Cybersecurity on a manageable budget: the priorities for an SME

Securing an SME: start with access, data and services

An SME cannot secure everything at once. It can instead protect, as a priority, the access, data and services its activity depends on. Here is a pragmatic plan for investing in the right order. The good news: well-chosen priorities remain accessible, even on a tight budget.

Why Swiss SMEs think they’re too small to be attacked

Picture a Monday morning: your accounting is encrypted, your mail blocked, your teams at a standstill, and a laconic message demands a ransom. The targeted company has only 25 staff, no IT department, and thought hackers only went after large groups. In reality, attackers automate their campaigns and target the least-protected structures first.

A badly skewed perception of risk

In fact, a representative study conducted by AXA in 2022 shows that 46% of the SMEs surveyed had defined password creation rules, while only two in five raised staff awareness of cyber risks. The result is a gap between the real threat and the measures actually deployed.

Leaders underestimate the risk, treat cybersecurity as a luxury, and defer decisions, directly exposing cash, reputation, and contracts.

“We don’t have anything interesting”: the costly argument

Many executives tell themselves they don’t store strategic data. In practice, attackers are interested in anything that can be quickly monetised: mail access for payment fraud, server encryption to demand a ransom, theft of HR or customer files for extortion.

It isn’t top-secret data being targeted, but the company’s ability to keep functioning.

The false equation: security = big budget

Another obstacle: the idea that protecting yourself immediately implies a 24/7 security operations centre (SOC), complex solutions, and five-figure invoices. Result: many SMEs do… nothing.

Yet a large share of incidents still stem from basic flaws: weak password, no multi-factor authentication (MFA), missing updates, untested backups. An effective priority plan starts by fixing these points cheaply. More advanced investments come later, gradually.

Prioritise real risks without blowing the budget

You can’t secure everything 100% right away. But you can decide what you refuse to lose: invoicing, email, customer files, ERP, production files. The point isn’t to buy the best solution; it’s to limit business impact as much as possible.

Map the scenarios that would really hurt

Start with a simple question: If this system goes down for three days, what concretely happens? Take your key functions: accounting, production, sales, support, HR. For each:

• identify the necessary applications and data (ERP, CRM, shared files, email);
• assess the impact of an extended outage (cash, contracts, image, legal obligations);
• note external dependencies (host, cloud provider, IT partner).

You end up with a short list of the crisis scenarios that would hurt most: ransomware blocking the file server, impersonation of your email to defraud your customers, theft of bank-account access, loss of a poorly backed-up cloud. These should drive your spending.

Rate risks: probability × impact

Next, give each scenario an estimate of probability (low, medium, high) and impact (low, medium, high). A targeted attack by a highly sophisticated group generally remains less likely than an automated campaign sent out at scale.

On the other hand, ransomware sent at scale through a malicious attachment is a real possibility. It deserves priority treatment, especially as only 40% of the SMEs surveyed say they train their staff on digital risks. Concentrate your efforts on the risks whose likelihood is medium or high and whose impact would be significant: email, account access, the servers or cloud services that carry your operations, backups.

A low-cost cybersecurity baseline for any SME

Before buying tools, lock down the basics. This baseline often only requires time, a bit of method, and occasional external support to move faster.

Standardise access: passwords, MFA, shared accounts

If only 46% of SMEs have password rules, your competitive advantage starts there. Decide on simple, non-negotiable rules: minimum length, ban on reused passwords, recommended password manager, rotation in case of suspicion.

Enable MFA wherever possible: email, cloud tools, VPN. Remove shared credentials. A generic address such as info@ should be set up as a shared mailbox, with named access for each employee rather than a common password. A provider like Avepto can fold these measures into a global identity and access management approach to avoid recurring human flaws.

Tidy up workstations and updates

Many attacks succeed because workstations are behind on updates. Set a simple internal rule: automatic updates on compatible workstations, planned and controlled rollouts for servers and business applications, with a monthly check.

