According to a study, cyber risks are underestimated by many SMEs
Keystone-SDA
Cyber risks are now among the key business risks facing small-and-medium enterprises (SMEs). However, many companies still assume that they are not affected.
This assumption is dangerous, according to the findings of a study published on Monday by VZ VermögensZentrum in collaboration with the Lucerne University of Applied Sciences and Arts (HSLU). This is because the consequences of cyber risks extend far beyond IT.
For instance, cyber risks could disrupt operations, damage data and systems, strain customer relationships, trigger legal obligations or place a heavy strain on a company’s liquidity. In the worst-case scenario, the very survival of an SME is at stake.
+ Switzerland juggles fighting crime against threat to tech-privacy industry
In the study, VermögensZentrum refers to the “Allianz Risk Barometer 2026”, which has ranked cyber incidents as the number one corporate risk globally for the fifth year running. The estimated global costs caused by cybercrime are around $9.5 trillion (CHF7.88 trillion) for 2024. If cybercrime were an economy, it would be the third largest in the world after the US and China.
Offences and unreported cases
According to the VermögensZentrum, crime statistics for Switzerland recorded just under 58,000 offences involving digital methods in 2025 alone. Added to this is a high number of unreported cases. The clearance rate stood at just 17.6%.
The study also sought to find out how well SMEs can correctly understand, categorise and insure against cyber risks as part of an effective risk management system.
It found that companies could manage these risks more effectively if they had a better understanding of their digital dependencies. To minimise risks, companies should clarify responsibilities, prepare contingency plans and carefully assess the financial consequences.
It’s crucial that SMEs are able to translate technical incidents into operational, financial and strategic consequences. This enables them to assess which risks they should avoid, reduce, bear themselves or insure against.
Cyber insurance is a key component of this. However, according to the study, it is no substitute for prevention or effective risk management. Less than 12% of Swiss companies currently have cyber insurance. One reason could be that cyber insurance is complex and often difficult for SMEs to compare, writes the study authors.
+ How we produce news in English
Translated from German, reviewed by an English Department journalist.
