What if the main cyber risk for your SME did not come from a spectacular attack, but from a forgotten administrator account, a backup never tested or a service provider on which an essential activity depends? The cyber risks most underestimated by SME managers are often hidden in these everyday dependencies. Less visible than ransomware, they can nevertheless disrupt your operations and limit access to your data.
You know that you need to protect your systems, but it is not always easy to distinguish priorities from general alerts. It can also be difficult to know who responds in the event of an incident and whether the company could resume operations within an acceptable time frame.
In this article, you will discover the blind spots that weaken SMEs, from access and phishing to backups, service providers and team preparation. You will then be able to define a realistic order of action, adapted to your resources and your obligations in Switzerland, and identify situations where a local partner in Switzerland can strengthen your cybersecurity and your continuity.
Key Points
- The cyber risks most underestimated by SME managers often appear when we examine digital dependencies and their consequences on business.
- Evaluate each risk based on its likelihood, its business impact and your company's ability to resume operations.
- Designate a security manager and clarify who decides and who acts in the event of an incident.
- Formalize the first reaction steps and check that the people concerned know their role.
- Coordinate cybersecurity, IT support and backups, taking into account FADP and data sovereignty.
Table of Contents
Why do SME managers underestimate certain cyber risks?
A cyber risk is underestimated when an exposure is known, or even trivialized, but its concrete consequences on the activity remain poorly assessed. A mailbox used for orders, a shared account or access retained after the departure of a colleague may seem ordinary. However, if one of these elements is compromised, work can slow down, data become inaccessible or professional exchanges be hijacked. The cyber risks most underestimated by SME managers are therefore not always unknown threats: they often lie in daily habits and dependencies.
The size of a business is not a natural protection. An SME may hold customer data, process payments or have access to systems used by its partners. Limited resources can also concentrate several responsibilities on the same person or delay the definition of procedures. This does not mean that all SMEs are targeted in the same way, but that a less visible activity is not synonymous with the absence of risk. There cybercrime covers different forms of attacks, some of which exploit access and relationships of trust.
A feeling of security describes a perception. Actual preparation depends on roles and instructions, while recovery capacity depends on the ability to restore essential activities.
Why can a Geneva SME be an indirect target?
Accounts, data and exchanges with suppliers may be of interest to an attacker, particularly when they open a path to other organizations. Let's take a fictitious SME from Meyrin which manages its orders by messaging and entrusts part of its digital services to a service provider. A compromised account could expose trades or disrupt order processing. The level of risk also depends on the access granted and the dependence on these tools.
To better understand your exposure, map the essential services, the people who can access them and the operations that would be interrupted if an account or service provider becomes unavailable. This analysis relates risk to its effects on the business, rather than the size of the company or the visibility of the threat.
The false sense of security: tools present, preparation absent
Antivirus helps protect workstations, but its presence alone does not prove that an incident will be detected, reported and handled in a coordinated manner. You also need to know who makes decisions, who to send an alert to and which operations to maintain or suspend. Without accessible guidelines, the team can waste time determining responsibilities when a clear answer is needed.
A concrete benchmark consists of checking that employees know how to report a suspicious message and that managers know the first steps to follow. An SMEs cybersecurity approach coordinates technical protection with IT support and operational readiness.
Five underestimated cyber risks in the daily operations of an SME
Digital risks become easier to spot when linked to the tasks they could disrupt. Unused access, an untested restoration or an unclear instruction may seem secondary until the day when an essential operation depends on this element. To broaden your analysis, also consult the guide to frequent cyber threats against Swiss SMEs.
Accounts, identities and access still too permissive
A shared account or access left active after the departure of an employee complicates the identification of actions and can facilitate an intrusion. In Microsoft 365, for example, review who is accessing boxes, files, and workspaces, then remove rights that are no longer needed. Multi-factor authentication adds verification to the login and reduces exposure from a stolen password, without eliminating all risks.
Question to ask: do we know who has sensitive access and how revocations are carried out upon role change or departure?
Backups, providers and continuity: forgotten dependencies
The presence of a backup does not guarantee that it is protected against corruption or that the data can be correctly restored. A restoration test allows you to concretely check which files or services can be recovered. A geosynchronous backup refers to real-time replication of data across two geographically separated sites. To examine the risks of intrusion and their access routes, the computer intrusion prevention guide provides additional guidance.
Service providers are another dependency: too much remote access or the unavailability of an external service can affect your operations. Data location and sovereignty also count in the analysis. Question to ask: what activities would be blocked if a provider or digital service became inaccessible, and what data could we restore?
- Messaging: a fraudulent message can encourage an employee to transmit information or carry out an unusual transaction. Define how the team flags a questionable email and verifies a sensitive request received by email.
