Key findings for Switzerland
New world, new rules: Cybersecurity in an era of uncertainty
Cybersecurity is entering a new phase. AI is changing both the nature of cyber threats and the tools available to defend against them. At the same time, geopolitical uncertainty and growing dependencies across technology ecosystems are making the risk landscape more complex.
For Swiss organisations, keeping pace with emerging threats is only part of the challenge. They also need to build resilience as AI, data, cloud infrastructure and third-party dependencies become increasingly interconnected – and vulnerabilities in one area can quickly affect others.
The survey was conducted between 6 May and 15 July 2026. AI has developed at remarkable speed since then. As a result, AI-related risks are likely to have moved even further up the corporate agenda, with the focus broadening from unintended access to sensitive data to the risk of increasingly autonomous AI systems.
This puts the fundamentals back in focus. Strong cyber foundations, trusted data and resilient operations remain essential, while organisations also need the agility to respond to new risks and use AI securely and responsibly.
PwC’s 2027 Global Digital Trust Insights survey captures how cyber leadership is adapting to an ever-changing, increasingly AI-powered cyber landscape. The study reflects the views of more than 3,900 business and technology leaders – including 54 from Switzerland – across 71 countries and a broad range of industries and organisation sizes. Nearly two-thirds of Swiss respondents hold business roles, while almost six in ten represent organisations with global revenues exceeding USD 1 billion. They provide valuable insights into how Swiss organisations are responding to cyber risks and opportunities – across strategy, AI, emerging technologies, people and leadership.
Risk and threat landscape AI takes the top spot
The no. 1 cyber threat organisations are least prepared to address is AI-powered attacks.
The threat landscape is becoming more complex as AI creates new attack vectors and geopolitical uncertainty increases exposure across interconnected technology ecosystems. About half of organisations globally and in Western Europe rank attacks generated from AI systems among the cyber threats they feel least prepared to address. More than half also cite autonomous botnets among their biggest concerns, alongside adversarial attacks, data poisoning and adaptive malware. Given the rapid evolution of AI since the survey was conducted between May and July, these risks are likely to warrant even greater attention today. Organisations were already alert to AI-related risks, but what has become much clearer in the months since is the speed, scale and power with which AI capabilities are evolving – and with them the cyber threats they pose.
Geopolitical developments are also reshaping cyber strategies. In Switzerland, 44% of survey respondents are adapting their approach to vendor and supply-chain risk; the same share is expanding threat intelligence and reviewing the resilience and location of critical infrastructure. Yet 9% of Swiss respondents plan no significant changes, compared with 4% in Western Europe and 6% globally – suggesting that a small but notable group sees no immediate need to adapt.
Supply chains are another key concern. Globally and in Western Europe, around half of organisations are strengthening software development and delivery or stepping up efforts to manage cyber risks from suppliers. This reflects a broader shift towards managing dependencies across the digital ecosystem, including software, third and fourth parties. In operational technology, the challenge appears to be less about recognising the risks than having the capabilities to address them: gaps in OT/IIoT cybersecurity skills and resources rank as the top challenge globally and in Western Europe (38% each).
Switzerland, meanwhile, shows comparatively strong implementation of fundamental data-risk measures, outperforming global and Western European peers in areas including data classification, data loss prevention, data quality and data discovery. Data minimisation is a notable exception. As AI becomes more deeply embedded in business processes, the challenge is to ensure that data remains secure, trustworthy and appropriately governed throughout its lifecycle.
“AI has not replaced the cyber risks of the past two decades – it has amplified them. Familiar threats can now evolve faster, operate at greater scale and become significantly more sophisticated. This changes both the nature of the threat and the speed at which organisations need to respond.”
Cyber resilience is increasingly determined by the weakest links across an organisation’s digital ecosystem. Swiss firms need greater visibility into their dependencies – from data and critical infrastructure to software, suppliers and fourth parties – and the capabilities to manage them.
Look beyond your own perimeter – identify dependencies, close capability gaps and build resilience across the ecosystem.
Cyber strategy and operations AI moves from cyber threat to cyber defence
84% of organisations plan to increase cyber spending in 2027, with AI-driven security enhancements as a top investment priority.
