Swisscom Threat Radar 2026: Six Months On, What Has Held Up

Swisscom’s Cybersecurity Threat Radar 2026, released at the end of April, read much like any spring security report: threats up, AI sharpening attacks, fragile supply chains. Six months on, it deserves a second look. Since then the National Cyber Security Centre (NCSC/BACS) has published its semi-annual report for the first half of 2026, the Federal Intelligence Service (FIS/NDB) has released its annual situation report, and the Swiss Insurance Association has published fresh cyber insurance figures. That is enough evidence to test Swisscom’s calls.

What Swisscom said in April

The 44-page report places 35 threats across five segments and compares each one’s trend with the previous year. It goes into depth on four topics: software supply chain attacks, AI as a “risk multiplier”, digital sovereignty and the security of operational technology (OT).

The headline change is in the foreword. Swisscom’s Chief Security Officer Marco Wyrsch writes that he was “particularly concerned about the fact that, for the first time, we had to include hybrid warfare, the mixture of traditional military means with cyberattacks, disinformation as well as digital and political influence, as a new threat vector.” For a telecoms operator, that is notably blunt.

On OT, the report uses a phrase that sticks. The risks of connected production, energy and building systems were long “the proverbial elephant in the room that no one really wanted to talk about.” That time is over, it says, and OT security belongs on the executive board’s agenda.

The detailed tables are the most revealing part. Ten threats are marked as rising, among them AI-based attacks, agentic AI, manipulated generative AI, cloud ecosystem dependencies and insecure IoT/OT. Only two are marked as falling: pressure from the security job market and, surprisingly, ransomware. Hybrid warfare and state-level attacks get plenty of attention, but Swisscom rates their trend as unchanged.

Geopolitics: the intelligence service agrees

On 25 June 2026 the FIS published “Switzerland’s Security 2026”. Its conclusions match Swisscom’s. Russia’s hybrid conflict activity is becoming more aggressive and affects Switzerland directly. FIS Director Serge Bavaud summed it up by saying that Switzerland’s protective environment is eroding from the east, the west and the south.

Switzerland has not yet seen a sabotage attack on its infrastructure. But the FIS warns that Swiss infrastructure could be targeted not to hurt Switzerland itself, but to hurt the countries that depend on it. A grid tied into Europe or a data centre serving foreign clients can be drawn into a conflict Switzerland is no party to. In cyberspace, neutrality offers no cover.

OT security: the lesson from Poland

A case study in the NCSC’s August report shows how real the OT risk is. On 29 December 2025 a coordinated wave of attacks disrupted IT and OT systems at several Polish energy sites, including around 30 wind and solar farms and a combined heat and power plant supplying heat to roughly 500,000 people. CERT Polska attributed the attack infrastructure to “Static Tundra”, a suspected Russian state actor.

The entry points are sobering. Remote access was exposed to the internet without multi-factor authentication, passwords were reused across devices, and some equipment still had factory default credentials. The attackers corrupted controller firmware and deployed wipers. None of this needed cutting-edge tradecraft. It only needed neglected basics.

For Switzerland, the NCSC is nuanced. Large grid connection points here are, for the most part, better isolated than in Poland. That does not cover the many small private generators, such as rooftop solar systems, that are permanently connected to the internet and to the manufacturer’s cloud. Swisscom’s elephant is not just on the factory floor. It is also sitting on thousands of roofs.

AI and supply chains: the forecast is holding

On AI and supply chains, the NCSC also backs Swisscom. Attackers now use AI systematically to deliver tailored, personalised content that looks credible. The compromise of several widely used open-source projects allowed credential-stealing malware to spread at scale. The report also cites an attack on a water utility in Mexico in early 2026, in which AI suggested exposed systems as targets and played a major role in carrying out the attack.

Attacking industrial control systems used to take specialist knowledge. The NCSC warns that AI could soon allow actors without that knowledge to find and manipulate poorly protected systems.

Mandatory reporting finally gives us hard numbers

Since 1 April 2025, critical infrastructure operators in Switzerland have had to report cyberattacks to the NCSC within 24 hours. There were 145 such reports in H2 2025 and 200 in H1 2026. Public administration (19.4 per cent) and IT and telecoms (18.6 per cent) filed the most.

