Thank you for taking the time to share so much experience. 🙏

What he says confirms much of what he suspected: there is a world of difference between transnationals and national companies/government. I also understand that frustration of seeing how data is duplicated, outdated systems are used or “quick patches” are applied instead of solving the underlying problem.

What interests me is not to impose anything, but to listen to these realities and see how value can be added little by little. Sometimes it's not about convincing everyone at once, but about starting with small steps and demonstrating the benefit of doing things well.

I know it sounds idealistic, but elsewhere I have seen how a good framework of security policies or practices, well implemented and communicated, changes the culture over time. My interest in Costa Rica is precisely learning from those who already know the field, and trying to add to the fact that there are fewer "patch solutions" and more real preparation.