evidoria

← Back to browse

Good practice Imported

AIG's National Network Detection & Response Platform — Panama Blankets 500,000+ Government Devices in AI Threat Monitoring After a 2026 Cyberattack Wave

Panama · Panama City · See the Panama profile · See the Panama City profile

Evidence: Descriptive / self-reported Top 83% 40/100 · Ask Evidence Copilot about this practice

After five major 2026 cyberattacks hit Panama's Social Security Fund, tax portal and ministries, AIG deployed an AI-driven Network Detection and Response platform covering 500,000+ government devices across 15 institutions, backed by a ~$6M investment.

500,000+ devices
Government devices covered by NDR platform (2026)
15 institutions
Critical institutions covered (2026)
~6 USD million
AIG cybersecurity investment (2026)
AIG's National Network Detection & Response Platform — Panama Blankets 500,000+ Government Devices in AI Threat Monitoring After a 2026 Cyberattack Wave

Details

Promoter
Autoridad Nacional para la Innovación Gubernamental (AIG)
Period
2026–present
Keywords
cybersecurity, digital government infrastructure, public administration

Context

In 2026, Panama suffered at least five high-impact cyberattacks on public institutions, including the Social Security Fund, the Panamá Emprende business portal, the Ministry of Health, the Ministry of Economy and Finance, and the Office of the Comptroller General.

Activities

The Autoridad Nacional para la Innovación Gubernamental (AIG) deployed a Network Detection and Response (NDR) platform using AI to identify anomalous network behaviour and potential intrusions across government systems, paired with a new Government Cybersecurity Operations Center (SOC) meant to shift the state from reactive to proactive monitoring.

Results

AIG reported the platform now covers more than 500,000 government devices and digital environments across 15 critical institutions (including Tocumen International Airport, IDAAN and the Ministry of Economy and Finance), with AIG investing approximately $6 million as part of over $5 million in recent cybersecurity spending. These figures are self-reported, with no independent audit of incidents prevented since deployment and no disclosed vendor identity.

Conclusions

The case should be read as evidence of rapid deployment scale rather than demonstrated impact, given the absence of independent verification.

Implementation
Indicative cost
High (€500k–€5M) — AIG reported investing approximately $6 million, described as part of over $5 million in recent cybersecurity spending (figures as self-reported, not independently itemised).
Time to results
Short (< 1 year) — Deployed during/after a 2026 wave of cyberattacks on Panamanian public institutions; described as an already-covering, national-scale rollout at time of reporting.
Staffing & skills
Government Cybersecurity Operations Center (SOC) staff under AIG, AIG director (Adolfo Fábrega) named as public lead

Conditions for success

  • Whole-of-government device coverage rather than a single-agency pilot
  • A dedicated SOC to shift from reactive to proactive monitoring
  • Rapid procurement/deployment following a concrete attack wave to justify urgency and budget

Common failure modes

  • No independent audit exists of incidents actually prevented since deployment
  • Underlying vendor/technology identity is undisclosed, limiting external scrutiny
  • Reported budget figures ($6M vs. $5M+) are inconsistent between statements, which is a transparency gap

Where it fits

Governance type
national government
Scale
national (15 critical institutions, 500,000+ devices)
Income level
upper-middle-income

Commonly funded by

National / regional programmes

Indicative funding routes for practices of this type — always check each programme's current calls and eligibility rules.

Do you run this practice? Claim it — verified implementers get a public contact pathway and can propose corrections.

Data sources

Where this practice's information was retrieved from, and when.

Attachments

Similar practices you may find useful