Cyber Insurance Summit 2026: Cyber resilience does not arise single-handedly

In the weeks leading up to the event on 5 November 2026, a series of serious cyber incidents in Switzerland attracted attention. Among those affected were pension funds, municipalities, administrative bodies and sports federations. This set the scene for the Cyber Insurance Summit: cyberattacks cut across business, public authorities and society. Every company is a potential target, but far from all are sufficiently prepared. At the same time, AI is accelerating the pace: vulnerabilities can be identified more easily and attacks can be scaled more quickly. However, AI also offers opportunities on the defence side: it can make IT systems and software more secure, for example by detecting vulnerabilities in program code earlier, as the PHP incident in mid-October 2026 showed. This makes it all the more important to be prepared, to identify trends at an early stage and to cushion the first wave of attacks. With these words, Manuel Suter, Deputy Director of the Federal Office for Cybersecurity (FOCS), set the tone for the event for visitors.

In addition to its relevance to current events, the afternoon’s topic followed the lifecycle of a cyberattack—from prevention to the attack itself and on to prosecution. In his keynote, Roger Knoepfel from the Zurich City Police explained why law enforcement in the digital space is particularly challenging. Cybercriminals act highly professionally and are internationally networked. “Cybercrime-as-a-service” is organized like a service offering. While the victims are in Switzerland and local infrastructure is affected, the perpetrators and data are often abroad. To combat cybercrime effectively, authorities and the private sector therefore rely on close information sharing and cross-border cooperation.

Christian Fichera, Head of IT and Cybersecurity at Swiss Infosec AG, demonstrated in the first keynote talk, using a deepfake of SVV CEO Urs Arbter, how easily familiar faces and voices can be manipulated. Just 30 seconds of audio material are enough to produce a voice clone for an attack. With the help of freely available tools, deceptively realistic real-time interactions are possible. “Seeing and hearing no longer proves identity,” Fichera noted. The most effective countermeasures are nevertheless comparatively simple: call-backs via known numbers, the four-eyes principle, clear payment limits and defined verification pathways. Not perfect detection of a fake, but robust processes stop the attack.

In the second keynote, Remo Muggli, Managing Director and co-owner of Stewards AG, made it clear that even small companies are not immune to cyberattacks. It was only after an inquiry from a journalist that his company learned that hacked personnel data was being offered for sale on the darknet. This was followed by a technical investigation, reports to the police and the data protection authority, as well as communication with employees and customers. Particularly challenging was the fact that the hosting partner had at times been barely reachable. “Being uninteresting isn’t enough to be protected,” Muggli warned. His conclusion: companies must not delegate responsibility entirely to IT service providers, even if they depend on them. They must actively demand security measures, define responsibilities, and prepare for the worst-case scenario. A cyber insurance policy could limit damage, but it does not replace personal responsibility, Muggli emphasized.

Heinz Tännler, member of the Cantonal Government and Finance Director of the Canton of Zug, placed cyber prevention as a location factor at the center of the third keynote speech. Trust would also determine where companies invested, set up operations, and created jobs. Zug therefore focuses on prevention, testing, and research. To this end, the canton works, among others, with the ITSec4KMU Competence Center and the National Test Institute for Cybersecurity (NTC). In addition, as part of the Zug Cybersecurity Initiative (CSI), the Canton of Zug is planning a long-term research collaboration with ETH Zurich.

The survey presented by Florian Widmer, Partner Cyber Security at Deloitte Switzerland, revealed a clear discrepancy: almost half of the employees surveyed said they had experienced a serious cyber incident at their employer in the past three months. Nevertheless, only around one fifth rated the cyber risk as high. “Cyberattacks on SMEs threaten the stability of our economy,” Widmer warned.

This perception gap does not come without consequences. Smaller companies in particular do not implement basic protective measures consistently. In addition, in 2025 only 11.5 percent of companies based in Switzerland had cyber insurance. This results in a need for action on several levels: companies must strengthen their foundations, the federal government must create clear framework conditions, and insurers must make access to suitable solutions easier.

The panel discussion on the topic “Interdependent: the state, companies and insurers in the fight against cyberattacks” brought these perspectives together. On the panel sat Professor Sita Mazumder from Lucerne University of Applied Sciences and Arts, Andreas Schmitt, Global Head Cyber at Zurich Insurance, Heinz Tännler, member of the cantonal government and Finance Director of the Canton of Zug, and Darja-Anna Yurovsky, Head CERT & Community SOC at Switch. The discussion began with the question of who bears responsibility before, during and after a cyberattack.

It became clear: even if an IT provider takes on important tasks, the affected company remains responsible. Cybersecurity is still often viewed by executive management as an operational issue. At the latest when systems are down after an attack and operations are disrupted, its strategic importance becomes apparent. Cyber risks therefore belong on the executive management agenda. Sita Mazumder summed up: “The decisive question is: How do I need to position myself so that my company is up and running again as quickly as possible after an attack?”

This includes a crisis team, clear reporting and communication channels, functioning backups and regular exercises. Cyber insurance is one line of defence, but not the only one. Its role also does not begin only with a financial payout in the event of a loss. Risk advisory services, prevention, connecting companies with suitable experts, and tested response plans can also help ensure that companies remain able to act.

At the same time, the panel argued for a simpler and more pragmatic approach to cybersecurity. Products and requirements should be understandable and minimum standards practical. At the same time, faster information sharing between companies, insurers and authorities is needed. The goal is “digital buckling up”: safe behaviour when handling devices and data should become as natural as wearing a seatbelt in a car, Darja-Anna Yurovsky emphasised.

In conclusion, SVV CEO Urs Arbter emphasized the importance of prevention. It creates security for the individual company while also strengthening society’s resilience. In doing so, Arbter drew a parallel with fire insurance. Its broad anchoring created acceptance for joint preventive measures, such as financing fire brigades via the so-called “Löschfünfer.” A similar network effect should also be leveraged for cyber risks, in order to enable broad coverage at affordable premiums.

Insurers are therefore also being called upon. Financial compensation in the event of a loss forms the core of the product, and that is where insurers can score points, Arbter said. Accessibility and concrete support are a basic prerequisite. At the same time, suitable framework conditions and dialogue between insurers, policyholders, authorities, and regulators are needed. Regulation can enable such solutions, but if designed inappropriately it can also weaken insurance markets.

The Cyber Insurance Summit 2026 thus made it clear: cyber resilience emerges where personal responsibility, prevention, insurance, and suitable government framework conditions interlock.