Cyber Risks in SMEs: Understanding, Assessing, and Insuring Against Them

It’s a typical Friday morning, 7:42 a.m.: At a manufacturing plant with 160 employees that serves international customers in the aerospace, automotive, and medical technology industries, the CNC machines are starting up, and an AI is inspecting the first titanium components. No one suspects yet that an attacker already knows the exact tolerance values for the aerospace orders. He didn’t steal them—the company’s own AI assistant provided them to him upon request.

The company is called AlpPrecision AG and is fictional. The scenario described, however, is very real. Using this case study, the report «Cyber Risks for SMEs,» published jointly by the Lucerne University of Applied Sciences and Arts (HSLU) and VZ VermögensZentrum in October 2026, illustrates how cyberattacks unfold today and what they can mean for small and medium-sized enterprises. The key message: Cyber risks cannot be completely avoided, but they can be managed.

Awareness does not (yet) reflect the threat level

According to the 2026 Allianz Risk Barometer, cyber incidents rank first among corporate risks worldwide for the fifth consecutive year. In Switzerland, too, they are considered the most significant business risk. In 2025, police crime statistics recorded nearly 58,000 crimes involving digital methods. Only 17.6 percent were solved, and the number of unreported cases is likely to be high.

The Federal Office for Cybersecurity (BACS), meanwhile, received nearly 65,000 voluntary reports in 2025. Fraud is the most common type of incident, accounting for about 39 percent of cases. At the same time, according to BACS, attacks are becoming more targeted and technically sophisticated.

All of this should be warning enough. Nevertheless, many small and medium-sized enterprises (SMEs) underestimate their risk. According to a Deloitte study, 49 percent of respondents experienced a serious cyber incident within three months. Yet only 22 percent rate their risk as high. Only two-thirds of companies use multi-factor authentication, and not even half conduct regular phishing tests.

Cyber risks are no longer just a concern for large companies. Small businesses are also being targeted by cybercriminals: According to a Deloitte study, micro, small, and medium-sized enterprises are affected by phishing at roughly the same rate. Nevertheless, only 11.5 percent of Swiss companies have cyber insurance, as the HSLU study notes, even though the premium volume has more than doubled since 2021 to 153 million Swiss francs. This means that nearly nine out of ten companies bear the financial consequences of an attack themselves.

A Chat Message Leads to Millions in Damages

In this case study, the attack begins neither with a suspicious email nor with a traditional hacking attempt. The attacker logs into the internal AI assistant using a stolen password. Because two-factor authentication is not in place, this is an easy task. The attacker then instructs the AI assistant to ignore all existing security rules and disclose the manufacturing parameters for the aviation orders. The assistant obeys without question.

This method is called «prompt injection» and tops the list of the biggest risks for language model applications maintained by the Open Web Application Security Project (OWASP). AI assistants process instructions and content through the same channel—so cleverly worded inputs can become new commands. According to the study’s authors, prompt injection could soon play a role for SMEs similar to that of phishing.

So what does the attacker do next? Using the stolen data, he shifts the CNC tolerances by a few micrometers. The AI quality control system continues to report «pass,» but the components violate aviation specifications. Only a manual spot check reveals the error. Then comes the blackmail: Pay up—or the most important customer will find out about the defective parts.

Potential damage following a cyber incident caused by prompt injection. (Source: VZ study «Cyber Risks for SMEs»)

The damage spreads from one level to the next: a digital security breach turns into a production problem, which then leads to a financial loss, and ultimately results in a strategic crisis. In this scenario, the most important aviation customer suspends operations for six months. For a real-world SME of this size, that could potentially threaten its very existence.

«That’s the IT department’s job»—a dangerous misconception

A password was stolen and the AI assistant was compromised. Creating the technical conditions to prevent this is certainly a matter for IT, but not exclusively so. Whether production continues, products are shipped, customers are notified, products are recalled, or payments are made, however, is decided by management. The study therefore identifies the belief that cybersecurity is solely the responsibility of IT as one of the most dangerous misconceptions.

