How the Board of Directors can boost cyber resilience

Cyber attacks have risen sharply in both frequency and level of sophistication over recent years, so this swissVR Monitor returns to the issue of cyber resilience, which it last investigated in swissVR Monitor II/2023. The considerable losses companies can suffer as a result of a cyber attack make it essential that Boards tackle cyber resilience as part of their mandate, achieving a clear understanding of their role and resulting responsibilities in this area. This edition of swissVR Monitor explores the possible impact of cyber attacks, the counter-measures companies are taking and management reporting to the Board on cyber-related issues.

Incidence and impact of cyber attacks

Four out of every ten Swiss Board members (41%) report that their company has been the victim of a cyber attack. This question was last asked in 2023, when the proportion was 28% (swissVR Monitor II/2023), indicating an increase of almost half (46%) in the number of companies reporting such an attack.

The increase in reported cyber attacks over the past three years focuses particularly on small and medium-sized companies: the number of such companies reporting a cyber attack has almost doubled, from 20% to 37%, since the last time this question was asked, whereas the proportion of large companies reporting such incidents has remained almost unchanged (48% in swissVR Monitor II/2026 as against 45% in swissVR Monitor II/2023). While large companies remain more vulnerable to cyber attack because of their size, small and medium-sized businesses are increasingly falling victim to such attacks. Therefore, the issue of cyber resilience is not a matter of company size, but an existential threat to all companies.

Developments in artificial intelligence (AI) mean that criminals are now able to cause significant damage to companies more easily and more rapidly. So what preparations have companies made specifically for the increased threat of cyber attack?

Around three-quarters of all companies (74% across the bottom three bars in the chart below) do not currently have a written strategy for tackling AI-based cyber attacks. Of the remaining companies, 8% report having a strategy for at least part of the company and 18% that they regularly brief the Board on the implementation and effectiveness of this strategy. It is important to note here that simply having a strategy for tackling AI-based cyber attacks and reporting to the Board on its effectiveness does not provide any direct indication of how well a company would able to defend itself against a cyber attack.

Company size also plays a key role in Swiss companies’ level of preparedness. Just 18% of small companies have a strategy for tackling AI-based cyber attacks, compared with 40% of large companies. Reasons for this finding may be the link between company size and frequency of cyber attacks or the fact that large companies are more likely that smaller ones to discuss and act on cyber-related issues, such as through their IT function or by having a Chief Information Security Officer (CISO).

The Board of Directors and cyber resilience

The Board of Directors has various sources of expertise to draw on when it comes to cyber resilience. Most Swiss Board members (62%) rely on the company’s management to provide the Board with this expertise, with only one-third (32%) reporting that their Board includes a member with cyber and/or IT expertise. In almost one-quarter of cases (24%), Boards receive advice from an external expert, while 8% of Boards have no cyber expertise.

Large companies are more likely than small companies to have large Boards, so it is unsurprising that their Boards are more likely to include members with cyber and/or IT expertise (41% of Boards of large companies compared with 28% of Boards of small companies). Boards in the ICT and corporate services sectors are more likely to include members with cyber and/or IT expertise (53% and 41% of Boards respectively), whereas Boards in construction, pharma and life sciences, and manufacturing and chemicals are less likely than the average to include members with such expertise (20%, 19% and 16% respectively).

Key issues for the Board of Directors

The most frequently cited issue facing Swiss Boards over the next 12 months is improving efficiency and optimising internal processes (cited by 33% of Board members). This issue ranked fourth in swissVR Monitor I/2026, probably because – as explored in that report – companies are now rolling out and refining artificial intelligence (AI) applications.

The second and third most important issues Boards will be facing over the next 12 months are risk management (cited by 29% of respondents) and digitalisation, robotics and automation (cited by 28%). Risk management has fallen one place in the rankings compared with I/2026, while digitalisation has risen three places.

The growing importance of IT (cited by 19% of respondents), security management (including cyber resilience) (18% of respondents) and go-to-market strategy (also 18%) is striking, given that these issues did not previously feature among the top ten issues cited by Board members. In contrast, formulating a new corporate strategy – also cited by 18% of respondents – has fallen dramatically in the ratings, from second place to eighth.

Modest improvement in the outlook for the Swiss economy

Board members are slightly more optimistic in their expectations for the economic, sector and business outlook for the next 12 months than in swissVR Monitor I/2026 and swissVR Monitor II/2025. The findings suggest an upward trend, albeit still modest. This is surprising given the many risks and uncertainties the Swiss economy continues to face, including tensions in the Persian Gulf, the possibility of new tariffs on Swiss exports to the US, a further rise in the value of the Swiss Franc compared to other currencies, and the ongoing economic weakening of key foreign markets.

Interviews

About the survey
 

swissVR Monitor is based on a survey carried out jointly by swissVR in collaboration with Deloitte and the Lucerne University of Applied Sciences and Arts. The aim of this bi-yearly survey is to gauge Board members’ attitudes to the outlook for the economy and business as well as corporate governance issues. swissVR Monitor also aims to share with the wider public the ways in which Board members perceive their role and the current economic situation. Each edition also explores a special focus topic and conducts interviews with experts. A total of 281 Board members took part in the current edition of swissVR Monitor, providing a good overview of the views and challenges facing board members in Switzerland.