Against a rapidly evolving threat landscape, 84% of organisations globally plan to increase cyber spending in 2027, up from 78% last year. AI is reshaping where that investment goes. Globally, 58% of organisations rank AI as their top cyber investment, ahead of cloud security at 46% and data trust at 39% – up sharply from 36%, 34% and 26%, respectively, last year. Within AI-related cyber investment, responsible AI governance and compliance, platform hardening and supply-chain security lead the priorities.
In Switzerland, the investment picture puts data protection and data trust firmly at the top, cited by 59%, followed by optimisation of existing technology and investments at 52%. Defending against AI-enabled attacks and ongoing security training both stand at 46%. By contrast, preparing for quantum computing risks is cited by just 13%, suggesting that more immediate AI and data challenges are taking precedence.
But AI is not only a risk to defend against – it is increasingly part of the defence itself. Half of organisations globally prioritise AI for threat detection and alerting, followed by fraud and phishing detection, incident triage and vulnerability prioritisation. This is where AI can deliver tangible value for cyber teams: helping security operations centres identify threats, prioritise incidents and respond more effectively.
Geopolitics is also reshaping technology strategies. Globally and in Western Europe, organisations are reducing concentration risk through multi- and hybrid-cloud strategies, regional redundancy and sovereign or region-specific cloud providers (see also our latest Cloud Business Survey). This puts technology sovereignty and cloud dependency increasingly on the cyber agenda. At the same time, operational resilience depends on more than technology: when working with critical third parties, lack of clarity over shared security responsibility remains an important cyber concern.
Higher spending alone does not ensure resilience. Globally, 39% of organisations already have fully formalised and integrated continuity plans addressing cyber threats, while a further 38% are developing them. The practical test is whether critical operations can continue during disruption. Organisations need to identify what must keep running and test recovery plans with the technology providers and suppliers supporting these operations.
“Swiss firms are clearly investing in modernisation, but the challenge is ensuring that spend translates into measurable resilience. Technology alone won’t solve the problem; it takes a well trained and governed organisation, hardened fundamentals, rehearsed playbooks, and the ability to respond and recover at speed.”
Turn cyber investment into resilience by focusing on the capabilities that matter most – from AI and data protection to technology dependencies and operational continuity.
Invest in resilience – not just for today’s threats.
Build a cyber strategy designed to adapt – and endure.
Artificial intelligence AI autonomy meets Swiss caution
Swiss organisations are embracing AI in cyber defence – but remain reluctant to hand over control without human oversight.
As AI moves deeper into cyber operations, the question is no longer simply whether to use it, but how much control to hand over. Switzerland takes a notably cautious stance. Only 11% of Swiss respondents would allow AI agents to independently execute the full range of cyber defence actions without human approval – half the global share. Most prefer to retain human oversight or limit autonomous action to lower-risk tasks.
This caution appears closely linked to trust. Reliability and maturity of AI technology is the leading barrier to greater autonomy in Switzerland, cited by 59%. Regulatory constraints, accountability and explainability are also prominent concerns. The challenge is therefore shifting from AI adoption itself towards defining how people and agents work together, with clear accountability and controls that reflect the level of risk involved.
Globally, organisations moving towards greater autonomy are starting with clearly defined security tasks such as threat intelligence, phishing containment and malware remediation. More consequential actions remain more likely to involve human oversight. Expanding AI autonomy safely requires clear safeguards and mechanisms for human intervention. Organisations must ensure that AI agents cannot override critical controls and that fallback procedures are in place if models fail or are compromised.
"The next step in AI-enabled cyber defence is not simply more autonomy, but trusted autonomy. Organisations need to know where AI can act independently, where human judgement remains essential and which controls must be in place before that boundary can safely move."
AI agents can accelerate cyber defence, but autonomy needs to be earned. Define where AI can act independently, who can intervene and how operations can be maintained if AI fails. Put governance, accountability and controls in place before expanding its authority.
Build trust before you hand over control.
Emerging technology AI takes priority, but quantum cannot wait
As AI moves rapidly up the cyber agenda, organisations must also prepare for less immediate but potentially far-reaching technology risks.
Emerging technologies are creating a growing range of cyber risks, but organisations are not addressing them at the same pace. Globally, 5G/6G and agentic AI currently lead the emerging technologies whose cyber risks are incorporated into continuously updated risk management plans. Quantum computing sits further down the list – reflecting a challenge that is potentially profound, but less immediate and harder to translate into action today.
