# What the 2026 Cyber Threat Landscape Means for GRC and Cyber Resilience

> SwissGRC® erklärt, was die Cyberbedrohungslage in der Schweiz im ersten Halbjahr 2026 für GRC und Cyber Resilience bedeutet. Der Beitrag richtet sich an Unternehmen, die Bedrohungsdaten unter NIS2, CRA und Schweizer Meldepflicht in Risikoentscheide übersetzen müssen.

- URL: https://swissgrc.com/ar/what-the-2026-cyber-threat-landscape-means-for-grc-and-cyber-resilience/
- الناشر: SwissGRC®
- تاريخ النشر: 2026-08-14
- آخر تحديث: 2026-08-20

## معلومات أساسية

- Im ersten Halbjahr 2026 wurden dem Bundesamt für Cybersicherheit (BACS) 27,054 Cybervorfälle gemeldet, 6.8 Prozent weniger als im zweiten Halbjahr 2025.
- Die Phishing Meldungen stiegen um 41 Prozent und die Malware Meldungen um 85 Prozent, Letztere ausgehend von einer deutlich kleineren Basis.
- Die BACS Statistik erfasst gemeldete Vorfälle und nicht die tatsächliche Gesamtzahl der Angriffe, bei technisch anspruchsvollen Angriffen besteht vermutlich eine erhebliche Dunkelziffer.
- Ab dem 11. September 2026 müssen Hersteller unter dem Cyber Resilience Act (CRA) aktiv ausgenutzte Schwachstellen und schwerwiegende Sicherheitsvorfälle melden, mit Frühwarnung innerhalb von 24 Stunden und Folgemeldung innerhalb von 72 Stunden.
- Seit dem 1. April 2025 müssen Betreiber kritischer Infrastrukturen in der Schweiz bestimmte Cyberangriffe grundsätzlich innerhalb von 24 Stunden dem BACS melden.
- Nach NIS2 müssen die Leitungsorgane betroffener Unternehmen Massnahmen des Cybersicherheits-Risikomanagements genehmigen und deren Umsetzung überwachen.

**The cyber threat landscape in Switzerland presents a seemingly paradoxical situation in the first half of 2026: the number of reported incidents is decreasing, while specific attack forms that are particularly relevant for businesses are increasing significantly.**

27,054 cyber incidents were reported to the Federal Office for Cybersecurity (BACS), a decrease of 6.8 percent compared to the second half of 2025. At the same time, phishing reports rose by 41 percent and reports of malware surged by 85 percent. This is highlighted in a recent [Threat Intelligence Briefing by n’guard.swiss](https://nguard.swiss/cyber-whitepaper/) based on publicly available BACS weekly statistics.

Thus, the key insight does not lie in the overall volume. **The risk profile is changing. And with it, the requirements for governance, risk management, and cyber resilience are evolving.**

The threat may not necessarily increase, but it becomes more challenging

The decline in total reports is largely due to fewer traditional fraud attempts. At the same time, other attack methods are gaining significance. Phishing accounted for 32.7 percent of the analyzed reports in the first half of 2026. Spoofing increased by 42 percent, while malware grew by 85 percent from a significantly smaller initial base.

The quality of attacks is also changing. The n’guard briefing points to AI-driven phishing variants and increasingly credible campaigns targeting corporate access points like Microsoft 365. Meanwhile, methods like ClickFix demonstrate how attackers strategically integrate human behavior into the attack chain: users are prompted to execute harmful commands themselves.

However, these numbers need to be properly contextualized. The BACS statistics capture reported incidents, not the actual total number of cyberattacks in Switzerland. Particularly with more technically sophisticated attacks, there is likely a significant dark figure.

For companies, it is less important whether the number of attacks is statistically rising or falling. What matters is how external threats impact their own risk profile.

Threat Intelligence must become Risk Intelligence

This is exactly where the GRC perspective begins.

An increase in phishing by 41 percent is initially information about the external threat landscape. For management, this information only becomes relevant when it is connected to the company’s own context.

Which identities and systems are exposed? Which critical business processes depend on them? What controls are in place? Which third parties have access? What regulatory obligations could be triggered by an incident? And what impact would an outage have on business operations?

From a GRC perspective, a chain is formed:

**Threat → Asset → Business Process → Risk → Requirement → Control → Incident → Action**

This is how Threat Intelligence becomes [**Risk Intelligence**](https://swissgrc.com/third-party-intelligence-center/).

It is precisely this connection that many organizations still lack. Security Operations, risk registers, compliance requirements, third-party risk management, and business continuity each have valuable information. However, if they are managed in isolation, the crucial overall view remains fragmented.

