Guides & Insights · Current as of September 5, 2026
In-depth analyses, market overviews, and actionable technical guides for Swiss decision-makers. From the true costs of traditional pentesting to mandatory FOCS incident reporting under Art. 74b ISA, to hardening hospitals, municipalities, and Microsoft 365 tenants.
Penetration testing has become an essential security audit for Swiss hospitals, municipalities, law firms, and SMEs. Yet market price divergence is vast—ranging from opaque daily consulting fees to four- or five-figure retainers. This guide provides full transparency on real costs, methodologies, and selection criteria.
Organizations frequently conflate automated vulnerability scans with penetration tests, discovering too late that a basic scanner printout satisfies neither cyber insurance underwriters nor Swiss regulatory authorities. Here is how the three approaches differ in practice.
Under Art. 74b of the Swiss Federal Information Security Act (ISA), critical infrastructure operators and essential services face a binding legal duty to report significant cyberattacks to the Federal Office for Cyber Security (FOCS) within 24 hours. Who is covered, and how must organizations prepare?
To defend an organization effectively, one must look at it through the eyes of real adversaries. Here is how Suisse Guard evaluates external perimeters across 12 distinct domains combining proprietary AI tools and certified human analysis.
Compass Security, Oneconsult, Redguard, SCRT, Kudelski Security, or Suisse Guard: which security partner fits your Swiss organization best? A transparent analysis of capabilities, operational models, and pricing structures.
Securing cyber insurance in Switzerland has become significantly more stringent. AXA, Mobiliar, Zurich, and Helvetia refuse coverage to companies that cannot produce verified evidence of technical security audits. Reviewing essential underwriter criteria.
Swiss healthcare institutions represent high-value targets for cyber adversaries. Balancing the critical confidentiality of patient data under medical secrecy (Art. 321 SCC), legacy biomedical equipment (IoMT), and strict 24-hour mandatory reporting under the Information Security Act requires robust technical controls.
Cyberattacks on Swiss municipalities demonstrate that no public administration is too small to be targeted. How can municipal councils secure inhabitant registries, tax records, and civil services on limited public budgets?
For law and notary practices in Zurich, Geneva, or Lugano, the compromise of client data is fatal. Beyond reputational ruin, inadequate digital security exposes practitioners to criminal prosecution under Art. 321 of the Swiss Criminal Code (SCC).
Most Swiss organizations run on Microsoft 365. However, Microsoft's default settings prioritize user convenience over maximum security. Here are the 7 most dangerous misconfigurations uncovered during our security audits.
Adversaries rarely launch direct frontal attacks on your main corporate firewall. They seek out forgotten staging subdomains, abandoned contractor portals, or uncataloged cloud instances. EASM reveals what attackers see before they exploit it.
Cybercriminals no longer need to break in—they simply log in using stolen credentials purchased on underground markets. In 2025 alone, over 531,000 Swiss user accounts were published on criminal forums. How can your business defend itself?
Your files are locked, backups are encrypted, and an extortion note demands a six-figure ransom. The first 24 hours determine whether your organization recovers operational integrity or suffers catastrophic collapse. A battle-tested emergency response guide.
You may have fortified your internal infrastructure, but what if your HVAC contractor, fiduciary accountant, or software vendor has unmonitored permanent VPN access to your network? Managing supply chain risk.
ISO/IEC 27001 is the global gold standard for information security management systems (ISMS). However, accredited certification bodies like Swiss Safety Center AG or SQS demand concrete technical evidence of periodic, independent penetration testing.
APIs transmit sensitive financial, personal, and operational data between mobile apps, customer portals, and internal databases. Without dedicated business logic testing, critical authorization flaws remain completely invisible to standard web vulnerability scanners.
With over 27,000 incident reports filed with FOCS in the first half of 2026 and time-to-exploit shrinking to negative values, Swiss organizations face unprecedented offensive velocity. Strategic review of official data and defensive priorities.
Gaining an initial foothold in a corporate network is merely stage one. The attacker's ultimate prize is Active Directory domination to deploy ransomware network-wide in minutes. Analyzing internal privilege escalation tactics and defensive tiering architectures.
We audit your complete external attack surface at a guaranteed flat rate of CHF 2,800 excl. VAT – inclusive verification re-test and accredited ISO 27001 certificate.