Uninstall obsolete or unused software, which expands your attack surface for no benefit. Block rogue installs: no new software without validation, no unknown USB key plugged into a workstation. Deploy properly configured, managed endpoint protection on every device: a basic, well-maintained solution beats a sophisticated one left misconfigured.

Train quickly without organising a seminar

Since only 40% of SMEs raise team awareness of cyber risks, you can sharply reduce your exposure with a focused one-hour session. Goal: teach teams to spot a fraudulent email, verify an urgent payment request, report an incident without fear of sanction, and protect customer data.

A simple internal kit (ten slides, three concrete examples, clear procedures) is enough to start. Add a quarterly reminder with two or three new examples to keep the habits alive. To structure that awareness work over time, see our article on phishing training that actually works.

Which paid solutions to choose when every franc counts

With a limited budget, the goal is to invest in what truly reduces potential losses, not in what shines most on a flyer.

Cyber insurance and local aid: an underused lever

Cyber insurance generally offers two pillars: incident assistance (specialists, lawyers, communication) and coverage of certain damages (business interruption, data restoration, response costs). Before subscribing, check the prerequisites: backups, antivirus, MFA, password policy.

Several cantons and economic-support bodies can occasionally fund security audits or upgrade projects. These aids evolve, but the logic is the same: encourage SMEs to set up a minimal security baseline. A discussion with your chamber of commerce or a local provider helps identify what you can claim.

Choose your security building blocks with focus

With a limited budget, focus your investments on four axes: endpoint protection (managed antivirus/EDR), email security, professional backup, supervision by a provider. A managed EDR solution helps detect suspicious behaviours on endpoints faster.

Advanced email filtering stops a large share of fraudulent messages before they reach the inbox. A managed external backup lets you recover your critical data. Finally, a managed-services contract gives you a single point of contact for any security or availability issue. The point is to assemble these building blocks coherently rather than stack isolated products.

To go further, a partner like Avepto can combine cybersecurity solutions, backup, and managed services into one offering designed for SMEs.

Your 30-day cybersecurity action plan with limited resources

You don’t have time to launch a big cybersecurity project. But you can transform your security posture in 30 days, in 30- to 60-minute blocks, following a clear roadmap.

Days 1–10: stabilise the visible foundations

In the first ten days, focus on three workstreams. First, list your critical systems: email, servers, cloud solutions, ERP, shared files, invoicing tools. Document who accesses them and how.

Next, enforce your new password rules and enable MFA on services that allow it. Finally, run a micro-awareness session for your teams: 30 minutes, three recent attack examples, and a clear rule for reporting any doubt.

Days 11–20: lock down data and backups

Second phase: reduce the probability of data loss or encryption. Start by checking your backups: location, frequency, retention, recent restore test. Until restoring a file or a full system has been tested in real conditions, you cannot know whether it will work on the day you need it.

Then put in place minimal network segmentation: separate workstations, servers and sensitive equipment, then allow only the traffic that needs to pass between those zones. Alongside that, limit access rights to only those who need them. Use the moment to disable the accounts of former staff still active. Where it makes sense, consider a managed professional backup solution, such as our managed backup services for SMEs.

Days 21–30: organise the response and delegate what must be delegated

Final step: prepare for the day something goes wrong. Write a simple escalation and recovery procedure: who to alert first, which systems to isolate from the network immediately (without shutting them down unless the response team says so), who is allowed to speak externally (clients, press, authorities), how to contact your insurer and your IT provider.

Make sure critical contact numbers are accessible offline. Then identify everything you can’t handle in-house: continuous system supervision, advanced alert handling, technical responses to an attack. Delegate these to a provider capable of supplying managed services and security monitoring sized for your scale.

In thirty days an SME can clarify its priorities, fix several common weaknesses and have a first response procedure in place. Lasting control then takes regular follow-up. To turn this roadmap into an execution plan suited to your reality, schedule an exchange with Avepto and get an action-oriented cyber diagnosis.