The vast majority of SMEs have been spared serious cyber-attacks over the past three years. However, 6 per cent of the Swiss companies surveyed were affected in 2026, two percentage points more than in the previous year. When it comes to cyberattacks, SMEs most frequently report significant effort required to rectify the damage and emotional strain. Financial consequences are cited only in third place among the damages suffered. Among companies with at least ten employees, the proportion of affected companies is significantly higher, at up to 16 per cent.
Despite a relatively low proportion of companies directly affected, almost nine in ten SMEs regard cybercrime as a serious problem. Furthermore, 81 per cent expect cybercriminals to make increasing use of artificial intelligence for attacks in future.
Technically, many SMEs are well equipped: over 80 per cent regularly install software updates, nine in ten create backups, and multi-factor authentication is standard practice in many cases. However, there are gaps in organisational measures. Only around a third provide regular training for staff, whilst contingency plans and security audits are even less common. And only around one in four SMEs tests whether its backups can be restored in an emergency.
The good news is that, following a decline last year, cyber security will regain importance for SMEs from 2026 onwards. 46 per cent of SMEs rate the issue as important or very important, and an increasing number of companies are explicitly defining who is responsible for cyber security. Furthermore, cyber security is increasingly seen as a management responsibility.
How can SMEs protect themselves more effectively?
Based on the findings, the study has drawn up a checklist for SMEs that covers both technical and organisational cyber security measures. The most important measures from a technical perspective are:
Securing the technical foundations: This includes, amongst other things, regular updates to operating systems and firewalls, the use of multi-factor authentication, and the use of password managers.
Protecting data: This includes, for example, regularly backing up data and verifying the validity of the backups made, as well as encrypting devices and sensitive data.
Securing infrastructure: This relates, amongst other things, to the use of VPN solutions or biometric login procedures, as well as the monitoring of data traffic and the segmentation of critical network systems.
With regard to organisational cybersecurity measures, the following recommendations are made:
Raising staff awareness: This includes, for example, the introduction of mandatory password policies, verifying the authenticity of emails and documents, and providing regular training for staff.
Establish structures and responsibilities: This refers to the clear definition of responsibilities regarding cyber security within the organisation, the inventory of the IT infrastructure, and the organisation of IT security support.
Increase resilience: This includes, for example, drawing up a contingency plan, defining responsibilities in the event of a crisis, and reporting cyber incidents to BACS.
Regularly reviewing risks: This includes assessing the cyber security of suppliers, classifying data according to protection requirements, or reviewing digital dependence on individual service providers.
Cyber resilience is not just about preventing attacks, but also about remaining capable of acting after an incident. Ultimately, combining technical protective measures with clear responsibilities, trained staff and a tried-and-tested emergency plan also strengthens a company’s competitiveness.
The study shows how Swiss SMEs assess cyber risks in 2026, the extent to which they are affected, and what protective measures they are implementing. It also examines the issue of digital sovereignty.
Mobiliar, in collaboration with the Federal Office for Cyber Security (BACS), digitalswitzerland, HES-SO Valais-Wallis, HWZ Zurich University of Applied Sciences and SATW. The survey was carried out by YouGov.
Between 24 June and 10 July 2026, 507 managers of SMEs with between 1 and 49 employees were surveyed online. The results are representative of around 614,400 Swiss SMEs across the country. The confidence interval is ±4.4 percentage points.
6 per cent of the SMEs surveyed have suffered a serious cyberattack in the last three years; extrapolated, this corresponds to over 35,000 businesses. 7 per cent have been subjected to extortion at least once, which, extrapolated, corresponds to around 45,000 SMEs.
81 per cent of SMEs expect cybercriminals to make increasing use of AI in their attacks.
Organisational measures include staff training, contingency plans, security audits, supplier vetting and testing of backups. Technical measures such as updates, backups and multi-factor authentication, on the other hand, are widely implemented.
To the management teams of SMEs and to decision-makers in politics, business and public administration who are involved in the cyber resilience of the Swiss economy.
The SATW addresses issues relevant to technology policy on behalf of the federal government. Cyber security is one of its key focus areas. Through this study, it is helping to strengthen the cyber resilience of SMEs, which form the backbone of the Swiss economy.
Translated by an automated translation plugin.
| Role | Title + Name |
|---|---|
| Text by | Tobias Schlegel |
