# Swiss Security Insights

> Independent cybersecurity analysis for Swiss CISOs, IT managers, and compliance officers — covering threat intelligence, FINMA/nDSG/NIS2 regulation, incident analysis, and security best practices.

Swiss Security Insights is an independent publication edited by Marco Scarito (CISSP · CISM · CRISC · CGEIT), with 22+ years in Swiss financial-sector information security, based in Lugano, Switzerland. Daily news articles are produced by an agentic newsroom of AI journalists, marked "(AI)" and approved by Marco before publication; analysis pieces are written by Marco. All content is in English and targeted at the Swiss market.

The site focuses on cybersecurity topics that matter specifically to Swiss organisations: NCSC advisories, FINMA circulars, nDSG/GDPR compliance, NIS2 implications, cantonal and federal infrastructure threats, and practical defensive guidance calibrated to the Swiss threat landscape.

## About

- **Editor-in-chief**: Marco Scarito — CISSP · CISM · CRISC · CGEIT, Lugano, Switzerland
- **Newsroom**: https://swisssecurityinsights.ch/about.php
- **LinkedIn**: https://linkedin.com/in/marcoscarito
- **Language**: English
- **Site URL**: https://swisssecurityinsights.ch
- **Contact / newsletter**: https://swisssecurityinsights.ch/newsletter.php
- **Machine-readable article index**: https://swisssecurityinsights.ch/llms-articles.json

## Key Pages

- [Home](https://swisssecurityinsights.ch/): Latest articles, threat landscape, and newsletter signup
- [All Articles](https://swisssecurityinsights.ch/articles.php): Complete article archive
- [About](https://swisssecurityinsights.ch/about.php): The agentic newsroom, its editorial process and the human editor

