What is inside
- Six documented figures – five on the situation in Switzerland, one international on the most common way in
- Why many security promises do not hold – and where the industry's best-known figures really come from
- The five things that are established – from multi-factor sign-in to the reporting duty under data protection law
- The test: four questions for any security figure, before you sign
- The metric that misleads – and the three that describe a state
- A template for monthly measurement and three actions for Monday
- Length
- 10 pages
- Languages
- German, English
- Version
- October 2026
- Sources
- 17
Download the guide
The link arrives by email and stays valid – so you still have the guide to hand later.
A look inside
Four questions every security figure has to answer
The test from Part 4 of the guide. It works for any figure anyone shows you – ours included.
Reported or measured?
Reports are not a survey: 90 % of voluntary reports to the Federal Office for Cyber Security come from the public. Fewer reports do not mean fewer attacks.
Where is the original?
The industry's best-known figures have none. "60 % of small businesses go bust after an attack" has no source, and the "99.9 %" for multi-factor sign-in comes from a marketing text – the measured figure is a 99.2 % reduction in risk.
Which SME is meant?
The Federal Statistical Office counts firms under 250 employees, the Swiss SME study firms with 1 to 49, and a large international report anything under 1,000. Ask who was counted.
Tested or assumed?
87 % of small firms back up their data, 61 % check whether the backup can be restored. A backup that has never been restored is an assumption.
The sources
Where the figures come from
The half-year reports and baseline protection guidance of the Federal Office for Cyber Security, the SME Cybersecurity study by YouGov and FHNW, the Police Crime Statistics, Verizon's Data Breach Investigations Report, field studies on phishing training from ETH Zurich and UC San Diego, Microsoft's MFA measurement, the Data Protection Act, the Information Security Act and the terms of a Swiss cyber insurance policy. The full list with dates and references is on the last page of the guide.
Who it is for
For managing directors and decision-makers in Swiss SMEs who are deciding on IT security, an IT provider or cyber insurance. No specialist knowledge needed, just a willingness to ask where a figure comes from.
All Academy materialThe three metrics, measured in your firm
In 30 minutes we go through your accounts, updates and backups – where MFA is missing, how long an update takes and whether your data can be restored. With numbers, and no sales pressure.