How Secure Is Your Company, Really?

It was a perfectly ordinary Monday morning at TechVision AG*, a solid Zurich-based software company with 80 employees. TechVision AG had always been confident it had "good IT." Until accountant Schläpfer opened an email that morning – one that appeared to come from Raiffeisen Bank.

Seventy-two hours later, all the company's data was encrypted. So was the backup server. The ransom demand followed quickly: CHF 180,000. What sets TechVision AG apart from thousands of other Swiss SMEs? Nothing really. And that's precisely the problem.

"We've never been attacked" is not a security strategy
The most common answer we hear at Centriq when we ask companies about their information security: "We've never had any problems." A dangerous statement because it creates a false sense of security. It’s not about whether you've been attacked. The critical question is this: "Would we even notice if someone were inside our network?" And most executives have no answer to that.

According to ENISA (European Union Agency for Cybersecurity), companies take an average of 207 days to detect a breach. In other words: attackers spend more than six months quietly extracting data, preparing systems and installing backdoors.

10 questions for your lunch break
To make a first assessment of your security posture, you don’t need a consultant or an expensive tool. All it takes is answering these ten questions honestly:

1. When did you last restore a full backup – not just run one?
   The right answer: We test at least every six months. Because we know: an untested backup is worthless.
2. How long would it take you to notice someone was inside your network?
   The right answer: 24 hours, with SIEM.
3. How many admin accounts actually exist in your Active Directory?
   The right answer: Fewer than five – because anything above five without explanation is too many.
4. Do all admin accounts have Multi-Factor Authentication (MFA) enabled?
   The right answer: Yes, 100% – no exceptions, no excuses.
5. Do your employees know the security policies? Have they ever actually read them?
   The right answer: Yes – we have signed confirmations from everyone.
6. When were the servers last patched? Are there systems that haven't received an update in more than 90 days?
   The right answer: We patch critical systems within 48 hours. Because without patches, all “doors” are wide open.
7. Have external service providers with access to your systems signed a non-disclosure agreement?
   The right answer: Yes – because any external access without an NDA is a legal and security risk for us.
8. What happens if your most important IT staff member leaves or falls ill tomorrow?
   The right answer: We have a documented contingency plan, and cover arrangements are in writing.
9. Have there been any security incidents in the past twelve months?
   The right answer: We had incidents in the past. Since we started documenting everything, analysing it and systematically fixing vulnerabilities, nothing has happened since.
10. Who in your company is responsible for information security? "The IT team" – or is there someone with a clear mandate and a budget?
    The right answer: We have assigned, defined and funded the role clearly.

What your answers mean
Did you have no clear answer to more than three questions – or did you think you'd better check with IT first? Then your company has a security gap. But you're not alone. Most Swiss SMEs have security gaps, often without even realising. If you had no answer to more than seven questions, what happened to TechVision AG could happen to you at any time.

What a security incident really costs
The direct costs of a ransomware attack – ransom, recovery, forensics – are painful. But the indirect costs – the ones nobody talks about – hit harder.

• Operational downtime: an average of 21 days of disrupted operations following a ransomware attack (Sophos State of Ransomware Report)
• Loss of client trust: particularly devastating for B2B companies that handle sensitive customer data
• Regulatory consequences: under the Swiss Federal Act on Data Protection (FADP) and, depending on your client base, the General Data Protection Regulation (GDPR), a data breach must be reported within 72 hours – and the stakes are high
• Insurance exclusions: many cyber policies won't pay out if basic measures like MFA were not in place
• Reputational damage: a data breach story in the NZZ or Tages-Anzeiger stays with your company forever

The first step: see what's there
The good news: information security is not an unsolvable problem. There are proven standards and methods – and a clear first step that doesn't require expensive technology or a major project. Everything starts with an honest assessment: what do we have, and what's missing? Where are the biggest risks? This structural analysis typically takes one to two days for a mid-sized SME. It gives you a clear picture of your security posture, identifies what to address first, and provides a realistic cost estimate."

Want to know how your company really stacks up? We'll run a structural analysis and show you clearly and directly where you stand today. Book a no-obligation initial consultation by email: security@centriq.ch

Next in this blog series:
What is an ISMS – and do I actually need one? We explain why information security isn't an IT issue. It's a leadership issue.

*TechVision AG is a fictional company that will regularly appear in the coming blog articles.