## Analysis

- [Apple Tightens macOS FDA: Swiss Compliance Read 2026](https://swisssecurityinsights.ch/articles/apple-tightens-macos-fda-swiss-compliance-read-2026.php): Apple is tightening macOS Full Disk Access controls after AI agents exposed mail, messages and browsing data without explicit user consent. (8 October 2026)
- [Governing an Agentic Newsroom: A CISO Case Study 2026](https://swisssecurityinsights.ch/articles/governing-agentic-newsroom-ciso-case-study-2026.php): How an AI drafting script became a supervised newsroom of AI agents, and the six security boundaries that govern it. A CISO case study. (4 October 2026)
- [EUVD: A New Vulnerability Signal for Swiss Teams](https://swisssecurityinsights.ch/articles/euvd-swiss-vulnerability-prioritisation-2026.php): ENISA’s EU Vulnerability Database gives Swiss security teams a regional signal for prioritising remediation, CRA exposure and supplier risk. (13 September 2026)
- [August 2026 Ransomware Record: Swiss Risk](https://swisssecurityinsights.ch/articles/august-2026-ransomware-record-swiss-europe.php): August 2026 set a ransomware record across Europe. Swiss organisations should turn the surge into measurable resilience action. (9 September 2026)
- [Swiss Healthcare Cyber Attacks Up 41%: 2026 Threat Index](https://swisssecurityinsights.ch/articles/swiss-cyber-threat-index-healthcare-attacks-2026.php): The Swiss Cyber Threat Index 2026 records 187 confirmed attacks on healthcare — a 41% surge. What the numbers mean before ISA reporting becomes routine. (9 August 2026)
- [OWASP LLM Top 10 2026: Swiss Enterprise Priorities](https://swisssecurityinsights.ch/articles/owasp-llm-top-10-2026-swiss-enterprises.php): OWASP reshaped its LLM Top 10 for 2026. Swiss teams should use it to reset AI threat models, supplier controls, and logging now. (4 August 2026)
- [Claude Code Trust: Swiss AI Supplier Controls 2026](https://swisssecurityinsights.ch/articles/claude-code-trust-swiss-supplier-controls-2026.php): How Swiss teams can assess Claude Code data flows, regional controls and prompt-injection risk without treating an allegation as evidence. (2 August 2026)
- [Exploit Speed vs Patch SLAs: Swiss FINMA and ISA Impact 2026](https://swisssecurityinsights.ch/articles/q2-2026-exploit-speed-patch-sla-finma-isa-swiss-2026.php): Q2 2026 data shows exploits ship 8 hours after Patch Tuesday. FINMA's 14-day patch SLA and ISA minimum standards cannot be met without automation. (23 July 2026)
- [AI Patch Gap: 25 CVEs a Day, 1.5 Fixes — Swiss Guide 2026](https://swisssecurityinsights.ch/articles/open-source-ai-patch-gap-swiss-vulnerability-management-2026.php): AI finds 25 open-source flaws daily while maintainers patch 1.5. What the 16.5:1 deficit means for Swiss vulnerability management under CRA and ISA. (12 July 2026)
- [AI Code in Production: Swiss SDLC Risk Guide 2026](https://swisssecurityinsights.ch/articles/ai-generated-code-production-swiss-sdlc-risk-2026.php): Half of engineering teams run AI-generated code in production while AI features fail pentests 2.7x more often. Swiss SDLC controls must adapt. (5 July 2026)
- [Financial Vendor Breaches Up 6.5x: Swiss Bank Risk 2026](https://swisssecurityinsights.ch/articles/black-kite-financial-vendor-breaches-swiss-banks-2026.php): Black Kite's 2026 report shows breaches among the top financial vendors rose from 6 to 39 in a year. What concentration risk means for Swiss banks. (5 July 2026)
- [Claude Fable 5's 19-Day Ban: How a Jailbreak Report Triggered US Export Controls on Anthropic's Flagship Model](https://swisssecurityinsights.ch/articles/claude-fable-5-us-export-control-ban-swiss-lessons-2026.php): US export controls pulled Claude Fable 5 offline for 19 days. The verified timeline, the jailbreak behind it, and what it means for Swiss AI governance. (3 July 2026)
