Pascal Zaugg

Trachsel identified two attack vectors companies underestimate: social engineering aimed at employees, such as CEO fraud, and exploitation of system vulnerabilities.

• Zaugg argues that the countermeasures Trachsel mentioned—multi-factor authentication and consistent updates—are purely technical.
• They protect systems but do nothing against attacks aimed at employees.
• Closing that gap requires employees trained to be sceptical and check back, plus clear rules about who may approve what.
• The post divides the response into system and human measures: enable MFA everywhere and install critical updates within 48 hours; train the team regularly on real attack patterns and define when checking back is mandatory.

A caller poses as the managing director and requests an urgent transfer. Multi-factor authentication cannot stop the attack; an employee must question the request and check back.

Read original

Risks include uploading company documents to public tools for summarising, pasting customer data into prompts because it is faster than the official route, and entering construction plans, contracts or quotations as sample text.

• Once data reaches a public tool, the company loses control over where it goes.
• It may be stored on servers abroad, used to develop AI models or exposed in a provider breach.
• A customer list pasted into the wrong tool cannot be recalled.
• Zaugg recommends against a ban and lists three actions: offer approved business tools so nobody has to work around the rules, train the team with concrete examples of what may and may not be entered, and set clear rules instead of prohibitions.
• Shadow AI disappears when employees know what is allowed and have an official route that works just as well.

A customer list pasted into the wrong public AI tool is described as irretrievably outside the company's control, even if the tool is later deleted or the provider changes its terms.

Read original

They call it understandable but wrong, then draw on the Swisscom Cybersecurity Threat Radar 2026 to give three reasons Swiss small and midsize companies are increasingly targeted.

• First, SMEs supply larger firms, so breaching them can expose a larger customer's data.
• Second, they hold specialist knowledge, including machine components, medical technology and precision parts sought internationally.
• Third, they are easier to hit: large corporations run security teams around the clock, while SMEs have much tighter resources.
• The takeaway: attackers seek not the biggest fish, but the most rewarding target with the least resistance.
• The post turns this into a self-assessment: which internal data would be valuable to others, and where could the company act as a door-opener for others?

Construction plans, recipes, customer lists, supplier details and price calculations are cited as ordinary business data that can make an SME valuable to an attacker.

Read original

Pascal Zaugg reports that supply-chain attacks have almost quadrupled since 2020 and cites the Verizon Data Breach Report's finding that around 30 percent of data breaches now trace back to third parties, double the previous year.

• The mechanism is straightforward: attackers reach a company through its software vendor, cloud service or a supply-chain interface, and the access can go unnoticed for months because it looks legitimate from outside.
• A digitalswitzerland study found that one in three Swiss SMEs has already been affected by a cyberattack, fewer than half have an emergency plan, and few systematically check suppliers' and service providers' security practices.
• The post frames this as shared responsibility with the IT partner, not distrust.
• It offers four questions for that conversation: who has which access, how software updates are checked before installation, whether there is a joint emergency plan if a supplier is compromised, and whether employees are trained to recognise suspicious activity.

An attacker enters through a software vendor, cloud service or supply-chain interface, not the company's own systems. The access looks legitimate from outside and can go unnoticed for months.

Read original

According to the Federal Office for Cybersecurity, one in three Swiss SMEs has already been a victim of a cyberattack, and almost half of those cases involved ransomware.

• The post explains ransomware-as-a-service: criminals buy ready-made extortion software, so they need no hacking skills of their own.
• They deliberately target less well-protected companies, where resistance is lower and payment comes faster because many SMEs cannot afford a long outage.
• Zaugg says the internal picture is most troubling: at 42 percent of Swiss SMEs nobody is responsible for IT security, even though management is legally responsible, and only half train employees against cyberattacks.
• The post's conclusion: being small does not protect a company; it makes it a target.
• Getting started does not require a fortune.

At 42 percent of Swiss SMEs, nobody is responsible for IT security; only half train employees against cyberattacks, while almost half of SME cyberattack cases involve ransomware.

Read original

Each opens with a quoted finding from a named authority or report, or a recurring objection raised in consultations.

