The cyber security challenges faced by swiss companies
Nearly 65,000 cyber incidents were reported by Swiss companies and public authorities to the Federal Office for Cyber Security (BACS) in 2025 (B2B Cyber Security). At the same time, more than one in ten Swiss companies had to abandon planned security initiatives, not because the technology was unavailable, but because the budget was insufficient (swisscybersecurity.net). The real issue is this: organisations acquire tools, patch gaps, and consume budgets, yet their security posture barely improves. What is missing is strategy and structure.
As of February 2026, BACS has recorded 260 attacks against critical infrastructures since April 2025. Following such incidents, affected organisations often begin searching for new products: a new tool is evaluated, purchased and deployed, only to become another addition to an environment already consisting of dozens of isolated decisions. The result is not a coherent security architecture but a patchwork of technologies with limited integration and little overall impact.
The real problem is therefore not a lack of technology. It is the absence of a clear strategy that defines what is truly worth protecting, the level of protection that is required, and how security measures should be prioritised and aligned with the resources available.
Structure creates impact
A security strategy defines which systems and data require the highest level of protection, where the security gaps lie, and in what order measures should be implemented, aligned with available budgets and resources.
This alignment is critical: the greatest security improvement does not come from the most extensive measure, but from implementing the right measure at the right time. Organisations that skip this step and move directly to architecture and implementation lose a vital point of reference. Security audits provide findings, but not strategic context. Individual measures are implemented, yet many risks remain unaddressed, and resources are wasted because the foundation is missing.
Three clearly distinct layers are essential:
- Strategy: What needs to be protected? What level of protection is required? Which risks are acceptable? Learn more here.
- Architecture: How should defence layers be planned and systems structured? Learn more here.
- Design: Which specific measures should be implemented, where, and how? Learn more here.
Only when these layers are properly aligned does a security framework emerge that works effectively in day-to-day operations and enables organisations to remain resilient and capable of action.
How organisations can take a structured approach to securing AI workloads and gain control over emerging risks is outlined in Axians’ AI Security Playbook for Swiss CIOs & CISOs.
AI increases the pressure to act
The need for strategic clarity becomes even more urgent with the adoption of Artificial Intelligence (AI). AI has become a reality in Swiss organisations, serving as an assistant, an analytics tool, and a component of automated business processes. As a result, new data flows, dependencies, and attack surfaces emerge that are only partially addressed by traditional security models.
Organisations that deploy AI workloads without understanding where data is flowing, who has access to it, and who is accountable when something goes wrong create structural risks, regardless of how mature the rest of their security architecture may be. AI Security is therefore not a separate discipline. It is the natural extension of a well-designed security strategy: governance, transparency, and clearly defined responsibilities are just as essential for AI systems as they are for any other critical infrastructure within the organisation.
How Axians supports
End-to-End Strategy, Architecture and Operations
This is exactly where Axians comes in. As a 360° ICT provider with more than 1,000 cyber security specialists worldwide and deep roots in the Swiss market, Axians supports organisations throughout the entire security journey, from strategic assessment and architecture design to day-to-day operations. This includes an ISO 27001-certified Security Operations Center and a modular portfolio that seamlessly integrates into existing environments.
The approach is risk-based: governance, architecture, and operations are brought together to deliver effective security for both traditional IT and OT environments, as well as the secure and controlled use of AI. This ensures that security measures are implemented precisely where they create the greatest impact.
MARTIN BUCK
Head of Information Security & Consulting Services, Axians BNC AG