- [WEF Cybersecurity Outlook 2026: Lessons for Swiss CISOs](https://swisssecurityinsights.ch/articles/wef-cybersecurity-outlook-2026-swiss-ciso-priorities.php): WEF 2026 report: AI drives 87% of cyber risk perceptions and identity is the dominant attack path. Priorities for Swiss security leaders. (7 June 2026)
- [Sovereign Cloud: How EU Regulations Reshape Swiss Cloud 2026](https://swisssecurityinsights.ch/articles/sovereign-cloud-dora-nis2-eu-ai-act-swiss-firms-2026.php): DORA, NIS2, and the EU AI Act are creating hard data residency constraints for Swiss FinTech and HealthTech firms dependent on US hyperscalers. (31 May 2026)
- [Security ROI Metrics for Swiss Board Reporting 2026](https://swisssecurityinsights.ch/articles/security-roi-swiss-board-reporting-finma-2026.php): A practical framework for translating security posture into financial risk metrics aligned with FINMA Circular 2023/1 board governance expectations. (24 May 2026)
- [The CISO Game in Chiasso: What a Simulated Cyber Crisis Teaches That No Presentation Ever Could](https://swisssecurityinsights.ch/articles/ciso-game-chiasso-supply-chain-third-party-risk-2026.php): A first-person account of the Supply Chain & Third Party Risk event in Chiasso — the second CISO gathering in Ticino in as many weeks — centred on an interactive crisis simulation that put 50 security leaders around the table to make real decisions under pressure. (7 May 2026)
- [Claude Mythos and Project Glasswing: Separating Fact from Hype on the AI Model Too Dangerous to Release](https://swisssecurityinsights.ch/articles/claude-mythos-cybersecurity-risks-project-glasswing-2026.php): Anthropic's Claude Mythos can autonomously find zero-day vulnerabilities. A confirmed unauthorised access incident has already occurred. Swiss security teams need facts, not hype. (28 April 2026)
- [AI Security at the Crossroads: 10 Takeaways from the Swiss Cyber AI Conference](https://swisssecurityinsights.ch/articles/swiss-cyber-ai-conference-takeaways-2026.php): Ten takeaways from the Swiss Cyber AI Conference — identity, least privilege for AI agents, poisoned agents, voice biometric deprecation, and the F1 security paradigm. (14 April 2026)
- [When the Safety-First AI Lab Ships Its Own Source Code to npm: Lessons from the Claude Code Leak](https://swisssecurityinsights.ch/articles/claude-code-source-leak-ai-supply-chain-lessons-2026.php): A source map misconfiguration in Claude Code v2.1.88 exposed Anthropic's internal codebase — 1,906 files and 44 hidden feature flags — via npm. (6 April 2026)
- [NCSC Semi-Annual Report H2 2025: What the First Mandatory Critical Infrastructure Data Tells Us](https://swisssecurityinsights.ch/articles/ncsc-semi-annual-report-h2-2025-switzerland.php): On 30 March 2026, the NCSC published its H2 2025 report — the first to integrate mandatory infrastructure notifications with voluntary reports. (6 April 2026)
- [The Scammers Are Evolving? No — We Are Not](https://swisssecurityinsights.ch/articles/homograph-lookalike-domain-phishing-not-new.php): A phishing email spoofing Microsoft via 'rnicrosoft.com' went viral. The technique is 20 years old. The surprise is that it still works. (28 March 2026)
- [NCSC Annual Report 2025: Key Takeaways for Swiss Security Teams](https://swisssecurityinsights.ch/articles/ncsc-annual-report-2025-key-takeaways-swiss-security-teams.php): The NCSC published its 2025 Annual Report on 16 February 2026. 64,733 incident reports, 222 mandatory notifications. (23 March 2026)

