# Pascal Zaugg

Pascal Zaugg shares cybersecurity guidance for Swiss small and midsize businesses, covering risks such as social engineering, ransomware, supply-chain attacks and unsafe use of AI tools. The posts also describe cybersecurity consulting and offer an initial assessment.

- Profile: https://b2binfluencer.marketing/creators/pascal-zaugg/
- LinkedIn: https://www.linkedin.com/in/pascal-zaugg-1a55571ba
- LinkedIn followers: 1,684
- Topics: artificial-intelligence, supply-chain, cybersecurity, social-engineering, ransomware
- Based on 12 dated posts, latest 2026-10-05

## Summary

Pascal Zaugg is most useful for German-language Swiss SME cybersecurity awareness content on social engineering, supply chain, ransomware, and shadow AI.

- Best for: A Swiss SME cybersecurity provider wanting an educational, German-language awareness campaign, not a product-led pitch.
- Not for: A global enterprise security platform targeting CISOs or SOC leaders outside Switzerland.
- Check first: Confirm audience breakdown, recent post results, and partnership scope before contacting them.

### Takeaways

- MFA and updates protect systems, not people, leaving a CEO fraud gap.
- Banning AI does not solve shadow AI; approved tools and data rules do.
- Ransomware is an industrialised business; the bigger gap is internal responsibility.

## Main ideas

- **Technical controls protect systems; trained people and clear approval rules stop CEO fraud**: Pascal Zaugg quotes Dominique Trachsel, head of awareness at Switzerland's Federal Office for Cybersecurity, from a 15 April 2026 SRF question-and-answer piece. Trachsel identified two attack vectors companies underestimate: social engineering aimed at employees, such as CEO fraud, and exploitation of system vulnerabilities. Zaugg argues that the countermeasures Trachsel mentioned—multi-factor authentication and consistent updates—are purely technical. They protect systems but do nothing against attacks aimed at employees. Closing that gap requires employees trained to be sceptical and check back, plus clear rules about who may approve what. The post divides the response into system and human measures: enable MFA everywhere and install critical updates within 48 hours; train the team regularly on real attack patterns and define when checking back is mandatory.
- **Shadow AI is not solved by banning AI; it is solved by making the approved route good enough**: Drawing on the Swisscom Cybersecurity Threat Radar 2026, Pascal Zaugg describes 'shadow AI': employees using ChatGPT, Claude and similar tools at work without management's knowledge or rules. Risks include uploading company documents to public tools for summarising, pasting customer data into prompts because it is faster than the official route, and entering construction plans, contracts or quotations as sample text. Once data reaches a public tool, the company loses control over where it goes. It may be stored on servers abroad, used to develop AI models or exposed in a provider breach. A customer list pasted into the wrong tool cannot be recalled. Zaugg recommends against a ban and lists three actions: offer approved business tools so nobody has to work around the rules, train the team with concrete examples of what may and may not be entered, and set clear rules instead of prohibitions. Shadow AI disappears when employees know what is allowed and have an official route that works just as well.
- **'We are too small for cyberattacks' is the objection Pascal Zaugg challenges**: Pascal Zaugg says this sentence comes up several times a week in advisory conversations. They call it understandable but wrong, then draw on the Swisscom Cybersecurity Threat Radar 2026 to give three reasons Swiss small and midsize companies are increasingly targeted. First, SMEs supply larger firms, so breaching them can expose a larger customer's data. Second, they hold specialist knowledge, including machine components, medical technology and precision parts sought internationally. Third, they are easier to hit: large corporations run security teams around the clock, while SMEs have much tighter resources. The takeaway: attackers seek not the biggest fish, but the most rewarding target with the least resistance. The post turns this into a self-assessment: which internal data would be valuable to others, and where could the company act as a door-opener for others?
- **Security does not stop at the company's own front door**: This post draws on several sources. Pascal Zaugg reports that supply-chain attacks have almost quadrupled since 2020 and cites the Verizon Data Breach Report's finding that around 30 percent of data breaches now trace back to third parties, double the previous year. The mechanism is straightforward: attackers reach a company through its software vendor, cloud service or a supply-chain interface, and the access can go unnoticed for months because it looks legitimate from outside. A digitalswitzerland study found that one in three Swiss SMEs has already been affected by a cyberattack, fewer than half have an emergency plan, and few systematically check suppliers' and service providers' security practices. The post frames this as shared responsibility with the IT partner, not distrust. It offers four questions for that conversation: who has which access, how software updates are checked before installation, whether there is a joint emergency plan if a supplier is compromised, and whether employees are trained to recognise suspicious activity.
- **Ransomware is an industrialised business, and the bigger gap is who is responsible inside the company**: Pascal Zaugg opens with the sentence 'We are simply too small for ransomware' and sets federal figures against it. According to the Federal Office for Cybersecurity, one in three Swiss SMEs has already been a victim of a cyberattack, and almost half of those cases involved ransomware. The post explains ransomware-as-a-service: criminals buy ready-made extortion software, so they need no hacking skills of their own. They deliberately target less well-protected companies, where resistance is lower and payment comes faster because many SMEs cannot afford a long outage. Zaugg says the internal picture is most troubling: at 42 percent of Swiss SMEs nobody is responsible for IT security, even though management is legally responsible, and only half train employees against cyberattacks. The post's conclusion: being small does not protect a company; it makes it a target. Getting started does not require a fortune.
- **A consistent pattern: named finding or client objection, SME consequence, short checklist, consultation offer**: Across five posts, the method is consistent. Each opens with a quoted finding from a named authority or report, or a recurring objection raised in consultations. The posts cite the SRF question-and-answer piece with Dominique Trachsel of the Federal Office for Cybersecurity, the Swisscom Cybersecurity Threat Radar 2026, the Verizon Data Breach Report and a digitalswitzerland study. Each then spells out the implication for Swiss SMEs, offers a short checklist with bolded or arrow-marked lead-ins, and closes with an invitation to a free initial conversation and a link to a related blog article in the comments. Written in German, the posts pair technical terms with plain explanations and name no specific products beyond broad tool categories.

