--- title: "SME IT security: the fundamentals that really make the difference | Avepto" canonical_url: "https://avepto.ch/en/articles/sme-it-security" last_updated: "2026-08-30T16:43:05.000Z" locale: en meta: author: "Yoann Talagrand" description: "SME IT security: appropriate access rights, tested backups, up-to-date systems and clearly defined responsibilities. Being prepared beats being perfect." "og:description": "SME IT security: appropriate access rights, tested backups, up-to-date systems and clearly defined responsibilities. Being prepared beats being perfect." "og:title": "SME IT security: the fundamentals that really make the difference" "twitter:description": "SME IT security: appropriate access rights, tested backups, up-to-date systems and clearly defined responsibilities. Being prepared beats being perfect." "twitter:title": "SME IT security: the fundamentals that really make the difference" --- ![A succession of open glass and mesh doors leading to a network cabinet in an office at dusk.](https://assets.avepto.ch/cdn-cgi/image/w=1280,h=853,f=auto,q=75,fit=cover/b5a10bb2-d3d1-4bc0-8151-eae71acf188c.png) # SME IT security: the fundamentals that really make the difference What changed, and what an SME has to do differently
Written by
Yoann Talagrand
Publication date
3 July 2025
Last updated
13 September 2026
Reading time
About two minutes
Podcast The article takes the floor. A conversation generated by artificial intelligence. IT security is no longer something you deal with now and then: it is part of how an SME runs every day, in Switzerland in particular. Yet many SMEs still rely on practices that have not kept pace with their tools, their working habits and the threats. Far from being a domain reserved for large groups, cybersecurity has now imposed itself as a pillar of resilience for small structures. Incidents do not come only from sophisticated attacks, but also from incomplete protection, ageing configurations or procedures that are still informal. ## A more exposed environment, with protection that is still uneven Digital threats have become more frequent, more accessible, and harder to detect. Attacks no longer require advanced technical skills: ready-made kits make it possible to run phishing campaigns or automated scans. Despite this trivialisation of risk, many Swiss SMEs still operate without a clearly defined security strategy. Few have a formalised plan for incident management, data protection, or staff awareness. As a result: some attacks succeed without any particularly complex technique, by exploiting missing protection, an access right that is too broad, or a procedure that was never formalised. Data losses, ransomware, and identity-fraud cases remain frequent, even in small structures. And these aren’t exceptional cases: most cybersecurity providers in Switzerland note a regular increase in these incidents in the local economic fabric. ## When the search for simplicity creates blind spots One of today’s biggest paradoxes? Danger often comes from the search for simplicity. Staff still use their personal computer without encryption, store passwords in their inbox, or leave the accounts of long-departed employees active. These practices, often kept in place to save time, create access paths and dependencies that are hard to control when an incident occurs. ## The IT-security fundamentals you can no longer ignore You don’t need a complex infrastructure to be secure. What counts is adopting good practices: simple but unavoidable. Here are the main pillars every SME should master today: - Strict access control: no shared accounts, rights limited to each role. - Automatic backups (local and cloud), regularly tested. - Continuous updates on all software, OS, and [antivirus](https://avepto.ch/en/cybersecurity/antivirus). - Regular team awareness, with attack simulations (phishing, social engineering…). These baseline measures sharply reduce exposure to the most common incidents we encounter. For the detailed action plan on a tight budget, see our [cybersecurity priorities on a manageable budget](https://avepto.ch/en/articles/affordable-cybersecurity-sme). ## Two incidents that could have been avoided Two typical examples, representative of incidents we regularly see in French-speaking Switzerland. In Lausanne, a fiduciary lost access to its customer files for four days because of a Word document containing a booby-trapped macro. Blocking macros and [endpoint protection (EDR)](https://avepto.ch/en/articles/mfa-not-enough-session-theft-siem-edr) would have been enough to protect it. In Neuchâtel, an energy SME suffered a CHF 18,000 fraud after a transfer to a fake IBAN. A systematic manual check of transfers and better mailbox protection would have avoided the loss. These Swiss examples are neither rare nor isolated. ## Avepto: a partner for SMEs that no longer want to be victims At Avepto, we support Swiss SMEs in setting up [concrete IT-security solutions](https://avepto.ch/en/cybersecurity). No needless jargon, no over-engineered complexity: we favour effective tools, simple to maintain and tailored to your size. Our approach rests on: - An analysis of your existing risks. - Setting up backup, supervision, filtering, and [network access control](https://avepto.ch/en/cybersecurity/networks) solutions. - Integration of secure cloud services (Microsoft 365, Infomaniak’s kDrive…). - And above all: human support, with continuous follow-up and a real ability to intervene quickly. ## To conclude: prepared rather than perfect Good IT security is not about removing every risk. It is about knowing which systems the business cannot run without, protecting the accesses that matter and preparing the response to an incident. A large share of attacks is opportunistic and automated. Others target a specific organisation, a specific role or a specific commercial relationship. An SME can be exposed in both cases, without that meaning it has been negligent. The fundamentals remain within reach: appropriate access rights, tested backups, up-to-date systems, staff who know what to watch for, and clearly defined responsibilities. Read about our approach to [cybersecurity for SMEs](https://avepto.ch/en/cybersecurity). Continue reading ## Two related articles. [All articles →](https://avepto.ch/en/articles) [![Two side-by-side road tunnels at dusk on a wet road, one dark, the other lit by headlight trails.](https://assets.avepto.ch/cdn-cgi/image/w=640,h=480,f=auto,q=80,fit=cover/7192875c-53b6-4765-9c1a-aa30765fb06e.png)CYBERSECURITY 4 MIN IT backup: the common pitfalls that lose precious data 08 JANUARY 2026](https://avepto.ch/en/articles/it-backup-common-pitfalls) [![A stone disc floating on dark water, ringed by three curved steel blades breaking the current.](https://assets.avepto.ch/cdn-cgi/image/w=640,h=480,f=auto,q=80,fit=cover/7fa3a822-832f-4e06-892a-38a546e60630.png)CYBERSECURITY 6 MIN Cybersecurity on a manageable budget: the priorities for an SME 27 NOVEMBER 2025](https://avepto.ch/en/articles/affordable-cybersecurity-sme)