Employee cybersecurity awareness remains the weak spot of Swiss SMEs: only about a third regularly train their staff, according to the "SME Cybersecurity 2026" study. Yet phishing plays a role in about a third of incidents. The Federal Office for Cybersecurity (FOCS) and several Swiss tools help organise this phishing awareness.
Swiss sources converge on a few levers: training staff regularly, drawing on real and recent scams, and setting simple rules on access and data. This page covers team training only. The other basic measures are set out in our guide to SME cybersecurity.
This page distinguishes between facts published by the sources, statements by experts and our own analysis.
Key figures
- About a third of Swiss SMEs regularly train their staff, according to the "SME Cybersecurity 2026" study.
- 6% of SMEs suffered a serious cyberattack in three years, and up to 16% among those with at least ten employees.
- Phishing, password theft, malware and attacks on networks each play a role in about a third of incidents.
- 81% of SMEs expect an increase in cyberthreats linked to artificial intelligence (AI), but only 29% plan additional measures.
- Only 36% of managers consider protective measures easy to put in place.
Why train employees rather than add another tool?
Swiss SMEs are fairly well equipped on the technical side. According to the SME Cybersecurity 2026 study, more than 80% install updates. Nine out of ten make backups, and multi-factor authentication is common.
The gap lies in organisation. Only about a third of SMEs regularly train their staff or keep an inventory of their systems. The survey is based on 507 managers of SMEs with 1 to 49 employees.
People are also a well-known point of entry. The Cybersecurity-Check website cites four frequent causes of successful attacks on SMEs. Among them is deception through social engineering, i.e. the manipulation of people.
The FOCS points in the same direction. It lists staff awareness among the organisational measures that should complement technology. The office makes it a responsibility of management, not just a task for the IT department.
Our analysis: solid technical protection loses its value if a person hands over access themselves. Training targets precisely this link.
What does phishing aimed at an SME look like?
Phishing means tricking a person with a fake message to obtain their data or access credentials. Scammers constantly adapt their scenarios. The FOCS publishes concrete cases every week, which show this evolution.
Dated example: on 20 October 2026, the FOCS described a variant linked to hotel bookings. These campaigns mainly targeted credit cards. In the new variants, scammers also try to take control of TWINT and e-banking accounts.
Dated example: on 13 October 2026, the office warned against another deception: fake Swiss shops. They display a .ch domain, the name of a Swiss town and a touching story. Yet the legal notice or the terms and conditions reveal a company based abroad, with a warehouse in Asia.
Artificial intelligence adds a further risk. The Cybersecurity-Check website, citing the SME portal of the State Secretariat for Economic Affairs (SECO), reports AI-assisted attacks. Deepfakes, for example, are used in CEO fraud attempts.
Our analysis: these weekly FOCS reviews provide free, up-to-date material for a short team session. A real case speaks louder than an abstract rule.
What simple rules should you give your team?
The FOCS's recent publications make it possible to draw out a few easy-to-remember rules. Phrasing them as team guidelines is our own analysis.
- Share with discernment. The FOCS's Cyber Security Month 2026 focused on "oversharing". A photo, a place and a name, combined, build a precise profile that a criminal can exploit.
- Protect data when using AI. On 16 October 2026, the FOCS pointed out that carelessly entering confidential or business information into an AI can lead to excessive data sharing.
- Strengthen access. On 19 October 2026, the office published "Five steps to secure authentication". In it, it proposes a classification of methods, such as passwords, passkeys or smart cards, according to the security they offer.
- Check before buying or paying. A website's legal notice and terms and conditions can reveal a false Swiss origin.
- Know whom to alert. The FOCS receives voluntary reports of cyber incidents from companies and helps them with their next steps.
The last point also matters in a crisis. Roman Hüssy, co-head of the FOCS's Govcert, cites outdated contact details among the frequent mistakes, as they slow down alerts. Our analysis: an up-to-date list of people to contact belongs in awareness training.
Training, test or label: which resources for a Swiss SME?
An SME does not need to start from scratch. Several public or association-run resources cover part of employee awareness, without answering the same question.
| Resource | Who runs it | What it provides | Its limitation |
|---|---|---|---|
| FOCS website | Swiss Confederation | Weekly reviews of scams, alerts, "Businesses and authorities" profile | Its home page does not describe a training programme |
| Cybersecurity-Check | Tool stemming from the national strategy, version 4.0 of November 2025 | Free self-assessment in a few minutes | It relies on the company's own answers |
| ICT minimum standard | FOCS | Lists staff awareness among the organisational measures | Optional for an SME |
| Cyber-Safe label | Swiss Association for the Cybersecurity Label (ASLaC), since 2018 | Assessment of the current situation, action plan and verification by an auditor | No price or duration published on its home page |
The free SME cybersecurity test gives an initial picture of the level of protection. The ICT minimum standard serves as a more structured checklist.
The Cyber Safe label adds an outside perspective. According to its website, 250 SMEs and 200 Swiss municipalities have obtained it. Aurélie Tulot, mayor of Roche, believes the process develops "awareness, staff training".
Who should lead awareness within the company?
Awareness is becoming a matter for management. The 2026 study notes that more SMEs are appointing someone responsible for cybersecurity. Among the recommendations drawn from the study is the appointment of a person in charge at management level.
"Cybersecurity does not start at the firewall, but with a clear digital strategy," says Marc K. Peter, professor at HES-SO Valais-Wallis and head of the study project.
Regularity matters as much as the launch. Scams "continue to evolve", notes the FOCS regarding fake hotel bookings. The requirements of the Cyber-Safe label also change from one session to the next, according to Jean Bourgeois, president of AUBEP.
Renewal moves thinking forward. For Yves Chardonnens Cook, director of the Foundation for Vocational and Continuing Education (FFPC), it helped integrate good practices into daily work. It also opened up reflection on sensitive information passed on to AI.
Other practical pages can be found in our section protecting your business.
What we don't know yet
- Our sources describe neither the method, nor the frequency, nor the cost of a phishing simulation for an SME.
- The Cyber-Safe website shows more than 25,000 phishing emails sent, without specifying in what context.
- No source consulted measures the effect of training on the number of incidents.
- The 2026 study is based on 507 interviews conducted by YouGov Switzerland from 24 June to 10 July 2026. It describes what companies report, not a check of their practices.
Sources
- Federal Office for Cybersecurity (FOCS)
- Cyber-Safe, the Swiss cybersecurity label
- Cybersecurity-Check für KMU
- "SME Cybersecurity 2026" study by Mobiliar and its partners, according to 2clics.com