## Work to read

- [Shadow AI: when staff upload company documents to chatbots](https://www.linkedin.com/posts/pascal-zaugg-1a55571ba_%F0%9D%97%A6%F0%9D%97%B0%F0%9D%97%B5%F0%9D%97%AE%F0%9D%98%81%F0%9D%98%81%F0%9D%97%B2%F0%9D%97%BB-%F0%9D%97%9E%F0%9D%97%9C-%F0%9D%97%97%F0%9D%97%AE%F0%9D%98%80-%F0%9D%98%83%F0%9D%97%B2%F0%9D%97%BF%F0%9D%98%81%F0%9D%97%B2%F0%9D%97%B0%F0%9D%97%B8%F0%9D%98%81%F0%9D%97%B2-activity-7483083078110945281-qycR)
- [MFA and updates protect systems, not people: the CEO fraud gap](https://www.linkedin.com/posts/pascal-zaugg-1a55571ba_%F0%9D%97%AD%F0%9D%98%84%F0%9D%97%B2%F0%9D%97%B6-%F0%9D%97%A6%F0%9D%97%B0%F0%9D%97%B5%F0%9D%98%84%F0%9D%97%AE%F0%9D%97%B0%F0%9D%97%B5%F0%9D%98%80%F0%9D%98%81%F0%9D%97%B2%F0%9D%97%B9%F0%9D%97%B9%F0%9D%97%B2%F0%9D%97%BB-%F0%9D%97%B1-activity-7475472883356606464-rt7P)
- [“We are too small for cyberattacks”: three reasons Swiss SMEs are targeted](https://www.linkedin.com/posts/pascal-zaugg-1a55571ba_%F0%9D%97%AA%F0%9D%97%B6%F0%9D%97%BF-%F0%9D%98%80%F0%9D%97%B6%F0%9D%97%BB%F0%9D%97%B1-%F0%9D%97%B1%F0%9D%97%BC%F0%9D%97%B0%F0%9D%97%B5-%F0%9D%97%BB%F0%9D%98%82%F0%9D%97%BF-%F0%9D%97%B2%F0%9D%97%B6%F0%9D%97%BB-%F0%9D%97%B8%F0%9D%97%B9%F0%9D%97%B2%F0%9D%97%B6%F0%9D%97%BB%F0%9D%97%B2%F0%9D%98%80-activity-7481271076635848705-raYB)
- [Supply-chain attacks: the entry point you do not control](https://www.linkedin.com/posts/pascal-zaugg-1a55571ba_cybersecurity-awareness-activity-7457724238851108864-_Y7W)
- [Ransomware as a service: one in three SMEs hit, 42 percent with nobody responsible for IT security](https://www.linkedin.com/posts/pascal-zaugg-1a55571ba_awareness-cybersecurity-activity-7455903870012198912-8r1u)

## Brand relationships

- **Swisscom** (mention)
- **Federal Office for Cybersecurity (BACS)** (mention)
- **SRF** (mention)
- **digitalswitzerland** (mention)
- **Verizon** (mention)
- **Unnamed cybersecurity advisory business** (disclosed_partnership)

## Partnerships

Pascal Zaugg’s five reviewed posts list no sponsorship packages, partner tiers, rate cards, or partnership inquiry route. They consistently offer Swiss SMEs a free initial cybersecurity consultation; two also point to a blog article. Brands should ask directly about scope, deliverables, disclosure, and usage rights.

## Alternatives

- Moritz Heininger: Choose Heininger for the same Swiss SME cybersecurity campaign when the working problem is AI adoption and governance, not attack awareness. Their posts argue that companies see little AI efficiency because employees have not been taught to use AI well. They compare AI agents to new hires who need a job description, access, onboarding, a probation with 50 real cases, rules, team integration, feedback, and a cost measure. That makes Heininger a stronger match than Pascal Zaugg for a provider whose shadow-AI offer focuses on employee enablement, agent governance, and measurable rollout—not phishing, CEO fraud, or ransomware awareness.
- Marcel Eberhardt: Choose Eberhardt when the campaign needs to persuade Swiss SME owners with a business case and a sales-process argument, not security awareness alone. Their posts describe a proposal method credited with raising an offer-to-win rate from under 10% to over 87%, and a cultural-debt argument that a bad hire cost a team EUR 265,000. For a cybersecurity provider whose offer stalls because SMEs treat security as a low-priority purchase, Eberhardt's work speaks to management attention, trust, and the cost of inaction. Eberhardt is the better fit when the campaign aims to help SME leaders see security as a commercial and organisational obligation.
- Jakob Strehlow: Choose Strehlow when the provider's bottleneck is paid lead generation and CRM feedback, not educational content. Their posts explain Meta lead-quality goals, value optimization, CRM connections, instant-form filtering, and appointment booking. They advocate a full loop from ad to lead to CRM to qualification to revenue and back to Meta. For a Swiss SME cybersecurity provider that already has awareness content and needs qualified initial assessments at volume, Strehlow is a better fit than Pascal Zaugg: their material is about buying and measuring paid demand, not writing security awareness posts.

---
AI-assisted summary of public posts. Audience demographics are not available. Engagement appears only where we checked recent posts. Method: https://b2binfluencer.marketing/methodology/