Cybersecurity for Swiss SMEs: the five things that actually matter

Swiss SMEs are attacked with commodity techniques, not bespoke ones. The intrusions we review almost never involve a novel exploit. They involve a password that was reused, an account that was never disabled, a backup that was reachable from the same network it was supposed to protect, or an invoice email that looked right.

That is good news, because commodity attacks have commodity defences. The problem is that security spending rarely follows the attack pattern. It follows the vendor conversation, and a 60-person manufacturer with one IT generalist ends up with a monitoring subscription before it has multi-factor sign-in on its email.

Below are the five controls that matter, in order, with what they cost and how they change between a 20-person company and a 200-person one.

What are Swiss SMEs actually attacked with?

Mostly fraud and stolen credentials. The National Cyber Security Centre received almost 65,000 reports in 2025, and the largest categories were fake calls from supposed authorities, phishing and investment fraud. Among attacks aimed at companies, CEO fraud was reported far more often than ransomware. The pattern is people being persuaded to hand over a password or a payment, not systems being broken.

The federal figures for 2025 also show the direction of travel. CEO fraud rose from 719 reports in 2024 to 970, business email compromise rose only slightly, and ransomware went from 92 reports to 104. Ransomware remains rarer than fraud and far more damaging when it lands. That is why the list below covers both: controls that stop the persuasion from working, and one that makes a successful ransomware attack an expensive week rather than the end of the company.

The European picture is the same. In the incidents ENISA analysed between mid-2024 and mid-2025, phishing was the initial way in for about 60%, and exploitation of known vulnerabilities for 21%. Those two routes are exactly what multi-factor sign-in and patching deadlines close.

The five, in priority order

1. Multi-factor authentication on everything external. Email, VPN, remote desktop, the ERP, the finance system, the webshop back office. Not only admin accounts: everything reachable from outside. This single control removes the largest category of intrusion, and it costs licence configuration and an afternoon of user support rather than money. It is also rarer than people assume. Across the EU in 2024, only about 40% of enterprises with ten or more staff used more than one authentication mechanism, according to Eurostat.

2. A leaver process that actually revokes. Accounts belonging to people who left are a standing finding in almost every assessment. Tie deprovisioning to the HR event, not to a helpdesk ticket somebody remembers to raise. Include the accounts nobody thinks of: the shared supplier portal login, the former contractor's VPN profile, the cloud folder shared with a personal address.

3. Backups that an attacker cannot reach. A backup on the same domain, with the same credentials, on the same network, is not a backup. It is a second copy waiting to be encrypted. Keep one copy offline or immutable, and restore from it in a test at least twice a year. An untested backup is a hypothesis. The NCSC's basic guidance makes the same point for any organisation: at least one copy offline, and three copies on two kinds of storage with one kept elsewhere.

4. Payment change verification out of band. Business email compromise does not break encryption. It asks accounts payable to update bank details. One phone call to a number you already had, every time, no exceptions for urgency. Urgency is the attack. The NCSC's advice on CEO fraud is the same: a second person approves payments and changes to a supplier's bank details, you call back on a number you already know, and the process is never bypassed for an instruction from senior management.

5. Patching with a deadline. Not a patching policy: a deadline, with an owner, and a report that shows what missed it. Start with internet-facing systems such as firewalls, VPN gateways, remote access tools and the mail server, because those are what attackers scan for.

Everything after these five is refinement. The same Eurostat survey shows how wide the gap between small and large firms is on the organisational side: in 2024, 29% of small enterprises had carried out an ICT risk assessment, against 76% of large ones. The five controls do not need a risk assessment to justify them. They are the floor.

What does the revised FADP require of an SME?

It requires security appropriate to the risk for any personal data you hold, and it requires you to notify the Federal Data Protection and Information Commissioner as quickly as possible when a breach is likely to cause a high risk to the people affected. It prescribes no specific products, sets no fixed number of hours, and does not require data to stay in Switzerland.