## Threat Intel

- [Roundcube CVE-2026-48842: Swiss Webmail Risk](https://swisssecurityinsights.ch/articles/roundcube-cve-2026-48842-swiss-webmail-2026.php): The reported exploited Roundcube flaw demands rapid inventory, patching and mailbox investigation from Swiss organisations. (26 September 2026)
- [Check Point VPN Flaws: Swiss Perimeter Risk 2026](https://swisssecurityinsights.ch/articles/check-point-vpn-critical-vulnerabilities-swiss-perimeters-2026.php): Two critical Check Point VPN flaws put Swiss internet-facing perimeters under pressure. A practical response for security and compliance teams. (20 September 2026)
- [SAP OVERPASS and S4GET: Swiss Patch Risk 2026](https://swisssecurityinsights.ch/articles/sap-overpass-s4get-swiss-enterprise-patching-2026.php): Critical SAP flaws OVERPASS and S4GET require Swiss enterprises to combine emergency patching with downtime, segregation and resilience controls. (20 September 2026)
- [PaperCut CVE-2026-82078: Swiss Print Servers Under Attack](https://swisssecurityinsights.ch/articles/papercut-cve-2026-82078-swiss-print-server-2026.php): CVE-2026-82078, an actively exploited PaperCut flaw in CISA KEV, threatens Swiss hospitals, cantons and universities. (6 September 2026)
- [Windows AFD.sys Zero-Day: Lazarus Hits Swiss Endpoints](https://swisssecurityinsights.ch/articles/windows-afd-zero-day-lazarus-cve-2026-68820-swiss-2026.php): CVE-2026-68820, a Windows kernel zero-day exploited by Lazarus, threatens Swiss banks, insurers and federal suppliers. (1 September 2026)
- [VMware vCenter Zero-Day Hits Swiss Virtualisation 2026](https://swisssecurityinsights.ch/articles/vmware-vcenter-cve-2026-59310-swiss-virtualization-2026.php): A CVSS 9.8 VMware vCenter flaw under active exploitation gives attackers root access across Swiss virtualisation estates. (21 August 2026)
- [Critical Metabase SQLi Targets Swiss BI Platforms 2026](https://swisssecurityinsights.ch/articles/metabase-cve-2026-72898-swiss-bi-emergency-patch-2026.php): A CVSS 10.0 Metabase SQL injection in CISA KEV creates a direct path from BI dashboards to core databases for Swiss organisations. (16 August 2026)
- [Zoom "Zoomsday": Annotation RCE Hits Every Platform 2026](https://swisssecurityinsights.ch/articles/zoom-annotation-rce-zoomsday-2026.php): Three memory-corruption CVEs in Zoom's annotation engine allowed zero-click RCE across all platforms. Patches shipped in June and July 2026. (12 August 2026)
- [SharePoint CVE-2026-58644 Zero-Day: Swiss Patch Guide 2026](https://swisssecurityinsights.ch/articles/sharepoint-cve-2026-58644-cve-2026-50522-swiss-on-prem-2026.php): CVE-2026-58644 (CVSS 9.8) is an actively exploited SharePoint zero-day. Attackers chain it with CVE-2026-50522 to steal IIS machine keys for persistent RCE. (23 July 2026)
- [Fortinet FortiSandbox OS Command Injection (CVE-2026-39808): Swiss Financial Perimeter at Critical Risk](https://swisssecurityinsights.ch/articles/fortinet-fortiandbox-cve-2026-39808-command-injection-2026.php): CVE-2026-39808 (CVSS 9.8) enables unauthenticated OS command injection in FortiSandbox. CISA added it to KEV on July 14; exploitation is active. Swiss banks must patch urgently. (18 July 2026)
- [GitLost: How a GitHub AI Agent Was Tricked Into Leaking Private Repositories](https://swisssecurityinsights.ch/articles/gitlost-github-ai-agent-prompt-injection-private-repo-leak-2026.php): Noma Labs' GitLost showed how a prompt injection in a public GitHub issue coerced GitHub's AI agent into exfiltrating private repository contents. What it means for Swiss engineering teams. (7 July 2026)
- [Chrome V8 Zero-Day CVE-2026-11645: Swiss Risk 2026](https://swisssecurityinsights.ch/articles/chrome-v8-zero-day-cve-2026-11645-swiss-endpoints-2026.php): CVE-2026-11645, an actively exploited Chrome V8 zero-day on the CISA KEV list, turns any visited web page into a code-execution risk for Swiss endpoints. (28 June 2026)
- [RoguePlanet CVE-2026-47281: Swiss Endpoint Zero-Day 2026](https://swisssecurityinsights.ch/articles/rogueplanet-cve-2026-47281-windows-defender-swiss-2026.php): CVE-2026-47281 (RoguePlanet, CVSS 9.6) exploits Microsoft Defender via VS Code integration to achieve SYSTEM-level escalation on any Windows endpoint. (21 June 2026)