• The posts cite the SRF question-and-answer piece with Dominique Trachsel of the Federal Office for Cybersecurity, the Swisscom Cybersecurity Threat Radar 2026, the Verizon Data Breach Report and a digitalswitzerland study.
• Each then spells out the implication for Swiss SMEs, offers a short checklist with bolded or arrow-marked lead-ins, and closes with an invitation to a free initial conversation and a link to a related blog article in the comments.
• Written in German, the posts pair technical terms with plain explanations and name no specific products beyond broad tool categories.

The shadow AI post follows a clear pattern: a report finding, a concrete risk for SMEs, a three-point action list and a free initial assessment offer. The supply-chain post ends with four supplier questions and a link to a blog article.

The posts consistently pair technical measures with human ones: MFA and updates need trained employees; AI rules need an approved tool route that works as well as the workaround; and supply-chain security needs shared responsibility with the IT partner, not a ban or accusation.

Read original · Original 2 · Original 3 · Original 4 · Original 5

Start here for the set’s most current topic and clearest step-by-step remedy.

Pascal Zaugg draws the term “shadow AI” from the Swisscom Cybersecurity Threat Radar 2026 and makes it concrete: employees summarise company documents with public AI tools, paste customer data into prompts because it is faster than the official route, and enter construction plans, contracts or quotations as sample text.

• Once data sits in a public tool, the company no longer knows where it goes: it can be stored on servers abroad, used to develop AI models or exposed in a provider breach.
• A customer list that lands in the wrong tool is out for good.
• The recommended response is not a ban.
• Zaugg lists three actions: provide approved business tools so nobody has to work around the rules (ChatGPT Enterprise, Microsoft Copilot with business data protection); train the team with concrete examples of what may and may not be entered into a tool; and set clear rules rather than prohibitions, naming which data is off-limits and which is not.
• The closing argument: shadow AI disappears when employees know what is allowed and have an official path that works just as well.
• The post cites the threat radar and points to a free initial consultation.

For brands planning a campaign

A partnership can build on the practical, non-prohibition framing: pair an AI-use policy template with a short training session, and use the “official path that works as well as the workaround” as the campaign line—not a scare message.

Start here to see how Zaugg positions the human side of security.

Zaugg responds to an SRF question-and-answer piece on cybersecurity from 15 April 2026, in which Dominique Trachsel, head of awareness at the Federal Office for Cybersecurity, was asked which cyber risks companies currently underestimate.

• He quotes her answer: two attack vectors are commonly underestimated—social engineering through employees, such as CEO fraud, and system vulnerabilities—with multi-factor authentication and consistent updates named as countermeasures.
• Zaugg’s observation is that both are purely technical: they protect systems but do nothing against attacks aimed at employees.
• The example he draws from Trachsel is a phone call in which an attacker poses as the managing director and requests an urgent transfer.
• No multi-factor authentication stops that, they write; only an employee trained to be sceptical and check back does.
• Zaugg divides the advice into a system side (enable MFA everywhere, install critical updates within 48 hours) and a human side (train the team regularly with real attack patterns, define who may approve what and where checking back is mandatory).
• The federal office treats both weaknesses as equal; technology helps against only one of them.

For brands planning a campaign

This is the strongest fit for a brief built around social engineering. A campaign could pair Zaugg’s two-sided argument with a CEO fraud or phishing simulation, using the 48-hour update window and approval-process questions as hooks for a compact checklist lead magnet.

Start here to see how Zaugg reframes being small from protection into a reason to be attacked.

Zaugg opens with a sentence they say they hear several times a week in advisory conversations: “We are too small for cyberattacks.”

• They call it understandable and wrong, then draw on the Swisscom Cybersecurity Threat Radar 2026, dated 27 April 2026, to give three reasons Swiss small and midsize companies are increasingly in the sights.
• First, they supply larger firms, so attacking them reaches big customers’ data.
• Second, they hold specialised knowledge, including machine components, medical technology and precision parts in demand internationally.
• Third, they are easier to hit: large corporations have security teams working around the clock, while SMEs operate with noticeably tighter resources.
• The summary: attackers no longer look for the biggest fish, but for the most rewarding target with the least resistance.
• A Swiss SME with valuable patents, customer data and insufficient protection fits that description.
• The practical section offers three self-check questions: which company data would be valuable to others, including construction plans, formulations, customer lists, supplier details and price calculations; how the supply chain could make the company a door-opener for others; and where those weak points sit.

