Many small and medium-sized enterprises assume that they are too insignificant for cybercriminals. At first glance, the idea sounds plausible: in an SME, customer projects, HR issues, delivery dates and operational decisions take centre stage. In this environment, cybersecurity quickly seems like a topic for corporations, banks or international organisations.

But this very assumption is risky. Today, many cyber attacks do not begin with a deliberate decision to target a particular company, but are automated. Systems scan the internet around the clock for open access points, weak passwords, outdated software, unpatched servers, insecure VPN access or missing multi-factor authentication. For attackers, what counts is not primarily how well known a company is. What matters is whether getting in looks easy enough.

That is precisely why SMEs are also targeted. Not necessarily because they are particularly prominent, but because they often carry the same digital risks as larger companies while having fewer resources available for protection, monitoring and ongoing maintenance.

Cyber attacks on SMEs are no longer the exception

Cyber attacks are now part of business risk. This applies not only to large companies, but equally to small and medium-sized businesses. The Swiss Federal Office for Cybersecurity (NCSC/BACS) received over 35,000 reports of cyber incidents in the first half of 2025 alone. At the same time, according to the Swiss SME Cybersecurity Study 2025, only around one in two to three SMEs feels really well prepared for a cyber attack.

These figures show that the question is no longer just whether a company is interesting enough for attackers. More important is how easy it would be to break into that company. Many attacks are automated. Attackers do not manually search for individual firms and then decide which company to attack. Instead, technical vulnerabilities are searched for on a large scale, such as open VPN access, unpatched systems, outdated firewalls, insecurely configured Wi-Fi networks or poorly maintained network devices such as printers, NAS systems or routers.

As soon as such a vulnerability becomes visible, an unknown SME can become a potential target. Company size plays a smaller role than many people believe. What matters is not whether a company is well known, but whether it appears vulnerable.

Why SMEs are attractive to attackers

Many SMEs face similar digital risks in their day-to-day business as large organisations, but have significantly fewer internal resources. IT is often run alongside day-to-day business, security projects are postponed and updates are installed when there is time. Responsibilities are not always clearly defined, IT environments have grown over the years, old accounts remain in place and access rights are not reviewed regularly. Backups often exist, but have not always been properly tested.

From an attacker’s point of view, such conditions are attractive. A company does not have to be internationally known to have valuable information. Smaller businesses also work with customer data, contracts, financial information, internal documents, credentials, email accounts, supplier portals and business partners. All this information has value and can be misused for extortion, fraud or further attacks.

However, cyber attacks are not just about data. For many companies, another question is at least as decisive: what does it cost when operations come to a standstill? A single day without access to emails, customer data, project documents or production systems can already have significant consequences. A week of downtime can delay orders, block employees, strain customer relationships and jeopardise delivery dates.

This is often where the real damage occurs. Not every company has data of international interest, but almost every company has processes whose failure becomes expensive. For SMEs, this dependency can be particularly critical because financial, personnel and organisational reserves are often more limited than in large companies.

An attack often begins inconspicuously

A cyber attack rarely begins spectacularly. In reality, there is usually no dramatic warning message and no immediately visible disaster. Often it all starts with a phishing email, a file from a seemingly trustworthy source, a compromised password, a user account without multi-factor authentication or a device that has not been updated for months.

Such situations seem harmless at first, but that is exactly why they are dangerous. In many cases, a single entry point is enough to give attackers access to further systems. From there, they move on, check permissions, look for stored passwords and gain access to emails, files, servers or backup systems.

Most companies do not notice the attack at first. Only later does it become apparent what has happened: systems are encrypted, customer data is missing, employees cannot work, production facilities come to a standstill or email accounts are misused. Suppliers or customers can also be affected if fake messages are sent in the company’s name.

At that point at the latest, cybersecurity is no longer purely an IT issue. A security incident becomes a business-critical emergency that simultaneously affects management decisions, communication with customers, operational processes and financial stability.

Why a single incident is particularly dangerous for SMEs

Large companies often have specialised security teams, crisis processes, external incident response partners, emergency plans and larger budgets. Many SMEs do not have these reserves to a comparable extent. When an attack happens, it therefore often hits ongoing operations directly.

