IT security for a Swiss SME rests first and foremost on a few basic steps: installing updates quickly, protecting access, training the team to spot phishing and knowing who to call in the event of an incident. The Federal Office for Cybersecurity (FOCS), the Confederation's centre of expertise, publishes alerts and recommendations for businesses and receives their reports. These measures matter, because a third of Swiss SMEs have already suffered a cyberattack, according to PME magazine.
This page gives an overview of the topic. It complements the section devoted to protecting your business, and distinguishes what the sources say from our own analysis.
Key figures
- A third of Swiss SMEs have already suffered a cyberattack, according to PME magazine.
- The FOCS's GovCERT classifies incidents using a four-level model, from "low" to "critical".
- The FOCS's on-call line operates 24/7.
- Operators of critical infrastructure have been required to report their cyber incidents to the FOCS since 1 April 2025.
- On 21 October 2026, the FOCS reported two critical vulnerabilities in PHP that could be exploited without authentication.
Why is a small business targeted?
An SME does not need to be singled out to be hit. Many attacks are automated: they scan the internet for vulnerable software, regardless of who owns it.
The online magazine Republik experienced this in 2026. Unknown attackers exploited a flaw in Metabase, a data analysis tool. Much of the evidence points to a broad, automated wave targeting all installations of this tool. The attackers were looking for credentials and keys to artificial intelligence services that could be resold.
The second risk comes through service providers. At the end of September 2026, an attack on a software supplier made it possible to steal data from the pension fund of the City of Zurich. The Bernese Pension Fund and the Bernese Teachers' Insurance Fund also lost data through an external supplier. This mechanism is known as a supply chain attack.
Our analysis: for an SME, protection therefore does not stop at its own computers. It requires knowing which service providers hold its data.
Why do updates come first?
A known flaw becomes a gateway as soon as attackers know how to exploit it. A patch only protects if it is installed.
The Republik case illustrates this. "The security flaw had been known since 6 August, but we did not take the necessary countermeasures in time," the magazine admitted. Unauthorised access had been ongoing since August.
A dated example: on 21 October 2026, the FOCS recommended immediately updating systems that use PHP. Two critical vulnerabilities could allow malicious code to be executed on a server without authentication. The office asked for web servers to be checked, but also applications and devices that integrate PHP as a component.
For an SME, this advice also covers its website, its online shop and tools hosted by a service provider. Roman Hüssy, co-head of GovCERT at the FOCS, cites a common mistake: applying only some of the recommendations, which allows attackers to spread.
Password or two-factor authentication: which to choose?
Authentication is the check that verifies a user's identity before granting access to a system. Stolen credentials are a target in their own right, as the search for access keys in the Republik case showed.
On 19 October 2026, the FOCS published "Five steps to secure authentication". In it, the office compares several methods: password, passkey or smart card. It proposes a classification of authentication methods, modes and services according to the security they offer.
Our analysis: an SME benefits from taking stock of its sensitive access points, such as email, e-banking or website administration. It can then choose, for each one, a method stronger than a simple password.
How to prepare the team for phishing?
Phishing consists of tricking a person with a fake message in order to obtain their data or access. Scammers constantly adapt their scenarios, which makes regular awareness training useful.
The FOCS publishes concrete examples every week. On 20 October 2026, it described fake hotel bookings used to take control of TWINT and e-banking accounts. On 13 October 2026, it warned against online shops that display a .ch domain but are based abroad.
Our analysis: data leaks make these messages more credible. A combination of contact details, IBAN and personal data makes it possible to write a highly targeted email. The FOCS's Cyber Security Month 2026 focused, as it happens, on "oversharing", the excessive sharing of information.
This sharing also concerns artificial intelligence (AI) tools. On 16 October 2026, the FOCS pointed out that carelessly entering confidential or business information into an AI can expose that data.
What should a business do if it suffers a cyberattack?
In Switzerland, the affected business remains responsible for managing its incident. "The FOCS acts on a subsidiary basis," explains Roman Hüssy. According to him, GovCERT works "like a fire brigade": first aid and an initial technical assessment.
The process is simple. The business contacts the FOCS via a form or the on-call line. The incident is then classified according to its severity. The office has no power to issue directives: the business itself chooses between a forensic analysis and immediate measures.
A response plan prepared in advance addresses the second mistake cited by Roman Hüssy: outdated contact details, which slow down alerts. The list of people to contact, internally and at service providers, therefore deserves regular updating.
Other steps may follow. The pension fund of the City of Zurich filed a criminal complaint. Republik reported its leak to the Federal Data Protection and Information Commissioner. For malware, on 6 October 2026 the FOCS published the measures to take if an infection is suspected.
What tools does the FOCS offer businesses?
The FOCS is the first point of contact for businesses on cybersecurity in Switzerland. Its website offers a "Businesses and authorities" profile and an "IT specialists" profile.
| FOCS tool | What it does for an SME |
|---|---|
| Voluntary reporting | Report a cyber incident and get help with the next steps |
| 24/7 on-call line | Reach GovCERT during an ongoing incident |
| Vulnerability reporting | Report a flaw; the FOCS assigns it a CVE number |
| Alerts and weekly reviews | Keep track of flaws to fix and current scams |
| Reporting statistics | Measure the threats reported in Switzerland |
Reporting remains optional for an SME. The reporting obligation, in force since 1 April 2025, applies to operators of critical infrastructure.
What our sources do not specify
The FOCS pages and the articles consulted for this page do not set out any rule on offline backups. Nor do they give a typical budget or a checklist specific to SMEs.
Sources
- Federal Office for Cybersecurity
- Cyberattack on pension funds (2clics.com, 16 October 2026)
