In 2025, IT security is no longer an afterthought: it’s a day-to-day operational issue, particularly for Swiss SMEs. Yet an alarming number of them continue to operate with outdated, even dangerous, IT practices.
Far from being the preserve of large corporations, cybersecurity is now a key factor in the resilience of small businesses. And it’s not the most sophisticated attacks that are the problem, but often the most basic negligence.
A more hostile environment, but stagnant reflexes
Digital threats have become more frequent, more accessible and harder to detect. Attacks no longer require advanced expertise: today, any malicious actor can buy a phishing kit or launch an automated attack with just a few clicks.
Despite this trivialization of risk, many Swiss SMEs still operate without a clearly defined security strategy. Few have a formalized plan for incident management, data protection or staff awareness. As a result, attacks often succeed not because of complex hacking, but because of simple, avoidable negligence.
Data loss, ransomware and identity theft fraud are still commonplace, even in small businesses. And these are not exceptional cases: most cybersecurity providers in Switzerland are seeing a steady increase in such incidents in the local economic fabric.
Simplicity: the digital Trojan horse
One of today’s greatest paradoxes? The danger often lies in the quest for simplicity. Employees still use their personal computers without encryption, store passwords in their mailboxes or leave the active accounts of employees who have been away for several weeks.
These practices, tolerated to “save time”, are today the equivalent of an open door on the company’s entire information system.
IT security fundamentals you should know in 2025
You don’t need a complex infrastructure to be secure. What counts is the adoption of simple but essential best practices.
Here are the main pillars that every SME should master today:
- Strict access control: no account sharing, rights limited to each role.
- Automatic backups (local and cloud), tested regularly.
- Continuous software, OS and antivirus updates.
- Regular team awareness training, including simulated attacks (phishing, social engineering, etc.).
- These basic measures can prevent up to 80% of known incidents, according to several reports on cybersecurity in SMEs.
Two incidents that could have been avoided
In Lausanne, a fiduciary lost access to its customer files for 4 days due to a Word document containing a booby-trapped macro. Double authentication and EDR antivirus would have been enough to protect them.
In Neuchâtel, an energy SME was defrauded of CHF 18,000 following a transfer to a false IBAN. Systematic manual control of transfers and better protection of mailboxes would have prevented the loss.
These Swiss examples are neither rare nor isolated.
Avepto: a partner for SMBs that don’t want to suffer any longer
At Avepto, we help Swiss SMEs to implement concrete IT security solutions. No useless jargon, no gas factories: we prefer effective tools that are easy to maintain and adapted to the size of your company.
Our approach is based on :
- An analysis of your existing risks.
- Backup, supervision, filtering and access control solutions.
- Integration of secure cloud services (Microsoft 365, kDrive…).
- And above all: human support, with ongoing monitoring and a real ability to intervene quickly.
In conclusion, good IT security is all about anticipation.
It’s no longer about being perfect. It’s about being prepared.
Cybercriminals don’t attack those who do everything right. They attack those who do nothing. And in an environment dominated by the cloud, telecommuting and remote access, continuing to do the minimum is like playing with fire.
IT security in 2025 is no more complex than before. It is simply more demanding. It doesn’t forgive improvisation.
SMEs that have understood this are already ahead of the game. The others take the daily risk of losing everything.