- Team preparation: without simple instructions, an alert may be ignored or transmitted late. Check if everyone knows who to notify, where to find instructions and which tasks should be maintained as a priority.
These dependencies are handled more effectively when they are identified with the managers concerned and linked to business consequences. THE NIST Cybersecurity Framework offers a reference framework to structure cyber risk management. For the cyber risks most underestimated by SME managers, a concrete review of access, restorations and procedures helps move from observations to measures to take. You can discuss with the Flux Group team about your cybersecurity issues.
How to distinguish a discrete cyber risk from a priority risk?
Priority does not depend solely on the probability of an incident. It also depends on what stops if the risk materializes and your ability to restore service. A discrete risk can become a priority when the activity is highly dependent on the system concerned. To rank exposures, compare their likelihood, business impact, dependencies involved and recovery possibilities, without trying to produce a universal score.
What criteria should be used to prioritize cyber risks?
Start by identifying the business functions and data involved: order processing, access to customer files, invoicing or internal communication. Then ask yourself what operations would be disrupted, who would be impacted, and what resources would be needed to resume the activity.
This table is used to structure an internal discussion, not to certify your level of security. The scenarios are fictitious: adjust their plausibility and impact to your systems and processes.
| Scenario | Likelihood to examine | Possible business impact | Addiction concerned | Resumption capacity to be assessed |
|---|---|---|---|---|
| Compromised business account | Depending on access, their use and the protections applied | Undue access to data or interruption of account operations | Identity, messaging and services accessible with this account | Ability to revoke access, review activities, and restore reliable access |
| Cannot restore after an incident | According to the checks and restoration tests carried out | Delay or blocking of activities that require the data concerned | Backups, recovery tools, and who can use them | Ability to retrieve usable data and restart priority functions |
For each line, record the missing information and the verification required. You thus transform a general concern into a concrete decision, without giving false precision to the evaluation. CISA Cyber Essentials can complement this with preparation resources.
The role of Swiss FADP and data sovereignty
The FADP concerns the processing of personal data. The measures to be planned depend on the situation of the company and the processing operations concerned. Without replacing legal advice, your map can indicate where the data is hosted, which service providers are involved and who can access it. Data sovereignty informs storage and continuity choices, but alone is not enough to establish compliance.
To place these criteria in a broader approach, the cybersecurity strategic guide for companies in Switzerland provides a useful complement. You can also discuss your cyber priorities with Flux Group.
What concrete measures can a Swiss SME prioritize?
To move forward without trying to tackle everything at once, start with the dependencies that support your essential activities. An SME in Geneva, Meyrin or Vernier can start with available internal resources, then adapt its approach as its systems and needs evolve. Aim for verifiable results: assigned responsibilities, identified access, tested restoration and organized response.
- Appoint a responsible person. Designate a contact person responsible for coordinating security and keeping instructions up to date. Employees must know who to report an anomaly to, and managers must know the person who is leading the first actions.
- Map access. Identify important accounts, their users and access granted to service providers. Specify who can modify or deactivate them. This reference list makes it possible to identify unnecessary rights and organize their revision.
- Check backups. Choose a sample of data needed for current operations and test its restoration. Note what was able to be recovered, the difficulties encountered and the people capable of carrying out the operation. A backup is only useful for recovery if its restoration is controlled.
- Prepare the reaction. Write accessible guidelines for priority scenarios, such as a compromised account or unavailable access. The document must indicate the people to be notified, the decisions to be taken and the operations to be maintained as a priority.
Prepare teams and respond to an incident
A usable plan distributes tasks unambiguously: one person decides, another records the facts and actions, and the parties concerned are notified according to the situation. For a simple exercise, imagine that an employee can no longer access their professional account. The team must know how to report the problem and where to find instructions, without improvising a procedure in a hurry.
Awareness-raising benefits from relying on examples close to daily work: unexpected attachment, unusual request for payment or urgent request from a manager. Encourage prompt reporting, without making the person who received the message feel guilty. The goal is to improve the collective response, not to find an individual responsible.
Test backups and reduce unnecessary access
After a change of role or the departure of an employee, re-examine the rights linked to the accounts and services concerned. Compare the access retained with the tasks actually needed, then record the changes made. For backups, repeat test restores and verify that the recovered files meet business needs. These controls produce concrete elements to correct deficiencies.
To organize this process and examine the priorities of your infrastructure, rely on an IT security audit in Switzerland. Proactive monitoring, or the continuous observation of systems to spot anomalies before they cause an interruption, can complement these checks.
How Flux Group supports SMEs facing underestimated cyber risks
Reducing digital blind spots requires an overview: access and systems must be examined in relation to the people who use them, the operations they support and the data to be preserved. Flux Group supports Geneva SMEs in cybersecurity and IT support, linking technical defense to continuity needs. The goal is to clarify your business priorities, without presenting protection as infallible.
