The OWASP Top 10 is the world's reference list of the 10 most critical categories of web vulnerabilities, maintained by OWASP (Open Worldwide Application Security Project). It covers SQL injections, authentication flaws, sensitive data exposure, Cross-Site Scripting (XSS), security misconfigurations and other major application attack vectors. Our web audits rely on this taxonomy to structure tests, classify detected vulnerabilities and prioritise recommendations in reports — ensuring coverage aligned with the standards recognised by application security professionals worldwide.

Our service www.cvefind.com is a search and monitoring platform dedicated to IT vulnerabilities. It allows cybersecurity professionals, developers, administrators, or CISOs to quickly consult known vulnerabilities (CVEs), track their evolution, and access additional indicators to prioritize remediation.

Our goal with CVE Find is to make information more accessible, readable, and actionable than on official databases, which are often too technical or not very user-friendly. We centralize useful data (CVSS, EPSS, KEV status, dates, affected products), and facilitate decision-making for remediation or alert actions.

The OFCS (Federal Office for Cybersecurity, formerly NCSC) is the national Swiss authority responsible for coordinating the protection of critical infrastructure, managing cybersecurity incidents at the national level and raising awareness among businesses and the general public. It regularly publishes alerts, recommendations and reports on current threats. Bexxo follows its publications to remain aligned with Swiss strategic and regulatory priorities — particularly in the context of the nFADP (new Federal Act on Data Protection).

Cyber Safe is a Swiss cybersecurity label that certifies that the labelled company applies appropriate and recognised IT security measures. It is accessible to SMEs as well as large organisations and provides a structured framework to strengthen digital security posture. The label is awarded after an assessment of the company's practices against defined criteria. Bexxo is an affiliated partner of Cyber Safe: we support clients who wish to initiate or consolidate a labelling process.

The ICT Minimum Standard is a framework developed by FOEE (Federal Office for National Economic Supply) in collaboration with the NCSC. It defines 106 measures based on the NIST CSF, adapted to the Swiss context. Free and available in French, German and Italian, it includes an Excel self-assessment tool.

Bexxo offers 5 service categories: (1) Web and network security audits (ISO 27001, NIST CSF); (2) Penetration tests; (3) Vulnerability monitoring via CVE Find, integrating MITRE, NVD and CISA KEV data; (4) Phishing simulation via PhishTrainer, a Swiss software with client-side encryption; (5) Consulting and nFADP compliance. Our audits detect an average of 12 to 15 critical vulnerabilities per SME.

Act immediately: (1) disconnect from the company network (Wi-Fi, cable); (2) report the incident to your IT department or security officer without delay — by phone, not by email; (3) change your password from another secure device; (4) do not delete the suspicious email, it is needed for forensic analysis; (5) enable MFA if not already done. The faster you act, the more the damage can be limited.

Our comparative analysis from February 2026 evaluates 8 solutions for Swiss SMEs (5-200 employees). Only 3 fully comply with the nFADP with hosting in Switzerland or Europe. Download the full report to discover our detailed recommendation by SME profile.

Our 12 security policy templates are aligned with the controls of ISO 27001:2022 (Annex A) and NIST CSF recommendations. They cover key areas: authentication, access control, data classification, cryptography, backups, supplier management and human resources.

Bexxo is a cybersecurity expert company based in Neuchâtel, Switzerland. We conduct audits, offer consulting services, and help our clients improve the protection of their IT systems against current threats.

In an SME, all employees should be trained, at least on the basics of cybersecurity. Every profile is concerned: the administrative staff who manage sensitive documents, the sales representative who exchanges emails with external parties, or the technician who accesses management tools. The training must be adapted to the role and the risks associated with each position.

In addition, technical teams, security referents (when they exist), and management must undergo more in-depth training to understand the issues, manage decisions, and react effectively in the event of an incident. In an SME, where resources are limited, training intelligently and progressively is often more realistic than aiming for exhaustiveness.

Precise and measurable objectives help structure available resources, anticipate threats, and implement targeted action plans to strengthen the overall resilience of your infrastructure.

Over 40% of cyberattacks in Switzerland target SMEs. An audit identifies vulnerabilities in your systems (network, website, access) before they are exploited, and ensures compliance with ISO 27001 and the Swiss Data Protection Act (nDSG).

The CVSS (Common Vulnerability Scoring System), developed by NIST, is the universal standard for assessing the severity of vulnerabilities. It assigns each vulnerability a score from 0 to 10 based on objective criteria: attack vector (network, local, physical), exploitation complexity, privileges required, user interaction, and impact on confidentiality, integrity and availability. Using CVSS allows Bexxo to communicate vulnerability criticality in a standard language understood by all IT professionals — and allows our clients to compare audit results with globally recognised benchmarks.

Bexxo is one of the rare organisations in Switzerland to combine two complementary expertises under one roof: cybersecurity and physical data recovery. Our group includes SOS Data Recovery (sdr.ch), a recovery specialist since 2006, equipped with a cleanroom and forensic equipment to intervene on all types of media — hard drives, SSDs, RAID, NAS, servers. In practice: a standard cybersecurity provider stops at software decryption and backups. If these options fail, they have nothing more to offer. Bexxo can go one step further and attempt physical data extraction from the medium — a decisive capability in the most critical cases.