Cybersecurity: Swiss SMEs are protected but not prepared for an attack

Small and medium-sized enterprises in Switzerland invest in IT security, but often do not know what to do when an attack actually succeeds. That is the finding of the study «KMU Cybersicherheit 2026», published on 22 October by Mobiliar together with digitalswitzerland, SATW (the Swiss Academy of Engineering Sciences) and the universities of applied sciences HES-SO Valais-Wallis and HWZ Zurich, with support from the Federal Office for Cybersecurity.

The survey polled 507 managers of Swiss SMEs with between 1 and 49 employees, between 24 June and 10 July 2026. The results are considered representative of around 614,400 Swiss SMEs across all the country's language regions, including Italian-speaking Switzerland.

Six percent of the companies surveyed suffered a serious cyber incident in the past three years, and 7% have already been victims of an attempted digital extortion. Projected across all Swiss SMEs, that share corresponds to around 35,000 affected companies. Companies with at least ten employees are hit noticeably more often than smaller ones.

Artificial intelligence is a particular concern: 81% of SMEs expect threats linked to the technology to worsen, even though almost half of the companies surveyed do not yet use it in their own projects.

Technically protected, organisationally not

The study distinguishes between technical measures, now widespread, and organisational ones, which still show gaps. More than 80% of SMEs regularly update their software, nine in ten companies create backups, and multi-factor authentication is now common. Only around a third of companies, however, regularly train staff or keep a systematic inventory of their IT systems. Emergency plans, security audits and checks on suppliers remain even rarer: only a quarter of companies regularly check whether their own backups can actually be restored in an emergency.

For Marc Peter, a lecturer at the HES-SO Valais-Wallis university of applied sciences who led the project, cybersecurity does not start with the firewall but with a clear digital strategy: companies with greater digital maturity also see themselves as more resilient against cyberattacks.

Jesús Pampín, head of Mobiliar's Cyber Risk competence centre, stresses that IT security cannot remain solely an IT department matter: it must become part of company strategy and management responsibility. Cyber insurance, he adds, reduces the financial consequences of an attack but does not replace that responsibility.

Almost one SME in two now rates cybersecurity as important or very important, and around two in five companies plan to further strengthen their security measures over the next three years. For Anu Anthamatten, a project manager at digitalswitzerland, it is not enough just to back up data: companies must also regularly check that they are able to resume operations quickly after an incident.