For brands planning a campaign

The three reasons and self-check questions translate directly into a scored self-assessment tool: a short risk quiz that captures what data a company holds and how connected it is, followed by a consultation offer.

Start here for the third-party risk angle.

Supply-chain attacks have almost quadrupled since 2020, and the Verizon Data Breach Report attributes 30 percent of data breaches to third parties—twice as many as in the previous year.

• Zaugg explains the mechanism plainly: attackers route through a software vendor, cloud service or supply-chain interface instead of targeting the company directly.
• Because the access looks legitimate from outside, it often goes unnoticed for months.
• They cite a digitalswitzerland study showing that one in three SMEs has already been affected by a cyberattack while fewer than half have an emergency plan; very few systematically check the security practices of suppliers and service providers.
• The framing is not an accusation of the IT partner but a call for shared responsibility: good IT security does not stop at your own front door.
• Four questions guide the conversation with an IT partner: who has which access to your systems; how software updates are checked before installation; whether there is a joint emergency plan if a supplier is compromised; and whether employees are trained to recognise suspicious activity.
• A blog post on what supply-chain attacks are and how to defend against them is offered in the comments.

For brands planning a campaign

A partnership could turn the four supplier questions into a one-page audit worksheet, positioning the partner as someone who works through them with the client rather than criticising the existing IT provider from the outside.

Start here for the clearest statement of the gap between the level of risk and the level of internal responsibility.

Zaugg opens with “We are simply too small for ransomware” and sets federal figures against it: according to the Federal Office for Cybersecurity, one in three Swiss SMEs has already been a victim of a cyberattack, and almost half of those cases involved ransomware.

• They explain ransomware as an industrialised business model, ransomware-as-a-service, in which criminals buy ready-made extortion software and deliberately target less well-protected companies.
• No hacking knowledge of their own is required; resistance is lower, and payment comes faster because many SMEs simply cannot afford a long outage.
• What troubles Zaugg most is the internal picture: at 42 percent of Swiss SMEs nobody is responsible for IT security, even though it is legally a management responsibility, and only half train their employees against cyberattacks.
• The closing argument: being small does not protect you; it makes you a target.
• You do not need to invest a fortune, but you do have to start.
• A blog post explaining ransomware-as-a-service is offered in the comments.

For brands planning a campaign

A campaign can make the responsibility statistic its core message: a management-level briefing or named-responsible-person checklist, with the outage-cost argument explaining why a decision cannot be postponed.

The argument: MFA and prompt updates protect systems but do nothing against a caller impersonating a managing director and demanding an urgent transfer.

• Closing that gap takes employees trained to be sceptical and ask again, plus clear rules about who may approve what.
• The post divides the response into system-side measures (MFA everywhere, critical updates within 48 hours) and human-side measures (regular training on real attack patterns, defined approval processes).

Quotes an official answer from a named authority, then divides the response into technical and human measures with a three-point action list.

This sample’s strongest reliance on government guidance comes in a post citing BACS representative Dominique Trachsel by name.

For brands planning a campaign

The post frames technical hardening and staff training as equally important, making it a fit for a joint campaign that pairs a security product or service with an employee-awareness module rather than a single-product pitch. A provider can position itself as covering both sides of the problem.

Examples: Source 1

Examples include uploading company documents for summaries, pasting customer data into prompts because it is faster than the official route, and entering construction plans, contracts or quotes as sample text.

• The post argues that once data reaches a public AI tool, the company loses control over where it goes: it may be stored on servers abroad, used to train models or exposed in a provider breach.
• A customer list sent to the wrong tool cannot be recalled.
• The recommended response is to offer approved enterprise tools so nobody has to work around the rules, train the team with concrete examples rather than abstract policies, and set clear rules about which data is off-limits instead of banning the tools outright.