In Switzerland, quantum readiness remains at an early stage. Only 6% of organisations are implementing quantum-resistant security measures, compared with 21% globally. Most Swiss respondents are still exploring, piloting or testing their approach. The gap underlines the need to advance quantum preparation alongside current AI-related priorities. The financial sector is further ahead, suggesting that the overall figure of 6% understates progress among banks. FINMA requires supervised institutions to establish a quantum-readiness plan by mid-2027, a move likely to raise awareness and accelerate preparations.
While implementation remains limited, Swiss organisations beyond the financial sector are also taking concrete steps towards quantum readiness. These include assigning clear responsibility, tracking new security standards and preparing cryptographic systems for change. Such foundations are particularly relevant for organisations with long-lived sensitive data and complex technology environments, where migration to quantum-resistant security could take years.
"AI may be dominating today’s cyber agenda, but quantum risk has not gone away. Organisations cannot wait for quantum computing to mature before they prepare: understanding cryptographic exposure and building the ability to adapt are steps they must take today."
Quantum readiness needs to move from exploration to execution. It should be treated as part of the wider digital and cyber strategy: strengthening data protection today while laying the foundations for quantum-safe security tomorrow. Acting early allows organisations to shape standards, embed lifecycle mitigations into the organisation, and secure an edge in a rapidly changing risk landscape.
Don’t wait for quantum to arrive – build quantum-resilient defences today.
Cyber leadership Cyber needs to become a business issue
Swiss organisations still have work to do to embed cyber risk into boardroom discussions and everyday business decisions.
Cyber risk has reached senior leadership but is not yet consistently embedded in business decision-making. In Switzerland, only 35% of respondents strongly agree that cyber risk is a standing board agenda item, compared with 47% globally. Even fewer – 20% versus 34% globally – say business decisions routinely trigger a cyber risk assessment. Cyber therefore still appears to be treated more as a technology concern than as an integral part of business risk.
Embedding cyber into leadership decisions also means demonstrating how cybersecurity contributes to business outcomes. Globally, leaders use measures ranging from compliance and control effectiveness to incident trends, business continuity and financial exposure to assess whether cyber strategy is reducing enterprise risk. The focus should increasingly move beyond measuring maturity against frameworks towards demonstrating the effectiveness of cyber initiatives.
The leadership challenge is broadening further with AI. Responsibility for AI governance and risk management spans technology, cyber, data, risk, legal and other business functions. Collaboration needs to be backed by clear ownership of decisions and their consequences.
Alongside governance, leaders also need to focus on the people behind cyber resilience. Organisations are prioritising career development, a strong cyber culture and training employees to work alongside AI-enabled tools. That includes the skills to question AI outputs and intervene when needed. Managing workload and burnout remains important in high-pressure cyber roles. Developing and retaining the right talent is therefore a key part of cyber resilience.
Cyber maturity is not the end goal – effectiveness is. Leaders need to look beyond frameworks and focus on whether cyber investments are actually reducing business risk.
Make cyber risk part of business decision-making, not just the technology agenda. Connect cyber investment to measurable business outcomes, establish accountability across functions and ensure leaders have the insights they need to make risk-informed decisions.
Move from cyber maturity to measurable business impact.
Conclusion Building trust in a world of uncertainty
Cybersecurity has evolved from defence to differentiation. As technology accelerates and global risks grow more complex, trust has become the defining measure of resilience.
Swiss organisations are investing more and modernising faster than ever. They are also experimenting with AI – but gaps remain in governance, quantum readiness, and leadership. The next phase is not about reacting to threats, but mastering change: embedding security into strategy, turning data protection into innovation, and making cyber a catalyst for growth.
The opportunity is now. To build digital trust that endures, organisations should:
Strengthen data and AI governance to turn control into confidence.
Improve cyber risk modelling to help target investments
Invest in AI training and skills development for employees
Integrate CISOs as partners in transformation and value creation.
Begin quantum readiness today to protect tomorrow’s data.
Cybersecurity is more than protection – it’s the foundation of trust, competitiveness, and resilience in a connected world.
Download the survey
https://pages.pwc.ch/view-form?id=701Vl00001i6sVJIAY&embed=true
Contact us
Chris Girling
Ashish Gupta