“SME Cybersecurity 2026” study: strong technical protection, weak organisational preparation

On 22 October 2026 the study “SME Cybersecurity 2026” was published. It was carried out by Swiss insurer Mobiliar together with the National Cyber Security Centre (NCSC), digitalswitzerland, HES-SO Valais-Wallis, the HWZ University of Applied Sciences in Business Administration Zurich and SATW. The core message, as summarised by the NCSC: many small Swiss companies are well protected technically, but gaps remain in organisational preparation. In other words, the backups exist, but often nobody has ever tried to restore them.

Below are the study's key figures and a practical checklist for SMEs that want to see where they stand.

The study at a glance

On behalf of Mobiliar, YouGov Schweiz interviewed 507 managers of Swiss SMEs with 1 to 49 employees between 24 June and 10 July 2026. According to the authors, the results are representative of around 614,400 SMEs. The study has been published every year since 2020; the full report in English and a web version are available at cyberstudie.ch.

• 88% of SMEs regard cybercrime as a serious problem.
• 46% consider cybersecurity important or very important, up from 33% in 2025.
• 6% suffered a cyberattack with serious consequences in the past three years: extrapolated, more than 35,000 SMEs in Switzerland. Among companies with at least ten employees the share reaches up to 16%.
• Around 7% have already been extorted by cybercriminals, equivalent to about 45,000 SMEs.
• Cybercrime is named by 23% as one of the biggest strategic risks, on a par with inflation and rising costs and with the shortage of skilled workers.

What SMEs already do well

Basic technical measures are widespread. According to the study, 83% of SMEs update their software regularly, many use and update a firewall and 55% have introduced two-factor or multi-factor authentication. Nine out of ten companies make regular backups; only 4% make none. Around three quarters of companies with backups store the data in Switzerland.

More advanced measures are rare: only 35% use a VPN for external access and 15% segment their network. Traffic monitoring and AI-based protection are also uncommon.

Where the gaps remain

The shortcomings are mainly organisational:

• only 27% of SMEs with backups regularly test restoring their data;
• only 31% train their staff on cyber risks regularly;
• about one third keep a systematic inventory of IT systems, devices, software and cloud services;
• 28% have an emergency or business continuity plan, 28% a documented security concept and 28% assess the IT security of their suppliers;
• only 15% carry out security audits.

The study also points to a contradiction: 52% of SMEs rate the risk of an attack causing at least one day of business interruption in the next two to three years as rather low. The answers of affected companies also show that the most frequent damage is not financial loss but the large amount of work needed to get systems running again, followed by the emotional strain. Around two in five companies plan to strengthen their security measures in the next three years.

Artificial intelligence and the threat landscape

81% of SMEs expect the cyber threat to keep growing because of AI. At the same time, almost half of the companies surveyed have not yet started any AI projects. During Cyber Security Month in October 2026, the NCSC and the Federal Data Protection and Information Commissioner (FDPIC) published recommendations on using AI in everyday work: do not enter personal data, customer data or trade secrets into AI services without anonymising them, prefer business or enterprise versions to private accounts, and check whether your inputs are used for training.

Checklist for an SME

The following list draws on the areas of the study's checklist, reduced to steps a small company can take within a few weeks:

1. Responsibility: decide who in the company looks after IT security and who decides in an incident, even if it is a part-time task or handled by an external partner.
2. Inventory: list computers, phones, website, domains, mailboxes, cloud services and software, with the name of whoever manages each.
3. Restore test: at least once a quarter, restore a file, a mailbox or the website from a backup and note how long it takes.
4. Logins: enable multi-factor authentication or passkeys for email, cloud and website administration; login security levels are described in our article on the NCSC's five levels.
5. Updates: include the website and the server; a recent example is the PHP vulnerabilities of October 2026.
6. Training: a short session once a year on phishing, fake invoices and the use of AI services.
7. Emergency plan: one page with contacts (IT provider, hosting, insurer, bank), first steps and criteria for reporting the incident to the NCSC.
8. Suppliers: ask whoever runs your website, hosting and software how they handle backups and updates and where the data is stored.

How ElaraTeq Sagl works

ElaraTeq Sagl runs websites and applications for SMEs and public bodies in Ticino with hosting in Switzerland, regular backups and updates. On request we check that restoring your website actually works and document the steps to follow in case of failure. For a check, contact us.

Sources

• NCSC, “SME Cybersecurity 2026: Cybercrime is becoming a business risk for Swiss SMEs”, 22 October 2026: bacs.admin.ch
• Mobiliar and partners, “SME Cybersecurity 2026”, PDF report: cyberstudie.ch; web results and checklist: cyberstudie.ch
• Die Mobiliar, “Cyberstudie 2026” (in German): mobiliar.ch
• inside-it.ch, “Schweizer KMU technisch geschützt vor Cyberangriffen”, 22 October 2026: inside-it.ch
• NCSC and FDPIC, “AI in our everyday working lives: Making the most of the opportunities, protecting our data”, 16 October 2026: bacs.admin.ch