The detail is in the Data Protection Ordinance, and it maps closely to the list above. Article 3 asks for access limited to what each person needs, the ability to restore data rapidly after an incident, and software in which known critical vulnerabilities are resolved. That is the leaver process, the backup and the patching deadline written as law. The Federal Act on Data Protection makes the duty personal: wilfully failing to meet the minimum data security requirements can bring a fine of up to CHF 250,000 for the responsible individual.

The data inventory is therefore the compliance artefact that matters most. You cannot enforce multi-factor sign-in on a system nobody listed. The wider obligations, including the duty to inform customers and when a register of processing activities is required, are in what Swiss companies actually have to do under the revised FADP.

Does the new reporting obligation for cyberattacks apply to us?

Probably not directly. Since April 2025, operators of critical infrastructure such as energy and water suppliers, transport companies and public administrations must report cyberattacks to the National Cyber Security Centre within 24 hours of discovery. Most SMEs are outside that scope. Many SMEs supply companies inside it, though, and those customers are starting to pass security requirements down their supply chains.

The Federal Council's decision gives operators 24 hours for a first report and 14 days to complete it, with fines for failing to report from October 2025. In practice, a 50-person electrical contractor maintaining a utility's substations, or a software firm hosting a municipality's records, will see the obligation arrive as a contract clause: notify us within hours, and show us your controls. Banks and insurers have had a comparable duty towards FINMA for years, and how that plays out with cloud providers is covered in cloud migration in Swiss banking.

Voluntary reporting is still worth doing, because the NCSC uses reports to warn other companies.

What should an SME actually spend?

Less than most vendors suggest, and mostly in time. The first three controls cost licence configuration and a few days of work. Endpoint protection, offline backup and awareness training are the main recurring costs. Penetration tests and round-the-clock monitoring come last, because each produces findings that someone has to act on, and in a company without an IT department nobody is yet in a position to.

Ranges are typical observations from the Swiss market in 2026 and vary with estate size. Buying the bottom row before fixing the top rows is the most common misallocation we see: continuous monitoring produces alerts, and alerts without a response process produce a subscription. For what outside help costs per day, see what a Swiss company should pay for consulting.

What changes between 20 people and 200?

The five controls stay the same at every size. What changes is who does the work: a side job for the founder at 20 people, one IT generalist fighting software sprawl at 80, and named roles with a tested incident plan at 200.

At 20 people, an external IT provider does the hands-on work and the risk is that nobody owns it. Write the five controls into the provider's contract, ask for a one-page monthly report on them, and make the callback rule a habit of whoever releases payments. In a startup this often belongs to the fractional CTO or first technical hire decision.

At 60 to 100 people, there is typically one IT generalist and a growing list of SaaS tools bought by departments. The risk shifts to sprawl: accounts nobody revokes and systems nobody listed. The leaver process and the inventory become the main work. This is also when a new ERP or finance system tends to arrive, and access rights should be designed into it rather than copied from the old one, a point that belongs in the first 90 days of a digital transformation.

At 200 people, you need named roles: someone accountable for security who is not the person administering the systems, a tested incident plan, and a review of the suppliers that hold your data. A penetration test starts to be informative. A dedicated security hire may be justified, but a part-time external role often covers it until the estate is larger.

Do we need a penetration test?

Not until the five controls are in place. A penetration test against an estate with no multi-factor sign-in and an unrevoked leaver account will report exactly that, at considerable expense, and you will have paid a specialist to tell you something an inventory would have shown for free. Test once the obvious is closed, and the result becomes genuinely informative.

When you do commission one, scope it to what an attacker would actually reach: the external perimeter, the email tenant, and one path from a phished account to administrator rights. Ask for findings ranked by how likely they are to be exploited, and retest the top ones a few months later to learn whether the fixes held.

