Only 1 percent of Swiss SMEs are optimally protected against cyber attacks

Whether phishing, ransomware or AI-based attacks on company networks, the threat situation is intensifying. SMEs are particularly affected, as they often lack the resources for comprehensive IT security measures. Many companies also underestimate the likelihood of falling victim to a cyberattack themselves.

Practical experience shows that many Swiss companies have already been affected by attacks: 36% of SMEs surveyed for Cisco report cyberattacks, while the figure for larger companies is as high as 58%. Despite the high level of attack experience, only 1% of SMEs in Switzerland have the best possible protection status.

"SMEs in particular must no longer postpone the issue of cyber security. A minimum level of protective measures is not enough to withstand complex attack methods such as AI-based attacks on company networks. SMEs also need a good level of cyber protection, otherwise there is a risk of business failures, loss of customer trust, possible lawsuits and, in extreme cases, company bankruptcy," says Christopher Tighe, General Manager Cisco Switzerland.

SMEs invest significantly less than large companies

A meagre 11% of Swiss SMEs are in the second-best defense category and therefore have a good level of protection. This means that a total of 12% in Switzerland are at least well protected. Among large companies, this applies to 26% - more than twice as many.

Even more alarming: only 28% of SMEs are planning to comprehensively modernize their IT infrastructure in the next one to two years. The figure for large companies is 45 percent. There are particularly large differences in investment planning for new security solutions (37% SMEs vs. 55% larger companies), for investments in AI-based systems (33% SMEs vs. 51% larger companies) and for new automation solutions in the security sector (26% SMEs vs. 40% larger companies).

A look back also shows a noticeable difference in financing: budgets for cybersecurity have increased significantly in the last one to two years for 14% of the SMEs surveyed, while 42% of representatives of large companies say the same.

Deceptive security for SMEs

Despite their comparatively weak defenses, SMEs are surprisingly confident: 96% consider their current IT infrastructure to be sufficient to protect them against cyberattacks in the near future. "The individually perceived security of Swiss SMEs is a fallacy. Many underestimate the dynamics and professionalism of today's cyber attacks. If you don't upgrade now, you risk serious damage from successful attacks," emphasizes Tighe.

There is also a structural problem: the shortage of IT specialists affects 80% of SMEs in Switzerland. Large companies make a similar assessment, with 86 percent agreeing. In addition, both groups of companies are struggling with the increasing complexity of their IT security infrastructure: 48% of SMEs already use 11 to 40 different security solutions, 18% even up to 70. Three out of four companies see this as a clear impairment of their ability to defend themselves.

8000 decision-makers surveyed

For the Cybersecurity Readiness Index 2025, 8,000 cybersecurity decision-makers were surveyed worldwide, 203 of them in Switzerland. Companies with fewer than 250 employees are counted as SMEs in this analysis. 90 Swiss experts and decision-makers from this group took part in the survey. 113 experts and decision-makers from large companies with more than 250 employees form the comparison group. The survey was conducted worldwide from January to February 2025 by a survey institute on behalf of Cisco. For Cybersecurity Awareness Month in October, Cisco analyzed the data in Switzerland once again with a focus on SMEs.