Choosing a security awareness provider in Switzerland

Choosing a security awareness provider

Choosing a security awareness provider in Switzerland means checking whether the session fits your payment and reporting risks, leaves audit-ready records, runs in your languages, and matches headcount without buying a learning platform that stays empty after kick-off. The cheapest seat licence is often the wrong product for a forty-person finance team that never logs in.

This page is for leadership, HR and finance in SMEs with about 20 to 250 staff and no CISO. You are comparing live facilitators with platform vendors because an insurer, customer or board asked for evidence.

What a good provider delivers

• Swiss scenarios in the slides: CEO payment mail, changed invoice IBAN, parcel SMS, fake Microsoft sign-in
• Clear outputs after the session: attendance, topic outline, optional mapping to ISO/IEC 27001:2022 A 6.3 or NIST SP 800-50 on request
• Follow-up a few weeks after the live session, not only a reminder email six months later
• Languages and location: German and English live, remote or on site in Switzerland with travel included
• Transparent headcount per package, without hidden per-seat licence fees

Training does not certify your company. It supplies content and records you can file in audits and questionnaires.

Live session or platform

Many SMEs need one live session per year with questions from the room, plus short modules for new hires. Pure e-learning seats without facilitation fit when hiring is very predictable and someone collects completions. If you are unsure, read e-learning vs live security awareness training.

If a vendor offers phishing simulations, clarify notice and how results are used before you sign. The Swiss framing is in are phishing simulations allowed in Switzerland. Simulations do not replace a clear report path.

Content, proof and coordination

Ask what preparation looks like: a short look at your sector, not a generic world map. Who facilitates, who collects attendance, who answers report mail after the session? Without names on paper, the programme stops when someone is on holiday.

Keep records simple: invitation, sign-in sheet, one-page summary and follow-up notes in one folder per year. Store an ISO A 6.3 mapping letter separately from the attendance list.

Tie examples to real processes: the same IBAN check finance uses in ERP, the same report mailbox IT monitors. When a process changes, send an update instead of waiting twelve months.

Most SMEs run training with an external facilitator while the IT partner owns mail rules and MFA. Agree in writing who sends reminders, who collects attendance and who answers reports after the session. HR owns the calendar, finance confirms payment stories in the slides, IT checks that examples match your mail system.

Price and scope for small and medium teams

• Aurum StandardCHF 1’190

  Up to 25 participants: prep review, live training 1–2 hours, follow-up call a few weeks later.

• Aurum PlusCHF 2’190

  Up to 50 participants, same structure.

• LargerCustom

  Quote on request.

• FormatRemote / on site

  German and English, travel included in Switzerland.

Vendors’ prices change; without a verified quote, omit the number. Compare package price with headcount, not only «per seat» in the small print.

Who should not book a live SME session yet

Swiss context in two sentences

According to the BACS half-year report 2025/2, fraud made up 52 per cent of reports in the second half of 2025 (external statistic). CEO fraud rose from 719 reports in 2024 to 971 in 2025, also per BACS. Payment and identity fraud belongs in every annual slot, even if last year was «only» clicked links.

Among firms under 250 staff, Deloitte 2026 reported regular cyber training at 65 per cent of small and 82 per cent of medium companies (again external measurement). The gap is in «what, how well, with what proof».

The BACS cyberattack reporting duty applies to critical infrastructure operators, not most SMEs. Do not confuse staff with 24-hour rules unless you know you are in scope.

Questions before you sign

• Who facilitates live, and who is backup if they are ill?
• Which sector incidents will appear in the slides?
• How are recordings handled if you film the session?
• Cancellation and headcount: what changes if you are plus or minus five people?
• Which languages in the same half-day, which materials afterwards?

Discovery conversation and next step

On Security Awareness Training you can book a discovery conversation with Riccardo Conti, co-founder. Use it to confirm scope, language and headcount band. Who should skip the call: procurement shopping for the cheapest per-seat licence without reading the live agenda, or firms that already run a mature global programme.

For a data protection session on the same day, the overview at /security describes combined training. «Training on the FADP and the GDPR» means content is aligned with the law; the session does not make anyone automatically «done».

Shortlist two providers, compare proof outputs before price, and run one live session before you sign a three-year LMS contract.