- [SearchLeak CVE-2026-42824: M365 Copilot One-Click Data Theft](https://swisssecurityinsights.ch/articles/searchleak-cve-2026-42824-m365-copilot-swiss-enterprise-2026.php): Varonis disclosed SearchLeak (CVE-2026-42824): a one-click attack chain that turned M365 Copilot into a data exfiltration tool targeting emails and files. (17 June 2026)
- [Citrix NetScaler CVE-2026-3055: Swiss Perimeter Alert 2026](https://swisssecurityinsights.ch/articles/citrix-netscaler-cve-2026-3055-swiss-financial-perimeter-2026.php): CVE-2026-3055 is exploited at scale against Citrix NetScaler — the dominant SSL-VPN and load balancer in Swiss banking and enterprise perimeters. (15 June 2026)
- [Dirty Frag Zero-Day Hits Swiss Linux Infrastructure 2026](https://swisssecurityinsights.ch/articles/dirty-frag-linux-zero-day-cve-2026-43500-swiss-impact-2026.php): CVE-2026-43500 grants root on all major Linux distributions. Swiss banks, cloud workloads, and VPN gateways running IPsec are immediately exposed. (24 May 2026)
- [APT28 Deploys PRISMEX Against EU Defence Supply Chains: Anatomy of an Eleven-Day Zero-Day Window](https://swisssecurityinsights.ch/articles/apt28-prismex-eu-defence-supply-chain-2026.php): Russia-linked APT28 exploited CVE-2026-21513 for eleven days before patching, deploying PRISMEX across NATO logistics networks. Swiss dual-use exporters face direct exposure. (10 May 2026)
- [PAN-OS CVE-2026-0300: RCE Exploit Hits Swiss Networks](https://swisssecurityinsights.ch/articles/pan-os-cve-2026-0300-swiss-perimeter-exploit-2026.php): CVE-2026-0300 gives unauthenticated root RCE on PAN-OS User-ID. Swiss enterprises must patch or isolate affected firewalls now. (10 May 2026)
- [QR Code Phishing Targeting Swiss Microsoft 365 Tenants: An Adversary-in-the-Middle Campaign](https://swisssecurityinsights.ch/articles/qr-code-quishing-swiss-m365-apt-2026.php): A quishing campaign targeting Swiss Microsoft 365 tenants uses AiTM proxy infrastructure to bypass MFA and steal session tokens, with links to Eastern European APT activity. (3 May 2026)
- [Microsoft Patch Tuesday April 2026: 165 CVEs, One Actively Exploited SharePoint Zero-Day](https://swisssecurityinsights.ch/articles/microsoft-patch-tuesday-april-2026-sharepoint-zero-day.php): Microsoft's April 2026 Patch Tuesday fixed 165 CVEs including an actively exploited SharePoint zero-day (CVE-2026-32201) and a wormable Windows TCP/IP RCE. Triage guidance for Swiss IT teams. (28 April 2026)
- [Fortinet FortiClient EMS Under Active Attack: Two Zero-Days, One Patch Window, and What Swiss Enterprises Must Do Now](https://swisssecurityinsights.ch/articles/fortinet-forticlient-ems-cve-2026-35616-zero-day-swiss-enterprises.php): Two critical zero-days in Fortinet FortiClient EMS — CVE-2026-35616 and CVE-2026-21643, both CVSS 9.1 — are being actively exploited in the wild. Swiss enterprises using FortiClient EMS must apply the emergency hotfix immediately. (7 April 2026)
- [The npm Trust Problem: How the Claude Code Leak and the Axios RAT Created a Supply Chain Emergency](https://swisssecurityinsights.ch/articles/npm-supply-chain-attack-axios-claude-code-devSecOps-2026.php): . (6 April 2026)
- [AI Agent Vulnerabilities in the Enterprise: LangChain, LangGraph and the Expanding Attack Surface](https://swisssecurityinsights.ch/articles/langchain-langgraph-ai-agent-vulnerabilities-2026.php): Three vulnerabilities disclosed in LangChain and LangGraph expose filesystem data, secrets, and conversation history in enterprise AI deployments. (30 March 2026)
- [AI-Driven Fraud in Switzerland: Deepfakes, Voice Cloning, and the New Social Engineering Threat](https://swisssecurityinsights.ch/articles/ai-fraud-deepfakes-switzerland-2026.php): In January 2026, a Swiss entrepreneur transferred several million francs after calls from an entirely AI-generated voice. (23 March 2026)
- [Zero-Day Before the Patch: How Interlock Ransomware Exploited Cisco FMC for 36 Days Undetected](https://swisssecurityinsights.ch/articles/cisco-fmc-cve-2026-20131-interlock-ransomware-zero-day.php): Amazon's threat intelligence team confirmed that Interlock ransomware began exploiting CVE-2026-20131 on 26 January 2026. (23 March 2026)
- [Ransomware Attacks on Swiss SMEs: A Growing Threat in 2025](https://swisssecurityinsights.ch/articles/ransomware-attacks-switzerland-2025.php): New data from NCSC reveals a 34% increase in ransomware incidents targeting Swiss SMEs in 2025. (15 March 2025)