A cybersecurity incident should not only generate a security ticket. It should also raise the question of whether an existing risk needs to be reassessed, a control adjusted, a third party reviewed, or a resilience scenario updated.

Regulation makes cybersecurity a governance task

The fact that cyber risks can no longer be considered exclusively a technical issue is also demonstrated by regulatory developments.

With the [**NIS2**](https://swissgrc.com/eu-nis2-richtlinie-fuer-cyber-sicherheit/), the EU explicitly places responsibility at the management level. The governing bodies of the affected companies must approve cybersecurity risk management measures and oversee their implementation. The directive connects risk analysis with incident management, business continuity, supply chain security, vulnerability management, and the assessment of the effectiveness of security measures.

In 2026, an important additional element will be introduced: the [**Cyber Resilience Act (CRA)**](https://swissgrc.com/cyber-resilience-act-cra/). Starting from **September 11, 2026**, manufacturers will be required to report actively exploited vulnerabilities and serious security incidents in products with digital components. Among other things, early warning is expected within 24 hours and a follow-up report within 72 hours.

The CRA illustrates a fundamental shift: cybersecurity becomes a task subject to control and testing throughout the entire product lifecycle. Risk assessment, vulnerability management, incident reporting, and responsibilities must be integrated.

Switzerland is also following this development. From **April 1, 2025**, operators of critical infrastructures will have the obligation to report certain cyberattacks. After the discovery of a reportable incident, a report to the BACS must, in principle, be made within 24 hours.

The common direction is clear: **Cybersecurity is increasingly understood regulatorily as a governance and risk management task.**

Cyber resilience begins with connections

The consequence is not to introduce an additional isolated control for every new threat.

Companies must understand how threats, risks, processes, controls, third parties, and regulatory requirements interact. This is where GRC becomes the connecting element between Cyber Security and Cyber Resilience.

Cyber Resilience ultimately means more than just preventing attacks. Organizations must anticipate risks, detect and manage incidents, limit impacts, and be able to restore critical business functions.

A holistic GRC approach provides the necessary transparency: Which critical processes are at risk? What controls protect them? How effective are these controls? What dependencies exist with third parties? What regulatory requirements apply? And where do new threats create additional risks?

The relevant question is not the number of attacks

The 27,054 reported cyber incidents of the first half of 2026 are primarily a signal.

The threat landscape is changing, while CRA, NIS2, and the Swiss reporting obligation simultaneously impose higher demands on risk management, accountability, and traceability.

For companies, one capability becomes crucial: **rapidly translating changes in the external threat environment into their own risk context and making decisions from that.**

The central question is therefore no longer just: *How do we protect ourselves from cyberattacks?*

But rather: **Do we understand which cyber risks actually threaten our business, and can we effectively manage them?**

It is precisely here that GRC and cyber resilience intersect.

## الأسئلة الشائعة

### Wie viele Cybervorfälle wurden in der Schweiz im ersten Halbjahr 2026 gemeldet?

Dem BACS wurden 27,054 Cybervorfälle gemeldet. Das sind 6.8 Prozent weniger als im zweiten Halbjahr 2025.

### Welche Angriffsformen nehmen in der Schweiz 2026 zu?

Die Phishing Meldungen stiegen um 41 Prozent, Spoofing um 42 Prozent und Malware um 85 Prozent. Hinzu kommen KI gestützte Phishing Varianten und Methoden wie ClickFix, bei denen Nutzer schädliche Befehle selbst ausführen.

### Was bedeutet Threat Intelligence wird zu Risk Intelligence?

Bedrohungsinformationen werden für das Management erst relevant, wenn sie mit dem eigenen Kontext verknüpft sind: Assets, Geschäftsprozesse, Risiken, Anforderungen, Kontrollen, Vorfälle und Massnahmen. Diese Verknüpfung nennt der Beitrag Risk Intelligence.

### Ab wann gelten die Meldepflichten des Cyber Resilience Act?

Ab dem 11. September 2026 müssen Hersteller aktiv ausgenutzte Schwachstellen und schwerwiegende Sicherheitsvorfälle bei Produkten mit digitalen Komponenten melden. Vorgesehen sind eine Frühwarnung innerhalb von 24 Stunden und eine Folgemeldung innerhalb von 72 Stunden.

### Welche Meldepflicht gilt in der Schweiz für kritische Infrastrukturen?

Seit dem 1. April 2025 müssen Betreiber kritischer Infrastrukturen bestimmte Cyberangriffe melden. Nach der Entdeckung eines meldepflichtigen Vorfalls erfolgt die Meldung an das BACS grundsätzlich innerhalb von 24 Stunden.