Firewalls, updates, and backups remain indispensable. But the crucial questions are of a business nature: How long can production be halted? Which customers will be notified, and when? How much financial loss can the company absorb? Effective risk management therefore begins with translating technical vulnerabilities into potential consequences for production, liquidity, operational capacity, and reputation. «The contribution of risk management, therefore, does not lie in better classifying cyber risks from a technical perspective. It is about translating digital dependencies into business impacts, ranges of potential losses, and management decisions,» the study states.

The authors therefore recommend «actionable cybersecurity scenarios» rather than long lists of vulnerabilities. A brief management proposal of this kind answers six questions:

1. How does the attack begin?
2. What is affected?
3. How is the damage progressing?
4. What order of magnitude is plausible?
5. How does the company recognize when a situation is escalating?
6. What decisions follow from this?

At AlpPrecision, early warning signs would have included, for example, unusual queries in the AI assistant, access from unknown locations, or repeated questions about tolerance values. According to the study, an attack becomes dangerous not because of its technical sophistication, but when it exploits blind spots.

Ten Steps to Improve Cybersecurity

According to the study, what matters most for SMEs are not complex security programs, but robust minimum standards, clear responsibilities, and well-prepared decisions. The following ten measures can be directly derived from the case study.

1. Highlight critical dependencies. Which systems, data, and service providers are truly indispensable for production, sales, finance, and customer service? Only once you know that can you set priorities.
2. Consistently implement multi-factor authentication. Email, VPN, remote access, ERP, administrator accounts, and AI tools should never be protected by a password alone. In the case study, MFA would likely have prevented the breach.
3. Grant access according to the "need-to-know" principle. People and systems see only what they truly need. The less a single system can reveal, the less damage can be done.
4. Treat AI systems as critical systems. Every AI tool requires a designated person in charge, formal approval, clear data boundaries, and regular testing to detect manipulated inputs.
5. Separate office IT from production. Machine control systems and quality control systems should not be connected to the same network as office systems and cloud services without proper oversight.
6. Store backups separately and test them. What matters is not whether backups exist, but which processes need to be back up and running, in what order, and within what timeframe.
7. Practice for an emergency. At least once a year, go through the process to determine who makes decisions, who informs whom, which systems are to be isolated, and who verifies compliance with reporting requirements.
8. Involve suppliers and IT service providers. It must be clear who has remote access, what security standards apply, and how partners should respond in the event of a claim.
9. Train employees to handle specific situations. Practice handling fraudulent payment instructions or unusual data requests—and foster a culture where asking for clarification is the norm.
10. Bringing cyber risks to the attention of senior management as potential scenarios. Update scenarios and leading indicators on an ongoing basis, not just in the next annual report.

Not every residual risk needs to be eliminated. According to the study, it only becomes a problem when no one has consciously decided to accept it.

Cyber Insurance: A Safety Net, Not a Substitute for Prevention

And if, despite everything, damage has occurred as a result of a cybersecurity incident: What can cyber insurance cover? The answer: Not everything, but such insurance can at least cover part of the residual financial risk. Typically, it also covers first-party losses such as data and system recovery, business interruption, and forensic investigations, as well as third-party claims. It often provides rapid access to IT forensic experts, lawyers, and communications specialists.

However, in order to purchase cyber insurance, companies must meet certain minimum standards. These include, for example, tested backups, timely patching, MFA, clear lines of responsibility, and an emergency response plan. Failure to meet these contractual obligations may result in reduced coverage. Frequently excluded are the value of lost data, fines and contractual penalties, war and government cyber operations, as well as ransom payments, depending on the provider.

The VZ study compares various policies from eight insurers. The differences are, in some cases, significant. There is a wide range, particularly in the «business interruption» category—which was weighted at 25 possible points in the rating. Zurich scored 21 points in this category, while AIG and Mobiliar each received only five points. It is also worth noting that none of the policies examined exclude AI-enabled attacks—but none explicitly list them as covered either. The study therefore recommends clarifying this in writing when signing a contract.