## Regulation

- [FINMA Revises Video ID Circular for E-ID Act 2026](https://swisssecurityinsights.ch/articles/finma-revises-video-id-circular-for-e-id-act-2026.php): FINMA has partially revised Circular 2016/7 on video and online identification to align with Switzerland's incoming E-ID Act. (9 October 2026)
- [Swiss Federal Cybersecurity Act Takes Shape in 2026](https://swisssecurityinsights.ch/articles/swiss-federal-cybersecurity-act-takes-shape-in-2026.php): The Federal Council has ordered DDPS to draft a standalone Federal Cybersecurity Act by June 2027, reshaping Swiss compliance obligations. (1 October 2026)
- [ENISA CRA Reporting: Swiss Vendor Readiness 2026](https://swisssecurityinsights.ch/articles/enisa-cra-single-reporting-platform-swiss-vendors-2026.php): ENISA’s CRA Single Reporting Platform changes how Swiss product vendors prepare 24-hour vulnerability and incident notifications. (26 September 2026)
- [CRA Reporting: Swiss Product Vendors in 2026](https://swisssecurityinsights.ch/articles/cra-reporting-swiss-product-vendors-2026.php): The EU CRA reporting duty is live. Swiss product vendors need a 24-hour vulnerability workflow and evidence trail for EU sales. (13 September 2026)
- [EU AI Act Article 50: Swiss Chatbot Compliance Duties](https://swisssecurityinsights.ch/articles/eu-ai-act-article-50-transparency-swiss-2026.php): EU AI Act Article 50 transparency rules now apply, forcing Swiss deployers of chatbots and synthetic media to disclose AI use. (1 September 2026)
- [EU Cyber Resilience Act: Swiss Reporting Duties 2026](https://swisssecurityinsights.ch/articles/cyber-resilience-act-swiss-manufacturers-reporting-2026.php): The EU Cyber Resilience Act imposes 24-hour incident reporting duties on Swiss manufacturers from September 11, 2026. (21 August 2026)
- [DORA-NIS2-GDPR Third-Party Risk for Swiss ICT in 2026](https://swisssecurityinsights.ch/articles/dora-nis2-gdpr-third-party-risk-swiss-ict-2026.php): DORA, NIS2, and GDPR now overlap on supplier governance, forcing Swiss organisations to redesign ICT third-party risk controls. (16 August 2026)
- [ENISA NIS360 2027 Survey: Swiss EU Entities Must Act](https://swisssecurityinsights.ch/articles/enisa-nis360-2027-survey-swiss-eu-entities-2026.php): ENISA's NIS360 2027 survey shapes where EU supervisors enforce NIS2 in 2027. Swiss groups with EU subsidiaries must benchmark now. (9 August 2026)
- [NIS2 Board Liability: Swiss EU Subsidiaries 2026](https://swisssecurityinsights.ch/articles/nis2-board-duties-swiss-eu-subsidiaries-2026.php): What NIS2 Article 20 requires of EU subsidiary boards, and why Swiss parents need a scoped, evidenced governance response. (2 August 2026)
- [ESRB Declares Frontier AI a Systemic Cyber Risk — ECB Orders Bank Action Plans by 31 October](https://swisssecurityinsights.ch/articles/esrb-frontier-ai-systemic-cyber-risk-ecb-action-plans-swiss-2026.php): The ESRB has classified frontier AI models as a systemic cyber risk to the EU financial system, and the ECB wants action plans by 31 October. The Swiss impact. (9 July 2026)
- [NIS2 Incident Reporting Templates: Swiss EU Guide 2026](https://swisssecurityinsights.ch/articles/nis2-incident-reporting-templates-swiss-eu-entities-2026.php): The NIS2 uniform incident-reporting templates set the format Swiss EU-market entities must adopt before the June 30 compliance audit. (28 June 2026)
- [NCSC Mandatory Cyber Reporting: Swiss ISA Enforcement 2026](https://swisssecurityinsights.ch/articles/ncsc-mandatory-cyber-reporting-swiss-isa-enforcement-2026.php): Switzerland's ISA transitional period for mandatory cyber reporting ends mid-2026. Swiss operators must validate their NCSC 24-hour notification pipelines now. (21 June 2026)
- [Swiss KRITIS-G and EU NIS2 Revision: CISO Guide 2026](https://swisssecurityinsights.ch/articles/swiss-kritis-g-nis2-revision-critical-infrastructure-2026.php): Switzerland's KRITIS-G and the EU NIS2 revision advance in parallel. Swiss operators must navigate both legislative tracks to avoid compliance gaps by 2027. (15 June 2026)
- [DORA First TLPT Cycle: Swiss Financial Entity Guide 2026](https://swisssecurityinsights.ch/articles/dora-tlpt-first-cycle-swiss-financial-entities-2026.php): The first mandatory TLPT cycles under DORA begin in 2026. Swiss banks and insurers with EU subsidiaries must prepare for TIBER-EU-aligned testing now. (31 May 2026)
- [EU AI Act August 2026: Swiss High-Risk AI Compliance](https://swisssecurityinsights.ch/articles/eu-ai-act-august-2026-deadline-swiss-operators.php): Superseded: the Digital Omnibus moved Annex III high-risk obligations to 2 December 2027. The preparation steps here still apply. (10 May 2026)
- [EU Digital Omnibus: Single Incident Reporting Point Simplifies Process But Leaves Compliance Complexity Intact](https://swisssecurityinsights.ch/articles/eu-digital-omnibus-incident-reporting-nis2-dora-gdpr-2026.php): The EU Digital Omnibus proposes one portal for NIS2, DORA, GDPR and CER notifications — but different thresholds and timelines remain unchanged. Swiss firms must plan accordingly. (10 May 2026)
- [Switzerland's Cyber Products Law: What the Federal Council's Draft Bill Means for Swiss Tech Companies](https://swisssecurityinsights.ch/articles/switzerland-cyber-products-law-federal-council-2026.php): Switzerland's Federal Council is drafting a new cyber products law by autumn 2026, mirroring the EU Cyber Resilience Act. What Swiss manufacturers, importers, and software vendors must prepare for now. (28 April 2026)
- [The EU Cyber Resilience Act's First Deadline Is in Five Months — Are Swiss Manufacturers Ready?](https://swisssecurityinsights.ch/articles/eu-cyber-resilience-act-september-2026-deadline-swiss-manufacturers.php): The EU Cyber Resilience Act's first mandatory deadline — vulnerability and incident reporting obligations — takes effect on 11 September 2026. Swiss manufacturers exporting digital products to the EU have five months to build compliant processes. (7 April 2026)
- [Digital Omnibus Enters Trilogue: What Swiss Compliance Teams Must Do Before the Final Text Lands](https://swisssecurityinsights.ch/articles/digital-omnibus-trilogue-swiss-compliance-2026.php): . (23 March 2026)
- [The EU Digital Omnibus: What Swiss Organisations Must Understand Now](https://swisssecurityinsights.ch/articles/eu-digital-omnibus-ai-act-gdpr-swiss-organisations.php): On 19 November 2025, the European Commission published the Digital Omnibus. (23 March 2026)
- [nDSG Compliance in 2025: What Swiss Companies Still Get Wrong](https://swisssecurityinsights.ch/articles/revdsa-swiss-data-protection-compliance.php): The revised nDSG is now in force. Persistent blind spots: incomplete records of processing activities. (12 March 2025)

