SME Cybersecurity 2026’: Cybercrime is becoming a business risk for Swiss SMEs
Four out of five Swiss SMEs expect the threat landscape for businesses to increase as a result of AI. At the same time, the ‘SME Cybersecurity 2026’ study by Mobiliar, which was carried out in collaboration with various partners, shows that whilst many companies are well protected from a technical perspective, there are still gaps in their organisational preparedness.
6 per cent of Swiss SMEs (small and medium sized enterprises) had been affected by a serious cyber incident in the last three years.
7 per cent of Swiss SMEs stated that they had been victims of cyber extortion at some point in the past.
81 per cent of SMEs expect threats to intensify as a result of AI.
25 per cent of SMEs regularly test whether backups can be restored in the event of an emergency.
Cyber security is regaining importance
Following a decline in the previous year, the notion of cyber risks is regaining importance in 2026. Almost one in two SMEs rates cyber security as important or very important. Furthermore, more companies are specifying who is responsible for it. The authors of the study see this as a positive sign: cyber security is increasingly being understood as a management responsibility and no longer exclusively as an IT issue.
It remains crucial to combine technical protective measures with clear lines of responsibility, staff training and contingency plans. Around two in five companies are planning to implement additional security measures over the next three years.
‘The study clearly shows that SMEs with a high level of digital maturity and strong technological innovation also rate their cyber resilience significantly higher. Cyber security therefore does not begin with the firewall, but with a clear digital strategy,’ says Prof. Dr Marc K. Peter, project leader and lecturer at HES-SO Valais-Wallis.
AI is changing the threat landscape
Four out of five SMEs expect the threat posed by AI to increase. It is reasonable to assume that cybercriminals will also use AI for cyberattacks. At the same time, almost half of SMEs are not yet using the technology themselves in their own projects. AI is thus perceived both as an economic opportunity and as an additional area of risk.
“Cybercrime has become a real business risk for Swiss SMEs. AI further exacerbates the threat. Around 35,000 affected SMEs show that cyber protection is just as important today as protection against fire or natural hazards. Cyber security must therefore not be the sole responsibility of the IT department. It belongs at board level and must be part of the corporate strategy. Cyber insurance can mitigate risks, but it is no substitute for personal responsibility,” says Jesús Pampín, Head of the Cyber Risk Competence Centre at Mobiliar.
Well protected technically, but often unprepared organisationally
Swiss SMEs have robust technical safeguards in place. More than 80 per cent carry out software updates, nine out of ten companies create backups, and multi-factor authentication is standard practice in many places.
There is room for improvement when it comes to organisational measures. Only around a third of SMEs conduct regular staff training or systematically inventory their IT systems. Contingency plans, security audits and checks on suppliers’ IT security are still significantly less common. Although backups are widespread, only one in four SMEs tests whether the backed-up data can actually be restored in the event of an emergency.
“Many companies still rely too heavily on basic security measures and neglect organisational contingency planning. It is not enough simply to back up data. SMEs must regularly test whether they can quickly resume operations in the event of a cyber attack,” says Anu Anthamatten, project manager at digitalswitzerland.
Cyber incidents disrupt the entire business
Cyber-attacks do not just cause financial damage. Most frequently, affected companies report significant additional effort required to manage the incidents. It can be assumed that, in addition to the financial impact, there are also time losses and operational disruptions, which place additional strain on employees and managers in particular. The impact was significantly higher for companies with at least ten employees than for smaller businesses.
Cyber incidents do not only affect individual companies. The more incidents are reported and insights shared, the better the cyber situational picture becomes. “Information, prevention and cooperation are key building blocks of a resilient cyber landscape,” summarises Romain Geiser, Programme Manager from the Swiss National Cyber Security Centre (BACS).
The full results of the ‘SME Cybersecurity 2026’ study will be available from 22 October 2026 at www.cyberstudie.ch.
About the study
For the study, a total of 507 managing directors of Swiss SMEs with between 1 and 49 employees were surveyed between 24 June and 10 July 2026. The results are representative of around 614,400 Swiss SMEs across all parts of the country. The sample was collected using quotas based on company size and language region, with a disproportionate selection followed by proportional weighting. The invitation process was based on the YouGov internet panel.
The study was conducted by Mobiliar in collaboration with digitalswitzerland, HES-SO Valais-Wallis, the HWZ Zurich University of Applied Sciences, the Swiss Academy of Engineering Sciences (SATW) and with the support of the Swiss National Cyber Security Centre (BACS).
About the study partners
digitalswitzerland: The umbrella organisation for digitalisation in Switzerland. It brings together the business community, academia, civil society and public authorities, and has over 140 members.
Mobiliar: Switzerland’s oldest private insurance company. It will celebrate its 200th anniversary in 2026 under the motto ‘Better together’. As a cooperative, it is committed to prevention, resilience and a sustainable society.
Swiss Academy of Engineering Sciences (SATW): A leading network of experts in engineering sciences in Switzerland. On behalf of the federal government, the SATW addresses issues relevant to technology policy.
Swiss National Cyber Security Centre (BACS): The federal government’s centre of expertise for cyber security and the first point of contact for business, public administration, educational institutions and the general public on cyber-related issues.
HES-SO Valais-Wallis School of Management: Trains future managers and conducts applied research to support the regional and national economy in its digital transformation.
HWZ Zurich University of Applied Sciences: Switzerland’s largest university of applied sciences specialising exclusively in part-time business studies.
YouGov Switzerland (formerly LINK): Swiss headquarters of the international Data and Analytics Group, which provides opinion research for brand and campaign planning worldwide.