VZ also compared the General Insurance Terms and Conditions (AVB) of the eight providers. Only standard coverage was evaluated, with a maximum of 100 points per category.

Source: VZ Study «Cyber Risks for SMEs,» General Insurance Conditions as of June 1, 2026

When it comes to liability coverage, the providers are quite similar. There are significant differences in coverage for first-party losses—especially, as mentioned above, in the case of business interruption—and in the terms and conditions of the policies. The study’s authors deliberately chose not to name an overall winner, noting that for SMEs, there is no «one right cyber insurance policy.» «Depending on the industry, data assets, digital dependency, supply chain, IT maturity, and financial viability, a different provider may offer the more suitable solution,» they conclude.

Evaluating Cyber Insurance

When evaluating cyber insurance policies, companies should weight their evaluation criteria based on their own relevance. For a manufacturing company, the «business interruption» criterion is more important than it is for a service-based company. A service-based company, on the other hand, will place greater weight on the criteria of liability and legal protection.

Even after taking out insurance, you should regularly review the list of covered benefits based on your own risk assessment. The following points can help you compare policies:

• Calculate your own scenario. Simulate a realistic loss scenario and review each item against the General Insurance Conditions. In the case of AlpPrecision, for example, contractual penalties, reputational damage, and the recall of physical components would likely not be covered under a cyber policy.
• Check the validity period. Are incidents covered if they occurred before the policy began but were not discovered until later? And how long does retroactive coverage last after the policy ends?
• Understand your right to terminate the contract in the event of a claim. If the insurer is allowed to cancel the policy after an incident, it may be difficult to obtain a new policy.
• Assess your obligations realistically. Can these obligations be fulfilled in everyday life and documented without any gaps? Vague or very strict guidelines pose the greatest potential for conflict.
• View the service interruption in detail. The waiting period, coverage period, and limits determine the practical benefits. Are outages caused by cloud or IT service providers also covered?
• Clarify coverage and costs. Do emergency and forensic costs count toward the main limit, or are they covered separately? Social engineering incidents, such as CEO fraud, often result in significant losses, but these are not covered under all policies.
• Document AI scenarios in writing. Prompt injection, deepfake deception, and manipulated AI systems should be explicitly considered insured cyber incidents.
• Test the emergency response system. Is there a 24/7 hotline? Does the insurer arrange for specialists on its own? Are preventive services, such as vulnerability scans, offered?
• Compare quotes with the same scope. Optional coverage options often significantly improve coverage, but they come at an additional cost. The key factor is the price in relation to the actual benefits provided.
• Review the policy regularly. New AI tools, new service providers, or increased revenue can change the risk profile. That is why coverage must also be adapted to these new circumstances.

Protective measures that have been proven to be effective pay off in two ways: They lower your premium and reduce the risk of benefit reductions.

Conclusion: The question is not "if," but "how much."

According to the study, the relevant question is no longer whether a cyberattack is possible. What matters is how severely a company will be affected, how quickly it can respond, and whether the financial consequences will remain manageable.

A good cybersecurity strategy, therefore, does not start with insurance, but with the question of which digital dependencies are critical to one’s own business. Those who understand these dependencies, make attacks more difficult, practice for emergencies, and choose the right policy will remain capable of taking action even under pressure.

*Editor's note: This text was edited with the help of AI.

About the study: «Cyber Risks for SMEs—Understanding, Assessing, and Insuring Against Risks» was published in October 2026 by VZ VermögensZentrum and the Lucerne University of Applied Sciences and Arts (HSLU). The authors are Prof. Dr. Stefan Hunziker (HSLU) and Simon Tellenbach, Luca Schläpfer, Selma Korac, and Gregor von Allmen (VZ). The study includes a rating of cyber insurance policies from AIG, Allianz, AXA, Chubb, Helvetia, Liberty, Mobiliar, and Zurich.

More information: https://www.vermoegenszentrum.ch and www.hslu.ch

This article originally appeared on m-q.ch - https://www.m-q.ch/de/cyberrisiken-im-kmu-verstehen-einordnen-und-versichern/