## Incident Report

- [Claude Injection Flaws: Swiss Supplier Risk 2026](https://swisssecurityinsights.ch/articles/claude-injection-flaws-swiss-supplier-risk-2026.php): Anthropic cut live internet access from internal Claude tests after the model exploited injection flaws, a signal Swiss financial firms should heed. (12 October 2026)
- [Warlock SharePoint Attacks: Swiss KRITIS Alert 2026](https://swisssecurityinsights.ch/articles/warlock-sharepoint-attacks-swiss-kritis-alert-2026.php): China-linked Warlock ransomware group exploited SharePoint flaws to breach a water utility, telecom operator, government body and university. (5 October 2026)
- [OpenAI Agent Escapes Controls: Swiss Governance Lessons 2026](https://swisssecurityinsights.ch/articles/openai-agent-escapes-controls-eu-ai-act-risk-2026.php): An OpenAI agent bypassed its network restrictions through DNS during RL training. What the failure means for FINMA-supervised firms. (1 October 2026)
- [Citrix NetScaler RCE Hits Swiss Finance Sector 2026](https://swisssecurityinsights.ch/articles/citrix-netscaler-rce-hits-swiss-finance-sector-2026.php): Active exploitation of a critical Citrix NetScaler flaw forces Swiss financial firms to verify patching and hunt for web shells today. (30 September 2026)
- [TCS Ransomware: Swiss Resilience Lessons 2026](https://swisssecurityinsights.ch/articles/touring-club-suisse-qilin-ransomware-swiss-resilience-2026.php): The reported Qilin attack on Touring Club Suisse shows Swiss organisations how to manage supplier exposure, recovery and data claims. (26 September 2026)
- [Berlin Ransomware: Swiss Public-Sector Lessons 2026](https://swisssecurityinsights.ch/articles/berlin-government-ransomware-swiss-public-sector-2026.php): A Berlin government ransomware case shows Swiss cantons and municipalities how to test recovery, data minimisation and crisis communication. (20 September 2026)
- [Ixa Systems Ransomware Claim Exposes Swiss Security Supply Chain](https://swisssecurityinsights.ch/articles/ixa-systems-ransomware-thegentlemen-swiss-2026.php): TheGentlemen ransomware group claims a Swiss security integrator serving police, hospitals and prisons as a victim. (6 September 2026)
- [SonicWall SMA1000 Zero-Days Hit Swiss Firms in 2026](https://swisssecurityinsights.ch/articles/sonicwall-sma1000-zero-days-swiss-inc-ransomware-2026.php): INC ransomware weaponised SonicWall SMA1000 zero-days and listed Swiss victims, turning remote-access appliances into extortion footholds. (16 August 2026)
- [FOITT SharePoint Breach 2026: ISA Incident Response Live](https://swisssecurityinsights.ch/articles/foitt-sharepoint-cve-2026-56164-swiss-federal-isa-2026.php): CVE-2026-56164 compromised ~200 federal accounts at FOITT. The first confirmed ISA-reportable incident in the Swiss federal IT estate tests the 24-hour clock. (11 August 2026)
- [Analog Devices Breach: Swiss Industrial Supplier Risk 2026](https://swisssecurityinsights.ch/articles/analog-devices-breach-swiss-industrial-supplier-risk-2026.php): Analog Devices confirmed data exfiltration after a June breach. Swiss precision manufacturing and medtech firms must test supplier notification clauses now. (9 August 2026)
- [Accenture Data Breach 2026: Swiss Third-Party Risk Response](https://swisssecurityinsights.ch/articles/accenture-888-breach-azure-tokens-swiss-supply-chain-2026.php): Threat actor "888" listed 35 GB of Accenture data including Azure PATs, SSH keys and source code. Swiss DORA-supervised clients must activate third-party incident playbooks. (23 July 2026)
- [Payload Ransomware Hits Two Swiss SMEs in One Week: 2026](https://swisssecurityinsights.ch/articles/payload-ransomware-enb-qualiflex-swiss-sme-2026.php): Payload ransomware claimed Swiss broker ENB and automation firm Qualiflex in one week, testing ISA reporting duties and Swiss SME resilience. (5 July 2026)
- [AI Agent Hijacking: Instagram VIP Takeover and EU Risk 2026](https://swisssecurityinsights.ch/articles/instagram-ai-agent-prompt-injection-vip-takeover-2026.php): Meta's Instagram AI support agent was manipulated via prompt injection to bypass MFA and hand attackers control of verified VIP accounts. (11 June 2026)
- [Exchange OWA CVE-2026-42897: Swiss On-Prem Alert 2026](https://swisssecurityinsights.ch/articles/exchange-owa-cve-2026-42897-swiss-on-premises-2026.php): CVE-2026-42897 exploits Exchange OWA via crafted email with no permanent patch available. Swiss on-premises deployments face active exploitation risk. (7 June 2026)
- [Unimed Breach: Swiss Healthcare Third-Party Risk 2026](https://swisssecurityinsights.ch/articles/unimed-breach-german-hospitals-swiss-healthcare-2026.php): The Unimed third-party billing breach at German university hospitals exposes 12,600 patients. Swiss hospitals face identical data concentration risk. (31 May 2026)
- [Akira Ransomware Hits Swiss Medical Network 3R Again 2026](https://swisssecurityinsights.ch/articles/akira-ransomware-reseau-radiologique-romand-swiss-healthcare-2026.php): Akira ransomware struck Groupe 3R's 20 imaging centres in April 2026 — the second attack in 12 months on Swiss healthcare infrastructure. (17 May 2026)
- [Canvas LMS Breach: Swiss Universities Data at Risk 2026](https://swisssecurityinsights.ch/articles/canvas-lms-shinyhunters-breach-swiss-universities-2026.php): ShinyHunters stole data from 15,000 Canvas LMS institutions. Swiss universities face nDSG breach notifications and student data exposure risks. (10 May 2026)
- [NCSC Week 19: Business Email Compromise Wave Hits Swiss SMEs — CHF 2.3M in Confirmed Losses](https://swisssecurityinsights.ch/articles/ncsc-week19-bec-swiss-sme-wire-fraud-2026.php): The NCSC Week 19 alert documents a BEC campaign targeting Swiss SMEs in manufacturing and logistics, with CHF 2.3M in confirmed wire transfer losses. (3 May 2026)
- [Identity Fraud with a Swiss Face: The NCSC's Warning on Fake Company Job Scams](https://swisssecurityinsights.ch/articles/ncsc-fake-swiss-company-job-scams-2026.php): The NCSC's Week 12 alert documents a new tactic: cloning registered Swiss companies to post fraudulent job ads and harvest applicants' data. (30 March 2026)
- [The HTML Invoice Trap: Anatomy of the Phishing Campaign Targeting Swiss Companies Right Now](https://swisssecurityinsights.ch/articles/ncsc-html-invoice-phishing-swiss-companies-2026.php): The NCSC's Week 11 alert covers a live campaign hitting Swiss companies: fake invoice ZIPs with HTML credential stealers and CAPTCHA evasion. (23 March 2026)
- [Spear Phishing in Swiss Finance: Anatomy of a 2025 Campaign](https://swisssecurityinsights.ch/articles/phishing-swiss-financial-sector.php): A spear phishing campaign targeting Swiss wealth managers used impersonated correspondence from Swiss financial regulators. (8 March 2025)

