Cybersecurity for Swiss SMEs
We assess and secure websites, shops, cloud systems and custom software. From critical updates to controlled AI access and tested recovery.
Clear scope. Prioritised actions. Technical implementation.
People · Accounts · Permissions
Software · Cloud · APIs · AI
Data · Monitoring · Recovery
Limit access and put targeted safeguards around sensitive information.
Fix vulnerabilities and prepare for recovery.
Document actions, responsibilities and evidence.
Our services
We look at the connections between people, applications and data. You get practical measures we implement with your team or IT partner.
Outdated components, insecure logins or missing access controls can expose customer data and business processes.
We review code, roles and integrations, upgrade runtimes and frameworks, and test critical workflows after changes. Across PHP, Node.js, Python and other stacks.
Prioritised findings, verified fixes and documented software versions.
Phishing, stolen sessions and overprivileged accounts can open a path into other systems.
We review Microsoft 365 and other accounts, MFA or passkeys, administrator rights and sharing. Together we define clear processes for sensitive requests and account changes.
Clear permissions, stronger authentication and managed onboarding and offboarding.
Public storage, exposed services, misconfigurations and unprotected API keys increase your attack surface.
We review cloud and server configurations, network boundaries, secrets and access logs. This includes secure deployments, hardening and agreed protection rules.
Restricted access paths and documented configurations for your environment.
Ransomware, data loss or a failed service can interrupt operations. Having a backup does not prove that a restore will work.
We review isolated or immutable backups, test restoration, and agree on alert routes and a process for security incidents.
Tested recovery with agreed recovery objectives and named owners.
Manipulated documents or prompts, overprivileged agents and uncontrolled data flows can put confidential information and actions at risk.
We limit data and tool access, isolate untrusted content, and assess approvals, logging and provider integrations. Including MCP and custom AI applications.
Tested access boundaries and human approval for sensitive actions.
Dependencies, plugins and compromised build access can introduce risks into your own software.
We inventory components and lifecycles, review CI/CD permissions and secrets, and establish a clear process for security advisories and dependency updates.
A component inventory, clear update ownership and controlled releases.
From findings to fixes
We first agree on systems, access and assessment boundaries. We then prioritise effort and changes based on the risks to your business.
Map applications, data, access and existing safeguards together.
System overview & assessment scopeAssess findings by impact, exposure and urgency.
Action plan with named ownersUpdate software, code and configurations with approvals, tests and a rollback plan.
Verified changes & evidenceAgree on monitoring, maintenance windows, restore tests and response times.
Ongoing support within an agreed scopeA new PHP, Node.js or framework version can require changes to extensions, APIs and custom code. We combine security measures with engineering so the upgrade fits your application.
Today & ahead
We distinguish established attack paths from expected developments. What matters is which ones are relevant to your systems and data.
The UK NCSC expects more efficient AI-assisted attacks through 2027. Connected AI systems also expand the attack surface.
Useful now: faster patching, limited agent permissions and approvals for sensitive actions.
NCSC: outlook to 2027CRA reporting obligations for covered digital products in the EU market apply from 11 September 2026; the main obligations follow on 11 December 2027. Scope depends on the product and provider role.
Useful now: prepare a component inventory, support periods and a vulnerability handling process.
EU: Cyber Resilience ActPost-quantum cryptography requires a migration plan. It is especially relevant to data that must remain confidential for years and systems that are hard to replace.
Useful now: inventory cryptography and data lifetimes, check vendor roadmaps and prioritise changes.
BACS: quantum computing & cryptographyData protection & ownership
Access controls, data minimisation, logs and tested procedures help protect personal data. When an incident occurs, risks, responsibilities and potential notification duties need to be assessed promptly.
Data security breaches likely to result in a high risk to affected individuals must be reported to the FDPIC as soon as possible. We support technical investigation and documentation.
FDPIC guidanceReportable personal data breaches generally have a 72-hour notification deadline after awareness. Risk assessment and possible communication to affected people are part of a prepared response process.
EDPB guidanceWe provide technical measures and evidence. Where needed, we coordinate legal interpretation with your data protection or legal adviser.
FAQ
We assess the agreed applications and their environment: for example PHP, Node.js, Python, CMS, e-commerce, APIs, cloud and Microsoft 365. We determine which checks are useful based on your actual systems and data.
We review supported versions, extensions and custom code. If a direct upgrade is not possible, we plan a clear migration path and, where appropriate, a vendor-confirmed interim fix. After the change, we verify security fixes and critical business workflows.
Yes. We coordinate access, responsibilities and changes with your hosting, IT or software partner. Active security tests are performed only within a scope agreed and authorised in advance.
We first clarify affected systems and contacts, coordinate the next technical steps, and review available evidence. Where needed, we involve specialist incident response or forensic partners. Availability and response times are agreed at first contact.
You can start with a defined security assessment, commission specific fixes as a project, or arrange ongoing support. After reviewing the environment, we provide a proposal with scope, deliverables and responsibilities.
We agree on verifiable measures and document results and remaining risks. Any additional technical, organisational or legal requirements are assessed for your business and the agreed scope.
Your next step
We discuss your systems, urgent concerns and the right first step: a security assessment, targeted fixes or ongoing support.
Swiss point of contact · Working with your IT team
Discuss urgent security needs by phoneResearch and content reviewed: 21 October 2026