Operational technology is a different problem

If you run production equipment, the assumption that you can patch on a schedule is usually wrong, and the assumption that the machines are air-gapped is almost always wrong too. Segment first, monitor the boundary, and treat vendor remote-access channels as the primary risk, because they typically bypass everything else you have built. Our cybersecurity practice starts these engagements with a connectivity map rather than a control framework, because the map usually changes the framework.

For industrial companies there is a free Swiss reference. The federal ICT minimum standard was written to protect critical infrastructure, and it has been mandatory for electricity suppliers since July 2024 and for gas suppliers since July 2025. For everyone else it is a recommendation, and it comes with a self-assessment spreadsheet. A 120-person machine builder will not implement all of it, but the assessment is a useful way to find the gaps between the office network and the shop floor.

Every machine connected to a dashboard or a cloud service is a new path in, and it belongs on the map before it goes live. The sequencing is in Industrie 4.0 in Swiss manufacturing.

What to do on the day something goes wrong

Have the plan written before you need it. The NCSC's model divides an incident into four phases: preparation, the incident itself, the response, and the debriefing. For a small company the useful part is short. Who decides, who calls the IT provider, who calls the bank to stop payments, who talks to customers, and who informs the Commissioner if personal data is affected. The free SME template in the NCSC emergency plan covers exactly that, and it is the most practical incident document we know of for a company without an IT department.

Decide two things in advance, because they are hard to decide under pressure: who has the authority to choose between restoring and negotiating, and where the plan lives. A plan stored only on the file server that has just been encrypted is not a plan.

The NCSC's own framing, from its 2026 event for SMEs, is that the question is not whether an SME will be affected by a cyber incident but when, and that effective basic protection can be established with simple measures alone. We agree with both halves.

Where to start this month

Run one query: list every external-facing service and whether multi-factor sign-in is enforced on it. Not policy, enforcement. That list, on one page, will tell you more about your real exposure than any framework assessment, and it takes an afternoon.

Then work through the month above. The same inventory is the base of data readiness for AI, and it matters more as companies give AI agents access to their systems. If payments are part of your product, the decisions that come before the code include fraud controls of exactly this kind.

Once the basics hold, the NIST Cybersecurity Framework 2.0 is a free structure for the next stage, written for organisations of every size, with quick-start guides for small businesses. A second pair of eyes on the list is how our cybersecurity work usually starts.

Sources

• Federal Office for Cyber Security — Week 52: More focused, more intricate, more sophisticated, reports received in 2025 by category
• Federal Office for Cyber Security — Week 4: Urgent money transfer, CEO fraud and recommended payment controls
• Federal Office for Cyber Security — Cybersecurity basics, backup and sign-in recommendations
• Federal Office for Cyber Security — Reporting cyberattacks on critical infrastructure mandatory from 1 April 2025, the 24-hour reporting duty
• Federal Office for Cyber Security — Emergency planning is the key to cyber resilience, four-phase model and SME template
• Federal Office for Cyber Security — Focus on SMEs: How to detect and defend against cyber attacks, June 2026 event summary
• Federal Office for Cyber Security — ICT minimum standard, mandatory for electricity and gas, recommended elsewhere
• Eurostat — ICT security in enterprises, Statistics Explained, 2024 survey
• ENISA — EU consistently targeted by diverse yet convergent threat groups, intrusion vectors, July 2024 to June 2025
• Fedlex — Federal Act on Data Protection (FADP), SR 235.1, Articles 8, 24 and 61
• Fedlex — Data Protection Ordinance (DPO), SR 235.11, Article 3: technical and organisational measures
• National Institute of Standards and Technology — NIST releases version 2.0 of landmark Cybersecurity Framework

Related reading

• The revised FADP: what Swiss companies actually have to do
• Cloud migration in Swiss banking after the revised FADP
• Industrie 4.0 in Swiss manufacturing: where to start, and what to skip
• Is your data ready for AI? The five foundations an SME actually needs
• Cybersecurity consulting