In this situation, management has to make decisions while important information is missing. Employees improvise, customers ask questions, suppliers wait for answers and IT tries at the same time to understand the incident, limit the damage and restore operations. It becomes particularly critical when backups are missing, outdated or themselves affected because they are located in the same infrastructure.

A technical incident can then quickly turn into a crisis lasting several weeks. A single day of downtime is annoying, a week of downtime is expensive, and several weeks of restricted operations can have existence-threatening consequences for an SME. That is exactly why it is not enough to treat IT security as an add-on topic to be tackled when time, budget or pressure allow.

Attackers do not wait for the next budget window

In many companies, IT security is improved when there happens to be capacity for it. That might be after a completed project, in the next budget window or when external pressure increases. This approach is understandable from a human perspective, but dangerous from a security point of view.

Attackers do not wait for internal priorities. They do not wait until a company is ready, but search continuously for vulnerabilities. When an open gap is found, it can be exploited regardless of whether a security project was being planned internally or not.

Artificial intelligence also makes certain attacks easier to scale. Phishing emails can be better worded, more credibly translated and more strongly personalised. Social engineering attacks appear more professional, and technical vulnerabilities can be analysed and prioritised more quickly. This does not mean that every SME will immediately become the target of a highly complex attack. But it does mean that simple security gaps can be exploited faster and on a larger scale.

IT security is not a one-off project

Many companies view IT security as a completed project. You introduce a solution, draw up a concept, install a firewall, set up backups, buy a password manager or run a training session. After that, the topic is often considered done.

However, security does not work as a one-time state. A firewall may be correctly configured today and become a risk tomorrow due to a new vulnerability. A user account may be necessary today and forgotten in six months. A device may seem secure today and later contain outdated software. An employee may be trained today and receive a perfectly worded phishing email tomorrow.

This idea is particularly important for SMEs. It is not about doing everything perfectly or building an overly complicated security model. What matters is consistently implementing the most important basics and reviewing them regularly. Security is ongoing maintenance, not a tick on a project list.

Which basics are particularly important for SMEs

Effective IT security does not have to start out complicated. For many SMEs, a significantly better level of security is already achieved when central basics are properly implemented. These include multi-factor authentication for important accounts and external access, professional password management instead of passwords in emails, Excel lists or browsers, and regular updates for servers, work devices, firewalls, routers, printers and other network devices.

Equally important are clear access rights based on the principle of “as much as necessary, as little as possible”, clean backup and recovery processes, secure Wi-Fi configurations and a clear separation of guest networks or insecure devices. Companies should also know who can access which systems and data, and regularly raise employees’ awareness of phishing, fraud and insecure workarounds.

It is not perfection that counts, but consistent implementation. Many security gaps do not arise because protective measures are unknown, but because they are not properly maintained, checked or enforced in everyday business.

The real challenge lies in continuity

Many SMEs basically know which measures would be important. The problem is rarely a lack of awareness, but implementation during ongoing operations. In everyday business, there is often a lack of time, responsibilities are unclear, internal IT is already working at full capacity, or external service providers only take care of individual topics without keeping the overall picture in view over time.

This is not unusual. However, it is important not to leave this responsibility to chance. If time, resources or specialist knowledge are lacking internally, IT security should be maintained continuously with a reliable partner. The key is that security is not only considered after an incident, but remains an ongoing part of corporate management.

Real security does not come from a single piece of software, a one-off project or a policy that nobody checks. It comes from clear processes, regular reviews and pragmatic measures that fit the company’s day-to-day operations.

Conclusion: The most dangerous assumption is not “We are too small”

The most dangerous assumption is not that a company might be too small. More dangerous is the thought that nothing will happen anyway. Often a single vulnerability is enough to trigger days or weeks of chaos, downtime and financial damage. In the worst case, such an incident can have existence-threatening consequences for an SME.

Anyone who wants to protect their company does not have to do everything themselves. But they should make sure that someone takes care of it consistently. That is exactly where sensible IT security begins: pragmatic, understandable and continuous.