A coordinated approach to defense and continuity
An at-risk account, an IT alert and a backup should not be treated as isolated subjects. By linking cybersecurity, IT support and proactive monitoring, your SME can better situate technical events in relation to the tools and activities concerned. This coordination helps to identify the points to be examined and to organize the follow-up to be given, taking into account the responsibilities already present in the company.
Continuity also depends on the possibility of finding useful data. Flux Group offers geosynchronous backup with geographic replication. Its role in your system is assessed according to the data and services on which your activity depends. Information localization and data sovereignty are also worth considering, without automatically inferring that all applicable requirements are met. Flux Group’s IT and cybersecurity services are part of this coordinated approach, adapted to the needs of each SME.
Flux Defense processes over 1,448 events per second. The reported average response time is less than 9.3 minutes, and Flux Group secures over 1,239 SMEs networks. This data describes the defense activity and its context, without guaranteeing that an incident will be avoided or that a recovery will take place without difficulty. Protection, support and backups together contribute to continuity.
A local partner in Geneva and Switzerland
In Geneva, Meyrin, Vernier, Eaux-Vives, Collogny, Grand-Lancy and Petit-Lancy, needs vary depending on the organization, tools and dependencies of each SME. Flux Group acts as a solutions integrator and supports internal teams to connect security priorities to operational realities, then coordinate measures with IT support. The cyber risks most underestimated by SME managers become more readable when they are examined based on the company's own uses, access and data.
An exchange with Flux Group allows you to examine the digital dependencies that support your business and define what needs to be addressed first. You can therefore consider an approach proportionate to the needs of your SME.
Make your next step a clear priority
Cybersecurity progresses when it becomes a subject of regular management, and not a one-off reaction to an alert. The cyber risks most underestimated by SME managers deserve to be re-examined each time your tools, your teams or your dependencies evolve. A new application, a change of service provider or the departure of an employee can modify access and the consequences of an interruption.
Choose a first milestone adapted to your reality: assign responsibility for a priority risk, plan a restoration test or clarify the procedure to follow in the event of compromised access. Record the outcome, then decide on the next step with those involved. This progression makes decisions more understandable and helps your SME to strengthen its continuity without trying to transform everything at once.
To move from assessment to action, contact Flux Group and define your SME’s next cybersecurity priority.
Frequently asked questions about cyber risks for SMEs
Is an SME really an interesting target for cybercriminals?
Yes, an SME can be of interest to cybercriminals, even if it is not targeted for its notoriety. Access to data, payments or partner systems may represent an opportunity. The cyber risks most underestimated by SME managers include these indirect access routes. In Geneva, as elsewhere in Switzerland, assess what an attacker could achieve rather than relying solely on the size of your company.
Is antivirus enough to protect a small business against cyber risks?
No, antivirus is a useful measure, but it doesn't cover all scenarios. It does not replace identity checks, system updates, online account protection or a response procedure. For example, an employee can enter their password on a fake login page without a malicious file being downloaded to their computer. Protection must therefore cover positions, accounts and uses.
How do I know if my company's backups can be restored?
Ask the person responsible to retrieve a representative file according to the usual procedure, then verify that its content is usable. A report should specify the data tested, the date of the test, the difficulties encountered and the people capable of repeating the operation. Also check that the rights necessary for the restoration are accessible to the right people. A message indicating that the copy has completed does not, by itself, demonstrate that it will meet business needs.
What to do first when a business account appears compromised?
Notify the IT or support person immediately and avoid using the account to send messages or approve requests. From a trusted device, revoke active sessions and secure relevant access, according to your company's procedure. Retain messages and information useful for analysis. Then check recent activity, including email forwarding rules and unusual requests sent on behalf of the account.
Does the Swiss FADP impose the same cybersecurity measures on all SMEs?
The FADP does not result in an identical technical list to be applied uniformly by all companies. Security measures must be adapted to the personal data processed and the risks associated with their processing. An SME that manages sensitive files does not necessarily have the same needs as a company that uses little personal data. Map out your treatments and protections, then seek legal advice if you need to determine your obligations in a specific situation.
Why can supplier access represent a risk for an SME?
Granted access to a vendor can open a door to your company's systems or data. The risk increases if the rights exceed the expected task, if several participants use the same account or if access remains active after the end of an intervention. Assign individual, limited access as needed, document who authorizes it, and remove it when the collaboration or task ends. This discipline also makes it easier to examine unusual activity.
Article by
Delyan TZONEV
Passionate entrepreneur and manager, I am CEO of Flux Group and Hype Swiss. I support companies in their digital transformation thanks to innovative solutions in IT, telecommunications and software development. My goal is to design high-performance technologies that simplify the daily lives of businesses and support their growth.
