Swiss SMEs Underestimate Cyber Risks: SME Cyber Risk Study 2026 (Deloitte)

Summary

• 49 per cent of the SME employees surveyed experienced a serious cyber incident at work in the last three months, but only 22 per cent consider their company's cyber risk to be high.p.1
• Among micro-enterprises, 38 per cent report serious cyber incidents while only 15 per cent rate the risk of a cyber-attack as high.p.1
• Deloitte's SME Cyber-security Index stands at 58 out of 100 points.p.2
• Only 45 per cent of companies have introduced passwordless authentication, and multi-factor authentication stands at 66 per cent.p.2
• 87 per cent of respondents are in favour of more extensive cyber-security regulations, but only 19 per cent would prefer stricter, purely state-imposed regulations.p.3
• The study is based on a representative online survey of 924 employees working for Swiss companies with up to 249 employees.p.3

Key insights

1. 88 per cent of respondents whose companies use email alerts consider them useful.p.2
2. Cyber insurance remains uncommon among small businesses in particular.p.1
3. AI is making cyber-attacks faster and more scalable, and many Swiss SMEs are inadequately protected and underinsured.p.1
4. Phishing, compromised login details and manipulated payment processes can have a severe impact even on small businesses.p.2
5. The index shows that on average only 58 per cent of the surveyed security measures have been implemented.p.2