Swiss SMEs are underestimating the business threat from cyberattacks

Cyber incidents have ranked as the world’s top corporate risk for five consecutive years. Swiss small and medium-sized enterprises are still treating many of these threats as someone else’s problem, according to a study by VZ VermögensZentrum and the Lucerne University of Applied Sciences and Arts.

The warning arrives as cyber risks move well beyond the IT department. An attack can interrupt production or sales, corrupt data, damage systems, unsettle customers and trigger legal obligations. It can also put immediate pressure on liquidity if a company must restore operations, replace equipment or absorb lost revenue. For a smaller firm with limited reserves, a prolonged interruption can threaten its ability to continue trading.

The study says many SMEs assume they are unlikely to be affected. That assumption leaves companies exposed because digital systems now support routine work across nearly every sector, from customer records and accounting to logistics and communications. A firm does not need to be a technology business to depend on technology.

The global scale is clear. Cybercrime caused estimated costs of $9.5 trillion, or CHF 7.88 trillion, in 2024, a figure that would make it the world’s third-largest economy if cybercrime were a country.

Swiss authorities recorded just under 58,000 offences involving digital methods in 2025. The figure does not capture the full scale of the problem, because the study points to a high number of unreported cases. The clearance rate was 17.6%, leaving many victims without a clear resolution.

For SMEs, under-reporting can begin with uncertainty. A company may not know whether a suspicious payment request, locked account or missing file represents a criminal act, a technical failure or an internal mistake. Some businesses may also hesitate to disclose an incident because they fear reputational damage or disruption to customer relationships.

That uncertainty carries practical costs. A company that does not record what happened may struggle to identify its digital dependencies, notify affected parties or demonstrate that it responded responsibly. It may also lose valuable information that could help investigators connect cases.

The study does not present crime statistics as a complete measure of exposure. They are one visible part of a wider risk landscape that includes attempted attacks, incidents discovered late and cases that never reach the authorities. For smaller firms, the first task is therefore basic but important: establish who is responsible for recognising, documenting and escalating a cyber incident.

An SME needs to know which digital systems keep the business alive before one of them fails. The VZ VermögensZentrum and HSLU study says companies can manage cyber risks more effectively by mapping their digital dependencies and assigning clear responsibilities.

That exercise should reach beyond servers and software. A company may depend on an external provider for payments, cloud storage, customer communications, payroll or production planning. It may rely on one employee who knows how systems work, or on a supplier whose access has never been reviewed. Each dependency creates a possible point of interruption and a decision that must be made during a crisis.

The study urges SMEs to prepare contingency plans and assess the financial consequences of different incidents. That means estimating the cost of downtime, data restoration, specialist support, customer communication and possible legal duties. It also means deciding which risks the business will avoid, reduce, retain or transfer through insurance.

Technical warnings become useful only when management can connect them to operations and finances. A disabled system is an IT problem. A week without orders, invoices or deliveries is a business problem. SMEs need plans that address both.

Fewer than 12% of Swiss companies currently have cyber insurance. The study identifies the complexity of insurance products as one reason SMEs may find cover difficult to compare. It also stresses that insurance cannot replace prevention or effective risk management.

For an owner, the decision involves more than choosing a policy from a list. Coverage may need to reflect interruption losses, data recovery, legal expenses, notification duties and support from external specialists. The value of that cover depends on the company’s systems, contracts, customers and ability to absorb a prolonged outage. A policy that does not match those realities can create false confidence.

Insurance also works after the company has taken basic precautions. Providers may examine access controls, backups, incident procedures and staff responsibilities before offering cover or settling a claim. Those requirements can help an SME identify weaknesses, but they do not remove the need for an internal plan.

The study’s message is practical: first understand the exposure, then decide what to prevent, reduce, retain or insure. For many firms, that process may reveal that a modest investment in preparation protects cash flow more directly than a policy considered in isolation.

The survival of an SME can depend on decisions made before an incident begins. The study by VZ VermögensZentrum and HSLU calls on companies to turn cyber risk into a management issue with named responsibilities, tested contingency plans and clear financial calculations.

That approach matters across Switzerland, where many smaller firms operate with lean teams and close relationships with customers and suppliers. A disruption can quickly affect orders, wages, deliveries and confidence. Even when systems return, damaged data or unclear legal duties may prolong the consequences.

The immediate priorities are straightforward. Management should identify critical systems and external providers, determine who leads during an incident, maintain workable recovery arrangements and calculate the cost of downtime. Staff also need a route for reporting suspicious activity before a small warning becomes a major interruption. Companies should review those arrangements rather than leaving them in a folder that nobody has opened.

The available figures show why delay is costly. Switzerland recorded nearly 58,000 digitally enabled offences in 2025, while fewer than 12% of companies had cyber insurance. Preparation will not eliminate attacks, and insurance will not restore every lost relationship. Both belong within a wider risk plan that treats digital resilience as part of ordinary business continuity.