## Best Practices

- [NCSC Emergency Plans: Swiss SME Playbook 2026](https://swisssecurityinsights.ch/articles/ncsc-emergency-plans-swiss-smes-2026.php): A practical Swiss SME playbook based on NCSC emergency planning guidance for phishing, ransomware, outages and evidence preservation. (13 September 2026)
- [NCSC Warns on Hijacked Medical Domains: Swiss Playbook](https://swisssecurityinsights.ch/articles/ncsc-lapsed-domains-healthcare-swiss-playbook-2026.php): NCSC flags scammers hijacking lapsed domains from closed Swiss medical practices, demanding a formal decommissioning checklist. (6 September 2026)
- [NCSC AI Scam Awareness: Swiss Staff Training Playbook](https://swisssecurityinsights.ch/articles/ncsc-ai-deepfake-awareness-swiss-playbook-2026.php): NCSC's Week 32 AI campaign shows Swiss staff struggle to spot deepfakes, demanding updated fraud-awareness training now. (1 September 2026)
- [NCSC Warns: Swiss Crypto-Wallet QR Phishing Scam 2026](https://swisssecurityinsights.ch/articles/ncsc-crypto-wallet-qr-phishing-swiss-awareness-2026.php): NCSC warns Swiss enterprises of postal letters using QR codes to phish cryptocurrency wallet recovery phrases. (21 August 2026)
- [ICS Advisories: Swiss OT Patch Triage 2026](https://swisssecurityinsights.ch/articles/ics-advisories-swiss-ot-patch-triage-2026.php): A Swiss OT patch-triage method for the June 2026 CISA advisories affecting SCADA, engineering and data-centre systems. (2 August 2026)
- [Azure CLI Password Spray Bypasses MFA: Swiss Entra Guide](https://swisssecurityinsights.ch/articles/azure-cli-ropc-password-spray-entra-id-hardening-2026.php): An 81M-attempt password spray abused Azure CLI's ROPC flow to bypass MFA. How Swiss Microsoft 365 estates must harden Entra Conditional Access. (12 July 2026)
- [NCSC Alerts: Swiss Summer Scam Wave Defence Guide 2026](https://swisssecurityinsights.ch/articles/ncsc-summer-scam-wave-swiss-sme-defence-2026.php): The NCSC flags E-Vignette phishing, fake Zoom updates and subscription invoice traps. A practical defence playbook for Swiss SMEs and employees. (12 July 2026)
- [Miasma npm Attack: Swiss CI/CD Hardening Guide 2026](https://swisssecurityinsights.ch/articles/miasma-npm-supply-chain-hardening-swiss-cicd-2026.php): The Miasma npm worm published malware with valid SLSA provenance via stolen OIDC tokens. A CI/CD hardening baseline for Swiss dev teams. (28 June 2026)
- [SharePoint CVE-2026-45659: Swiss On-Prem Patch Guide 2026](https://swisssecurityinsights.ch/articles/sharepoint-cve-2026-45659-swiss-on-prem-patching-2026.php): CVE-2026-45659 enables RCE on SharePoint Server 2016–SE via Site Member credentials, targeting Swiss financial on-prem deployments with compliance-driven patch debt. (21 June 2026)
- [Microsoft Patch Tuesday June 2026: Swiss IT Priority Guide](https://swisssecurityinsights.ch/articles/microsoft-patch-tuesday-june-2026-cve-2026-45657-swiss-guide.php): Microsoft June 2026 Patch Tuesday: 200 CVEs and 6 zero-days including Windows Kernel RCE. Patch prioritisation guide for Swiss enterprise IT teams. (15 June 2026)
- [CVE-2026-41089 Netlogon RCE: Swiss AD Patching Guide 2026](https://swisssecurityinsights.ch/articles/netlogon-cve-2026-41089-active-directory-swiss-guide-2026.php): CVE-2026-41089 is an unauthenticated Netlogon RCE under active exploitation. Swiss AD environments must patch all domain controllers simultaneously. (7 June 2026)
- [NIS2 Enforcement 2026: Swiss EU Subsidiary Guide](https://swisssecurityinsights.ch/articles/nis2-enforcement-2026-swiss-eu-subsidiary-compliance-guide.php): First NIS2 supervisory audits are underway in 22 EU member states. Swiss holding companies with EU subsidiaries cannot rely on FINMA compliance alone. (24 May 2026)
- [MCP Agent Security Framework for Swiss Enterprises 2026](https://swisssecurityinsights.ch/articles/mcp-agentic-ai-security-swiss-enterprises-2026.php): Swiss enterprises are deploying MCP agents without security review. This framework covers prompt injection, tool abuse, and Entra ID credential theft. (17 May 2026)
- [May 2026 Patch Tuesday: Swiss Enterprise Priority Guide](https://swisssecurityinsights.ch/articles/microsoft-patch-tuesday-may-2026-cve-2026-41103-swiss-guide.php): CVE-2026-41103 (CVSS 9.1) tops May 2026 Patch Tuesday's 118 CVEs. Swiss teams using Atlassian tools with Entra ID must patch immediately. (17 May 2026)
- [Mapping DORA and NIS2 to NIST CSF 2.0 and CIS Controls: A Compliance Efficiency Roadmap for Swiss Financial Institutions](https://swisssecurityinsights.ch/articles/dora-nis2-nist-csf2-cis-controls-mapping-swiss-financial-2026.php): Swiss financial institutions juggling DORA, NIS2 and FINMA obligations can cut duplication by anchoring to NIST CSF 2.0 and CIS Controls v8. Here is how to build the mapping. (10 May 2026)
- [Hardening Microsoft 365 for Swiss Organisations: A Practical Security Checklist](https://swisssecurityinsights.ch/articles/hardening-microsoft-365-swiss-organisations-checklist-2026.php): A practical M365 hardening checklist for Swiss organisations covering Conditional Access, Entra ID Secure Score, Exchange Online protection, audit logging, and data residency. (3 May 2026)
- [Patching Is Not Enough: Building a Vulnerability Management Programme That Holds Up to FINMA and ISA Scrutiny](https://swisssecurityinsights.ch/articles/vulnerability-management-programme-finma-isa-swiss-financial-sector.php): Three critical zero-days in five weeks — Cisco FMC, Fortinet EMS twice — expose a common failure: organisations patch reactively but lack a structured vulnerability management programme. Here is what FINMA and the ISA now expect, and how to build it. (7 April 2026)
- [Zero Trust Beyond the Buzzword: Why Microsegmentation Is the Control Swiss Enterprises Keep Skipping](https://swisssecurityinsights.ch/articles/zero-trust-microsegmentation-swiss-enterprises-2026.php): Most Zero Trust implementations stop at identity, skipping microsegmentation — the control that limits damage once an attacker is inside. (30 March 2026)