Half of Employees at Swiss Small Businesses Experienced a Serious Cyber Incident Within Three Months

On August 20, Deloitte published the results of a representative survey of employees at Swiss small and medium-sized enterprises. The findings suggest that the biggest problem may not be a lack of information about cyberattacks, but the gap between actual experience and the way companies assess their own risk. Nearly half of respondents, exactly 49 percent, had experienced a serious cyber incident at work during the previous three months. Only 22 percent of employees, however, consider their company's cyber risk to be high. According to Deloitte, the gap is most pronounced among microbusinesses with one to nine employees. Companies may therefore have direct experience with phishing, fraud, account compromise, or another security event while still failing to treat systematic security as a major investment priority. AI makes this mismatch worse. Deloitte points out that it allows attackers to create and modify fraudulent messages more quickly, make them more convincing, and conduct a larger number of attempts. For a small company, the cost ratio is particularly problematic. An attacker can automate a substantial part of the preparation, while the defender still needs a specific person to update devices, review access rights, train employees, and handle incidents. A smaller company also has less resilience during an outage. Several days without access to accounting, orders, or a production system can directly stop invoicing and cash flow. Compromise of an executive's account may also open access to additional services because smaller companies more often concentrate permissions in a small number of people. Cyber risk therefore cannot be assessed only by the probability of an attack, but also by the company's ability to continue operating after an attack succeeds. Deloitte also points to insufficient insurance coverage, particularly among the smallest businesses. Insurance does not replace security, and insurers may require basic protective measures. Even so, it can transfer part of the exceptional costs, such as specialist support, data recovery, or legal services. Management should therefore assess technical controls, recovery, and insurance together. The practical minimum remains multifactor authentication, regular updates, separate backups, restrictions on administrator privileges, and a predefined incident-response procedure. AI does not change these fundamentals. It does, however, change the economics of attack: an adversary can test more avenues more cheaply and quickly. A company that previously considered some controls excessive because of its small size therefore needs to recalculate that assumption. Terms to explain Multifactor authentication: A login method that requires an additional independent proof of identity beyond a password. Cyber resilience: A company's ability to withstand an attack, limit its impact, and restore critical activities. Cyber insurance: Insurance coverage for part of the financial impact associated with a security incident.

Half of Employees at Swiss Small Businesses Experienced a Serious Cyber Incident Within Three Months

The full article is available to users registered at Hard Skills