Bridging the gaps to cyber resilience: The C-suite playbook

Threat outlook and risk modelling improvements

Cyber risks remain the top concern for Swiss business leaders in 2025

As cybersecurity threats become more volatile and unpredictable, organisations are challenged to manage an expanding attack surface driven by cloud, AI, connected devices, and reliance on third parties.

One thing stands out: cyber risk remains the top concern for Swiss business leaders in 2025. While 65% of Swiss executives prioritise mitigating cyber risks over the next 12 months, this figure is 57% globally. In a year marked by geopolitically motivated cyber attacks on Switzerland, it is perhaps unsurprising that Swiss businesses are more concerned about cyber risks than the global average. In addition, organisations undergoing cloud transformation, with an increasing number of cloud migration projects, face added complexity as these changes can heighten cybersecurity and privacy concerns.

Cloud threats: a disconnect between concern and preparedness remains

The top three cyber risks for Swiss businesses are cloud-related threats, hack-and-leak operations, and ransomware attacks. While cloud security (49%) and hack-and-leak attacks (41%) ranked higher in Switzerland than the global average, concern about third-party data security risks (29%) was notably lower, which is surprising given the FINMA’s June 2024 report on cyber incidents in the financial sector in 2022 and 2023, which highlighted that over half of these incidents involved outsourced services. In contrast, concern about ransomware (39%) was significantly higher in Switzerland than the global average, suggesting that Swiss organisations do not yet feel fully prepared to respond to or recover from such attacks.

Globally of particular note is the gap between concern and preparedness for cyber threats: cloud threats are the number one threat for 42% of organisations worldwide, yet 34% of organisations say they are least prepared to deal with cloud-based attacks.

67% of Swiss firms increase their cyber budgets

While 54% of Swiss companies planned to increase cybersecurity spending in 2023, this number rose to 70% in 2024. Looking ahead to 2025, 67% of Swiss companies and 77% globally intend to increase their cyber budgets.

On the other hand, 22% of Swiss organisations plan to keep their cybersecurity spending unchanged, compared to just 11% globally. In comparison, Swiss companies are less polarised than their global counterparts, where fewer companies plan to keep their cyber budgets flat and a larger percentage either increases or decreases spending. This suggests that after several consecutive years of moderate growth in cyber spending, Swiss businesses feel the need to continue this trend.

Business and tech leaders have lower engagement with cyber leaders

The allocation of cyber budgets reflects the differing priorities of business and technology leaders. For business leaders, the primary areas of investment include data protection and trust (48%) as well as addressing technical debt by modernising technology infrastructures (43%). This includes enhancing cybersecurity measures, improving security training, and optimising current technologies and investments to strengthen overall resilience.

Technology leaders focus on cloud security (34%), data protection and trust (28%), and network security and continuity (27%). They also plan to increase investment in emerging technologies such as generative AI (GenAI) and machine learning, recognising their potential to transform both security operations and organisational efficiency. As organisations race to realise the new opportunities brought about by AI technology, cyber leaders recognise that it also requires new approaches to managing data protection, integrity, and ethical concerns, which is driving the focus on this topic. 

Download the survey

Strategy and Cyber

Cyber resilience: strategy and implementation

In terms of implementing cyber resilience measures, Swiss organisations are making significant strides forward with many ahead of their global counterparts. A majority have identified critical business processes and deployed technological cyber recovery solutions.

While this progress reflects a positive trend, there is a notable dichotomy within Switzerland. Some companies are clearly leading in their cyber resilience strategies, but many others lag, leaving critical gaps.

While many Swiss organisations are adopting recovery technologies and playbooks, relatively few have conducted comprehensive tests, such as tabletop exercises, raising concerns about the true level of preparedness to manage a cyber incident. Without regular simulations or readiness tests, it’s not guaranteed that the technologies and plans will live up to expectations.

The road ahead: strategic objectives for cyber and privacy in the coming year

In the coming year, many organisations will increase their focus on cyber resilience, not only to respond more quickly to incidents, but also to improve the ability of their leaders to effectively manage cybersecurity threats. This focus is driven by the need to stay ahead of evolving threats and secure their position in the marketplace.

