments, run through state agencies, are designed to help government bodies and private-sector partners recognize that phishing and social engineering exploit human error, not just technical gaps.

For professionals in São Paulo’s tech-heavy economy, the stakes are high. With so much national data flowing through the city, workers in finance, logistics, healthcare and IT are frequent targets. Experts recommend starting with the basics: enable two-factor authentication on all accounts, use a password manager, and never click on links in unsolicited emails or messages.

Practical steps for job seekers and professionals

Job seekers should be especially cautious. Fake job offers and recruitment scams are a common form of social engineering in Brazil. Candidates are often asked to pay for training or background checks upfront, a major red flag. Legitimate employers in São Paulo will not ask for payment during the hiring process.

For professionals already in the workforce, regular cyber hygiene training is essential. Many larger firms in São Paulo now run internal phishing simulations to test employees. But for those at smaller companies without such programs, independent training resources are available through platforms like the CERT.br (part of NIC.br) and the São Paulo State Government’s digital safety portal.

With awareness scores continuing to fall, the message is clear: staying safe online requires constant vigilance, not just a one-time update. As one local cybersecurity webinar put it, 'consciousness protects the operation.'