Report-backed risk framing followed by a three-step remediation list and a clear case against prohibition.

For brands planning a campaign

An AI governance campaign for SMEs can build on the framing that bans do not eliminate shadow AI: an official route that works just as well can. That opens the way to a combined offer of usage rules, training and approved tooling, aimed at management as well as IT.

Examples: Source 1

It adds digitalswitzerland's finding that one in three Swiss SMEs has already been hit by a cyberattack, fewer than half have an emergency plan, and few systematically check the security practices of suppliers and service providers.

• The argument: attackers can reach a company through its software vendor, cloud service or supply-chain interface, and outside access can look legitimate for months.
• The post closes with four questions to put to an IT partner: who has which access, how software updates are checked before installation, whether a joint emergency plan exists if a supplier is compromised, and whether employees are trained to spot suspicious activity.

Combines two named research sources, turns them into a partner-facing checklist and points to a blog article for detail.

For brands planning a campaign

The four-question list can serve as a workshop worksheet or lead magnet for a campaign targeting SME procurement and IT decision-makers. Its emphasis on shared responsibility with the IT partner also gives a services provider a cooperative, rather than fear-based, message.

Examples: Source 1

They deliberately target less well-protected companies, where resistance is lower and payment comes faster because many SMEs cannot absorb a long outage.

• The post highlights that at 42% of Swiss SMEs nobody is responsible for IT security, even though the responsibility lies legally with management, and that only half train their employees against cyberattacks.
• Its closing argument: being small does not protect a company; it makes the company a target.
• Getting started does not require large spending.

Official statistics, a plain explanation of the attacker's economics and an offer of further reading in the comments.

For brands planning a campaign

Fits a campaign selling basic readiness — clear ownership and staff training — rather than expensive technology. The line that no fortune is needed, but a start is, can support a low-friction entry offer such as a readiness check or awareness session.

Examples: Source 1

The post gives three reasons drawn from the Swisscom Cybersecurity Threat Radar 2026: SMEs supply larger firms, so breaching them can expose a larger customer's data; they hold specialist knowledge in machine components, medical technology and precision parts that is sought internationally; and they are easier to hit because large corporations run security teams around the clock while SMEs work with much tighter resources.

• Attackers, the post argues, no longer look for the biggest fish but for the most lucrative target with the least resistance.
• It suggests an honest self-assessment of which internal data would be valuable to others — construction plans, recipes, customer lists, supplier details, price calculations — and where the company could act as a door-opener for others.

Starts with a recurring client objection, rebuts it with three report-based reasons, then prompts a self-assessment.

The post starts with the creator's advisory conversations and attributes its three reasons to the Swisscom Threat Radar 2026.

For brands planning a campaign

The rebuttal of a common misconception is a natural hook for a campaign offering SME owners a low-commitment risk assessment. Its three-reason structure is short and concrete, and can be adapted almost directly for email, ad or landing-page copy.

Examples: Source 1

Each opens with a quoted finding from a named authority or report — an SRF Q&A with a BACS representative, the Swisscom Cybersecurity Threat Radar 2026, the Verizon Data Breach Report or a digitalswitzerland study — or with a recurring objection from consultations.

• Each then states the uncomfortable implication for Swiss SMEs, gives a short checklist of concrete actions with bolded or arrow-marked lead-ins, and closes with an invitation to a free initial conversation and a link to a related blog article in the comments.
• Sources are dated where the underlying material is dated, for example 15 April 2026 and 27 April 2026.
• The posts are written in German for a Swiss audience, pair technical terms with plain explanations, and avoid naming specific products beyond broad tool categories.

Quote or objection, implications for SMEs, action checklist, consultation call to action and supporting blog link.

For brands planning a campaign

A partner can fit into an established rhythm by supplying an SME-relevant report, dataset or objection; the collaboration then fits the existing post structure without changing the creator's format. The recurring free initial assessment offers a ready-made conversion step for a joint campaign.