Swiss organisations have set specific priorities for the next 12 months, with almost half aiming for faster incident response times, compared to about a third globally. This highlights the critical need to mitigate potential disruptions in real time. In addition, improving leadership confidence in managing current and future cyber threats is a priority for 37% of Swiss companies, compared to 31% globally. In line with global trends, nearly a third of Swiss organisations are focussing on cybersecurity – and the use of managed services to enable regulatory compliance and accelerate entry into new markets are also key objectives.

However, improving cybersecurity to enhance the customer and employee experience is a 2025 priority for only 22% of Swiss organisations, below the global average of 30%. Almost a third of Swiss organisations are investing in cyber to drive their entry into new markets, highlighting that the gaps between international and cross-sector regulatory requirements that need to be bridged for growth and diversification are larger than international norms.

Cybersecurity as a competitive advantage

Cybersecurity is increasingly seen as a key competitive advantage for organisations. In Switzerland, customer trust is the top area where this advantage is realised, with 55% of companies positioning cybersecurity as a driver of trust, close to the global average of 57%.

Brand integrity and loyalty, as well as resilience to business disruption, are recognised by 33% of Swiss organisations, compared to higher global figures of 49% and 43% respectively. This indicates that Swiss companies could further leverage cybersecurity to strengthen their brand and customer loyalty. In addition, public relations, business growth, and brand loyalty are seen as areas where cybersecurity provides an advantage.

Globally, there has been a trend over the past two years for companies to use cybersecurity investments to gain a competitive advantage. Banks have launched cybersecurity investment funds to offer solutions to clients, while insurers are increasingly helping clients to quantify their cyber risk exposure and find ways to mitigate it. Recent acquisitions of cyber security companies by financial sector participants underscore how cybersecurity is now seen as a driver of growth and differentiation for an increasing number of financial services leaders.

Download the survey

Cyber risk quantification: a missed opportunity

Bringing a cyber strategy to life requires more than awareness – it demands measurable action. Quantifying cyber risk is critical to prioritising investments and understanding the potential financial impact of cyber threats. However, this practice isn’t yet common in Switzerland.

None of the surveyed Swiss companies measure the potential financial impact of cyber risks to a significant extent – that is, they lack comprehensive cyber risk quantification with automation and executive reporting – compared to 15% globally. 44% of global businesses quantify or model risk to a large extent, compared to only 23% of Swiss companies. A third of the Swiss organisations assess cyber risk to a limited extent, relying on qualitative risk assessment and prioritisation. Only 3% plan to implement cyber risk quantification in the next two years (globally: 6%).

These figures suggest that Swiss companies may be less advanced than their global peers in deeply understanding and modelling their cyber risks, and therefore in grasping the financial impact of potential cyber threats.

Behaviours and awareness

Partial implementation isn’t enough for real cyber resilience

Despite mounting concern about cyber risks, most businesses are struggling to fully implement cyber resilience across core practices. This leaves a severe vulnerability – without enterprise-wide resilience, companies remain dangerously exposed to increasing threats that could compromise their entire operations.

A limited percentage of Swiss companies report that their cybersecurity teams ‘usually’ (81-100% of the time) perform key resilience activities. Only 20% of Swiss companies (versus 26% globally) have controls in place to withstand serious cyber disruptions and respond to threats quickly. 

Only one in six Swiss companies allocate cyber budgets to their top risks, highlighting a lack of confidence in cyber risk models and limited cross-business involvement of the CISO in budget allocation. This increases the likelihood that investment in cyber will be directed to less critical areas, with insufficient input from the wider organisation or a robust tieback to risk-based investment. 
 

Translating strategy into execution

While Swiss CEOs show a leading level of interest in cybersecurity topics, engagement between cyber leaders and leaders across the wider organisation is lower than the global average. Although Swiss CISOs report having acquired and deployed various cybersecurity and resilience solutions, limited board awareness, insufficient involvement from other business areas, as well as inadequate simulation and testing could prevent these solutions from meeting expectations in a crisis. 

Download the survey

https://pages.pwc.ch/core-asset-page?asset_id=701Vl00000Q8LTMIA3&embed=true