"SME Cybersecurity 2026": Cybercrime is becoming a business risk for Swiss SMEs
Four out of five Swiss SMEs expect the threat landscape for businesses to increase as a result of AI. At the same time, the "SME Cybersecurity 2026" study by Mobiliar, which was carried out in collaboration with various partners, shows that whilst many companies are well protected from a technical perspective, there are still gaps in their organisational preparedness.
Following a decline in the previous year, the notion of cyberrisks is regaining importance in 2026. Almost one in two SMEs rates cyber security as important or very important. Furthermore, more companies are specifying who is responsible for it. The authors of the study see this as a positive sign: cybersecurity is increasingly being understood as a management responsibility and no longer exclusively as an IT issue.
It remains crucial to combine technical protective measures with clear lines of responsibility, staff training and contingency plans. Around two in five companies are planning to implement additional security measures over the next three years.
"The study clearly shows that SMEs with a high level of digital maturity and strong technological innovation also rate their cyberresilience significantly higher. Cybersecurity therefore does not begin with the firewall, but with a clear digital strategy," says Prof. Dr Marc K. Peter, project leader and lecturer at HES-SO Valais-Wallis.
AI is changing the threat landscape
Four out of five SMEs expect the threat posed by AI to increase. It is reasonable to assume that cybercriminals will also use AI for cyberattacks. At the same time, almost half of SMEs are not yet using the technology themselves in their own projects. AI is thus perceived both as an economic opportunity and as an additional area of risk.
"Cybercrime has become a real business risk for Swiss SMEs. AI further exacerbates the threat. Around 35,000 affected SMEs show that cyberprotection is just as important today as protection against fire or natural hazards. Cybersecurity must therefore not be the sole responsibility of the IT department. It belongs at board level and must be part of the corporate strategy. Cyberinsurance can mitigate risks, but it is no substitute for personal responsibility," says Jesús Pampín, Head of the Cyber Risk Competence Centre at Mobiliar.
Well protected technically, but often unprepared organisationally
Swiss SMEs have robust technical safeguards in place. More than 80 per cent carry out software updates, nine out of ten companies create backups, and multi-factor authentication is standard practice in many places.
There is room for improvement when it comes to organisational measures. Only around a third of SMEs conduct regular staff training or systematically inventory their IT systems. Contingency plans, security audits and checks on suppliers’ IT security are still significantly less common. Although backups are widespread, only one in four SMEs tests whether the backed-up data can actually be restored in the event of an emergency.
"Many companies still rely too heavily on basic security measures and neglect organisational contingency planning. It is not enough simply to back up data. SMEs must regularly test whether they can quickly resume operations in the event of a cyberattack," says Anu Anthamatten, project manager at digitalswitzerland.
Cyberincidents disrupt the entire business
Cyberattacks do not just cause financial damage. Most frequently, affected companies report significant additional effort required to manage the incidents. It can be assumed that, in addition to the financial impact, there are also time losses and operational disruptions, which place additional strain on employees and managers in particular. The impact was significantly higher for companies with at least ten employees than for smaller businesses.
Cyberincidents do not only affect individual companies. The more incidents are reported and insights shared, the better the cybersituational picture becomes. "Information, prevention and cooperation are key building blocks of a resilient cyberlandscape," summarises Romain Geiser, Programme Manager from the National Cyber Security Centre (NCSC).
The full results of the "SME Cybersecurity 2026" study will be available at www.cyberstudie.ch.