Unauthorised access accounts for almost 26 per cent, mostly email accounts hijacked through phishing. Credential theft follows at 13.5 per cent, with DDoS and data leaks at 12.7 per cent each. Salt customers felt this on 15 May 2026, when a DDoS attack knocked out the operator’s fixed-line service for around 40 minutes.

A note of caution: the rise from 145 to 200 doesn’t necessarily mean more attacks. Some of it probably reflects operators settling into the obligation. Penalty provisions have also applied since 1 October 2025. Strictly speaking, though, the fine of up to CHF 100,000 is not for a missed report as such but for wilfully ignoring a legally binding NCSC ruling.

Where Swisscom looks too optimistic: ransomware

Rating ransomware as declining is where we part company with the Threat Radar. The NCSC recorded 79 ransomware incidents in H1 2026, the same as in the previous half-year, and assumes the real figure is higher. Meanwhile, the number of ransomware families active in Switzerland rose from 21 to 29. Akira remains the most documented group, but its share fell from around 35 to 19 per cent. That is fragmentation, not easing, and more varied tactics arguably make defence harder. According to the NCSC, vulnerable VPN gateways and firewalls remain common entry points.

Digital sovereignty: from buzzword to contract clause

Swisscom argues that companies must know where their data is processed and under which jurisdiction. The report itself notes that US providers are subject to US law even when data sits in Swiss data centres. Swisscom, of course, sells Swiss-hosted cloud services itself. The argument still stands. The NCSC’s latest report recalls that Microsoft admitted before the French Senate in 2025 that it could not guarantee data sovereignty, and the Federal Council adopted its own report on digital sovereignty in November 2025.

What Swiss organisations should do now

The priorities are not new, but Poland shows what happens when they are missing.

Lock down remote access and edge devices first

VPNs, firewalls and remote maintenance access are the favourite way in. MFA on every external access point, no default passwords and a binding patch process for edge devices are the minimum.

Build an OT inventory worth the name

You cannot protect controllers or solar inverters you don’t know about. Swisscom recommends strict IT/OT separation and monitoring with OT-specific anomaly detection. For energy companies, the report also points to the Electricity Supply Ordinance, which requires alignment with the federal ICT minimum standard.

Govern AI use rather than banning it

Shadow AI appears where staff lack an approved alternative. A sanctioned tool with clear data rules beats a ban. Pair it with training on AI-assisted phishing and on fake IT helpdesk calls, which the NCSC describes as particularly striking.

Hold suppliers to account

Contracts with software and cloud providers should cover data locations, subcontractors, incident notification deadlines and exit scenarios. Firms with EU customers must also factor in NIS2 and the Cyber Resilience Act. The NCSC’s guidance on cybersecurity in the supply chain is a practical starting point.

Check reporting channels and insurance

Operators subject to reporting should set up NCSC Cyber Security Hub access in advance. SMEs should also review their cover: according to the Swiss Insurance Association, only around 11.5 per cent of Swiss companies hold cyber insurance, and the gap is widest among SMEs.

Our assessment

The Swisscom Threat Radar 2026 got the big picture right. Geopolitics, AI and OT are where the landscape has moved since April, as official data confirms. On ransomware, though, nobody should read the report’s downward arrow as an all-clear. With limited resources, the biggest gains come not from exotic scenarios but from remote access, passwords and a clean asset inventory. That is exactly how the attackers got in in Poland.

Sources

• Swisscom: Swisscom Cybersecurity Threat Radar 2026: geopolitics and AI are exacerbating the threat of cybercrime, 27 April 2026
• Swisscom: Cybersecurity Threat Radar 2026 (download, 44 pages)
• NCSC/BACS: Semi-Annual Report 2025/2, 30 March 2026
• NCSC/BACS: Semi-Annual Report 2026/1, 24 August 2026
• NCSC/BACS: Reporting obligation for cyberattacks on critical infrastructure
• Fedlex: Information Security Act (ISA/ISG), Art. 74a ff.
• Federal Intelligence Service: Switzerland’s Security 2026 (PDF), 25 June 2026
• Swiss Insurance Association (SVV): Cyber insurance survey 2026 (in German), 3 September 2026
• inside-it.ch: DDoS attack temporarily takes down Salt’s fixed network (in German), 18 May 2026
• Federal Council: Report on Switzerland’s digital sovereignty (in German), 26 November 2025