Disclaimer
The articles published on the Flux Group blog aim to share our expertise, our field experience and best practices in IT, cybersecurity, cloud, telecommunications and digital transformation of SMEs.
We strive to provide reliable, up-to-date and relevant information at the time of publication. However, technologies, regulations and service offerings are evolving rapidly. The published content is therefore provided for informational purposes and does not constitute personalized, legal, tax, financial or technical advice.
Each company has specific needs, we recommend that you seek professional support before making a decision or implementing a solution presented in our articles.
The opinions, recommendations and comparisons published on this blog reflect our analysis and experience. When we talk about partners or publishers such as Microsoft, Swisscom or Infomaniak, our objective is to present the solutions objectively, highlighting their advantages as well as their limitations depending on the different contexts of use.
Flux Group cannot be held responsible for any direct or indirect consequences resulting from the use of the information published on this blog. Links to external sites are provided to complete the information; their content is the responsibility of their respective publishers.
© Flux Group – All rights reserved.
Our services
If you wish to be supported in the choice, deployment or optimization of your IT solutions, the Flux Group experts are at your disposal. We support SMEs in Geneva, Switzerland and Pays de Gex in their Microsoft 365, cybersecurity, cloud, telecommunications, managed IT services and IT infrastructure projects.
Questions fréquentes
Why can a Geneva SME be an indirect target?
Accounts, data and exchanges with suppliers may be of interest to an attacker, particularly when they open a path to other organizations. Let's take a fictitious SME from Meyrin which manages its orders by messaging and entrusts part of its digital services to a service provider. A compromised account could expose trades or disrupt order processing. The level of risk also depends on the access granted and the dependence on these tools. To better understand your exposure, map the essential services, the people who can access them and the operations that would be interrupted if an account or service provider becomes unavailable. This analysis relates risk to its effects on the business, rather than the size of the company or the visibility of the threat.
What criteria should be used to prioritize cyber risks?
Start by identifying the business functions and data involved: order processing, access to customer files, invoicing or internal communication. Then ask yourself what operations would be disrupted, who would be impacted, and what resources would be needed to resume the activity. This table is used to structure an internal discussion, not to certify your level of security. The scenarios are fictitious: adjust their plausibility and impact to your systems and processes. For each line, record the missing information and the verification required. You thus transform a general concern into a concrete decision, without giving false precision to the evaluation. CISA Cyber Essentials can complement this with preparation resources.
Is an SME really an interesting target for cybercriminals?
Yes, an SME can be of interest to cybercriminals, even if it is not targeted for its notoriety. Access to data, payments or partner systems may represent an opportunity. The cyber risks most underestimated by SME managers include these indirect access routes. In Geneva, as elsewhere in Switzerland, assess what an attacker could achieve rather than relying solely on the size of your company.
Is antivirus enough to protect a small business against cyber risks?
No, antivirus is a useful measure, but it doesn't cover all scenarios. It does not replace identity checks, system updates, online account protection or a response procedure. For example, an employee can enter their password on a fake login page without a malicious file being downloaded to their computer. Protection must therefore cover positions, accounts and uses.
How do I know if my company's backups can be restored?
Ask the person responsible to retrieve a representative file according to the usual procedure, then verify that its content is usable. A report should specify the data tested, the date of the test, the difficulties encountered and the people capable of repeating the operation. Also check that the rights necessary for the restoration are accessible to the right people. A message indicating that the copy has completed does not, by itself, demonstrate that it will meet business needs.
What to do first when a business account appears compromised?
Notify the IT or support person immediately and avoid using the account to send messages or approve requests. From a trusted device, revoke active sessions and secure relevant access, according to your company's procedure. Retain messages and information useful for analysis. Then check recent activity, including email forwarding rules and unusual requests sent on behalf of the account.
Does the Swiss FADP impose the same cybersecurity measures on all SMEs?
The FADP does not result in an identical technical list to be applied uniformly by all companies. Security measures must be adapted to the personal data processed and the risks associated with their processing. An SME that manages sensitive files does not necessarily have the same needs as a company that uses little personal data. Map out your treatments and protections, then seek legal advice if you need to determine your obligations in a specific situation.
Why can supplier access represent a risk for an SME?
Granted access to a vendor can open a door to your company's systems or data. The risk increases if the rights exceed the expected task, if several participants use the same account or if access remains active after the end of an intervention. Assign individual, limited access as needed, document who authorizes it, and remove it when the collaboration or task ends. This discipline also makes it easier to examine unusual activity.
Besoin d'un accompagnement IT à Genève ?
Parlons de votre infrastructure, de votre sécurité ou de votre téléphonie. Sans engagement.
Contacter Flux Group