Swiss SMEs are underestimating the business threat from cyberattacks

Cyber incidents have ranked as the world’s top corporate risk for five consecutive years. Swiss small and medium-sized enterprises are still treating many of these threats as someone else’s problem, according to a study by VZ VermögensZentrum and the Lucerne University of Applied Sciences and Arts.

The warning arrives as cyber risks move well beyond the IT department. An attack can interrupt production or sales, corrupt data, damage systems, unsettle customers and trigger legal obligations. It can also put immediate pressure on liquidity if a company must restore operations, replace equipment or absorb lost revenue. For a smaller firm with limited reserves, a prolonged interruption can threaten its ability to continue trading.

The study says many SMEs assume they are unlikely to be affected. That assumption leaves companies exposed because digital systems now support routine work across nearly every sector, from customer records and accounting to logistics and communications. A firm does not need to be a technology business to depend on technology.

The global scale is clear. Cybercrime caused estimated costs of $9.5 trillion, or CHF 7.88 trillion, in 2024, a figure that would make it the world’s third-largest economy if cybercrime were a country.

Swiss authorities recorded just under 58,000 offences involving digital methods in 2025. The figure does not capture the full scale of the problem, because the study points to a high number of unreported cases. The clearance rate was 17.6%, leaving many victims without a clear resolution.

For SMEs, under-reporting can begin with uncertainty. A company may not know whether a suspicious payment request, locked account or missing file represents a criminal act, a technical failure or an internal mistake. Some businesses may also hesitate to disclose an incident because they fear reputational damage or disruption to customer relationships.

That uncertainty carries practical costs. A company that does not record what happened may struggle to identify its digital dependencies, notify affected parties or demonstrate that it responded responsibly. It may also lose valuable information that could help investigators connect cases.

The study does not present crime statistics as a complete measure of exposure. They are one visible part of a wider risk landscape that includes attempted attacks, incidents discovered late and cases that never reach the authorities. For smaller firms, the first task is therefore basic but important: establish who is responsible for recognising, documenting and escalating a cyber incident.

An SME needs to know which digital systems keep the business alive before one of them fails. The VZ VermögensZentrum and HSLU study says companies can manage cyber risks more effectively by mapping their digital dependencies and assigning clear responsibilities.

That exercise should reach beyond servers and software. A company may depend on an external provider for payments, cloud storage, customer communications, payroll or production planning. It may rely on one employee who knows how systems work, or on a supplier whose access has never been reviewed. Each dependency creates a possible point of interruption and a decision that must be made during a crisis.

The study urges SMEs to prepare contingency plans and assess the financial consequences of different incidents. That means estimating the cost of downtime, data restoration, specialist support, customer communication and possible legal duties. It also means deciding which risks the business will avoid, reduce, retain or transfer through insurance.

Technical warnings become useful only when management can connect them to operations and finances. A disabled system is an IT problem. A week without orders, invoices or deliveries is a business problem. SMEs need plans that address both.