Examples: Source 1 · Source 2 · Source 3 · Source 4 · Source 5

One explains why Swiss SMEs are now targeted: they supply larger firms, hold specialised know-how and are cheaper to hit. The other highlights the report’s “shadow AI” finding: employees upload documents, customer data, contracts and quotes to public AI tools.

View example

Trachsel identifies two attack vectors Swiss companies underrate: social engineering such as CEO fraud, and unpatched system flaws. Another post cites BACS figures showing that one in three Swiss SMEs has already been attacked, ransomware featured in nearly half of those cases, and 42% of SMEs have nobody responsible for IT security.

View example

View example

View example

View example

One post also says the arguments come from “my consulting conversations” several times a week. The posts do not name the company behind the offer or explain Zaugg’s relationship to it; ask who provides the advisory service.

View example

Heininger's post taking apart the claim that AI produces hardly any measurable efficiency gains reads like Zaugg's objection posts: a widely repeated statement is quoted, questioned, and replaced with specifics from their own work.

Heininger's subject is AI adoption and enablement inside companies, not cybersecurity. Their posts describe a personal working day rather than published reports and official statistics.

Read original · Original 2

The offer-to-win post states a rate, lists six wrong assumptions and ends with a proposal structure — the pattern Zaugg follows when a report finding becomes a short action list.

Eberhardt works on B2B sales proposals and team culture rather than security, and draws on their own business results — win rates and euro amounts — where Zaugg cites official statistics and vendor research.

Read original · Original 2

Strehlow's post on why a paid campaign reached them by mistake is close in tone to Zaugg's posts that name sloppy practice and say what to do instead.

Strehlow's field is paid social and performance marketing, and their arguments focus on campaign targeting and lead quality, not security risk.

Read original · Original 2

Their posts argue that companies see little AI efficiency because employees have not been taught to use AI well.

• They compare AI agents to new hires who need a job description, access, onboarding, a probation with 50 real cases, rules, team integration, feedback, and a cost measure.
• That makes Heininger a stronger match than Pascal Zaugg for a provider whose shadow-AI offer focuses on employee enablement, agent governance, and measurable rollout—not phishing, CEO fraud, or ransomware awareness.

Heininger's reviewed posts focus on AI productivity and governance, not cybersecurity risk, regulatory duties, attacker methods, or Swiss SME security evidence.

• A security provider would give up Pascal Zaugg's concrete framing of social engineering, supply-chain risk, and shadow AI, as well as the free initial security assessment call to action.
• Heininger fits when security is a feature of an AI productivity and governance campaign, not its main subject.

Examples: Source 1 · Source 2

Their posts describe a proposal method credited with raising an offer-to-win rate from under 10% to over 87%, and a cultural-debt argument that a bad hire cost a team EUR 265,000.

• For a cybersecurity provider whose offer stalls because SMEs treat security as a low-priority purchase, Eberhardt's work speaks to management attention, trust, and the cost of inaction.
• Eberhardt is the better fit when the campaign aims to help SME leaders see security as a commercial and organisational obligation.

Eberhardt's reviewed posts offer management persuasion but no cybersecurity subject matter, attacker or control detail, or Swiss SME security statistics.

• A provider choosing Eberhardt over Pascal Zaugg would trade topic authority and educational content for a business-and-culture angle.
• Ask whether a security message can fit that conversation without becoming a generic business post.

Examples: Source 1 · Source 2

Their posts explain Meta lead-quality goals, value optimization, CRM connections, instant-form filtering, and appointment booking.

• They advocate a full loop from ad to lead to CRM to qualification to revenue and back to Meta.
• For a Swiss SME cybersecurity provider that already has awareness content and needs qualified initial assessments at volume, Strehlow is a better fit than Pascal Zaugg: their material is about buying and measuring paid demand, not writing security awareness posts.

Strehlow's reviewed posts cover performance marketing for e-commerce and general customer acquisition, not cybersecurity.

• Ask for evidence of cybersecurity expertise before choosing Strehlow as a source of subject-matter authority.
• They can complement an awareness creator, but replacing a security educator with a paid-social operator shifts the campaign from trust-building to acquisition and calls for a shorter, offer-led message.

Examples: Source 1 · Source 2