A Swiss SME can carry out an initial cybersecurity test, free and quick, with the Cybersecurity-Check, a tool that grew out of the national strategy and was revised in November 2025. In a few minutes, this self-assessment shows where the company is exposed and where to start. It does not replace a cybersecurity audit, but it helps prepare for one and set priorities.
The need is real: according to Mobiliar's "SME Cybersecurity 2026" study, published in October 2026, many SMEs lack security concepts, emergency plans and audits. This page deals only with the assessment. The protective steps themselves are covered in detail in our guide to SME cybersecurity basics.
Key figures
- The Cybersecurity-Check has existed since 2020; its version 4.0 dates from November 2025.
- It is available in four languages: German, English, French and Italian.
- 6% of the SMEs surveyed suffered a cyberattack with serious consequences over three years, compared with 4% in the 2024 and 2025 editions of the study.
- Among SMEs with at least ten employees, this share reaches as much as 16%.
- 45% of SMEs consider cybersecurity important or very important, compared with 33% in 2025.
- Only 36% believe that protective measures are easy to implement.
What is the Cybersecurity-Check for SMEs?
The Cybersecurity-Check is a self-assessment tool for small and medium-sized enterprises. Its promise fits in one sentence: find out for free, in a few minutes, how well the company is protected against cyber risks, and where it needs to act.
The tool has public origins. Its first version was developed in 2020 as part of the National Strategy for the Protection of Switzerland against Cyber Risks. It was completely overhauled in November 2025, with several partners.
The check can be downloaded from the cybersecurity-check.ch website. Version 4.0 is available in German, English, French and Italian, which makes it usable in all language regions.
What does a cybersecurity test for SMEs measure?
A company cybersecurity check reviews the most common weak points. The Cybersecurity-Check website cites four frequent causes of successful attacks on SMEs:
- insufficiently protected systems and processes;
- outdated software and IT infrastructure;
- deception through social engineering, that is, the manipulation of people;
- insufficient preparation for security incidents.
These four areas match the attacks actually experienced. In the Mobiliar study, the affected SMEs mainly cite phishing, password hacking, malware and attacks on networks and servers. Each of these routes plays a role in about a third of the reported incidents.
Our analysis: a good test is therefore not limited to technology. Two of the four areas concern people and organisation, which is precisely where the study places SMEs' shortcomings.
SME cybersecurity test, check or audit: what is the difference?
The available tools do not answer the same question. The table summarises what our sources say about each one.
| Tool | What it is for | Its limitation |
|---|---|---|
| Cybersecurity-Check | Assessing the level of protection yourself, free of charge, and identifying where action is needed | It relies on the company's own answers |
| Artificial intelligence assistant of the "SME Cybersecurity 2026" study | Answering questions about the study's results and recommendations, based solely on the study's documents | It gives no individual security advice |
| Website of the Federal Office for Cyber Security (NCSC) | Following alerts, reporting an incident or a vulnerability | For an SME, reporting remains voluntary; the obligation has applied to critical infrastructure since 1 April 2025 |
| Cybersecurity audit | An examination that the study cites among the elements SMEs often lack | Our sources specify neither its content nor its cost |
Our analysis: the check serves as a starting point. It provides an initial picture, which the company can then compare with a specialist's view during an audit.
Why does an SME often overestimate its level?
The Mobiliar study describes a gap between perceived resilience and resilience that is actually organised. Nearly half of SMEs consider themselves well informed about the threats that concern them. Many also say they know whom to contact in an emergency.
Yet security concepts, emergency plans and audits are often missing. According to the study, many SMEs judge their resilience on the basis of their personal knowledge rather than organised preparation.
When presenting the study on 22 October 2026, the NCSC summed up the findings as follows: many companies are well protected technically, but still need to make progress organisationally. A structured test makes this gap visible, question by question.
The threats, meanwhile, are evolving. According to the study, 81% of SMEs expect an increase in cyber threats linked to artificial intelligence. Yet only 29% are planning additional measures.
What should you do with the test results?
The result of a test serves first of all to rank the work to be done. Organisational weak points deserve as much attention as technical flaws, since that is where the study places the greatest shortcomings.
On the organisational side, the study stresses the value of clear responsibilities, defined processes and emergency concepts. Marc K. Peter, a professor at the University of Applied Sciences and Arts Western Switzerland (HES-SO), believes that cybersecurity starts with a clear digital strategy, not with the firewall.
On the technical side, updates remain a priority. A dated example: on 21 October 2026, the NCSC recommended immediately installing the patches for two critical vulnerabilities in PHP, which runs on web servers in particular.
Access is another frequent area of work. On 19 October 2026, the NCSC published "Five steps to secure authentication". It proposes a classification of authentication methods, such as passwords, passkeys or smart cards, according to the security they offer.
Finally, a test result may reveal that the company does not know whom to alert. The NCSC receives voluntary reports of cyber incidents from companies and helps them with the next steps. According to the study, 40% of SMEs would be prepared to report an incident of this kind.
The NCSC's Cybersecurity Hub is another resource that is still little used. It is aimed primarily at operators of critical infrastructure and their service providers, but SMEs can join it. According to the study, around 7% of SMEs or their IT service providers use it.
These resources and other concrete measures are gathered in our section on protecting your company.
What we do not yet know
The Cybersecurity-Check presentation page specifies neither the number of questions nor how the result is calculated. Nor do our sources give a price or a standard specification for a cybersecurity audit aimed at an SME.
The Mobiliar study is based on 507 interviews with managers of SMEs with 1 to 49 employees, conducted by YouGov Switzerland from 24 June to 10 July 2026. The results describe what the companies report, not an inspection of their systems.
