Red Teaming Providers Switzerland 2026

Last updated: June 23, 2026

Red teaming in Switzerland

Switzerland, as an international financial center, places particularly high demands on cyber resilience. FINMA (Swiss Financial Market Supervisory Authority) and the NCSC (National Cyber Security Centre) set the regulatory framework.

Unlike a classic penetration test, which looks for vulnerabilities within a clearly bounded scope, a Red Teaming Assessment simulates a real, multi-stage attack against the entire organization, covertly and across technical, physical, and social attack vectors. It shows whether an intrusion succeeds and whether the defense detects and stops it in time. This test of detection and response capability makes red teaming relevant for regulated Swiss financial institutions, which must demonstrate their operational resilience not just on paper but under realistic conditions.

Regulatory framework

• FINMA: Swiss Financial Market Supervisory Authority requirements for cyber resilience and operational stability
• DORA: the EU's Digital Operational Resilience Act; does not apply in Switzerland itself, but binds EU-regulated subsidiaries of Swiss groups
• NCSC: National Cyber Security Centre, recommendations and situation reports

Regulatory context for red teaming in Switzerland

Switzerland is not an EU member, so DORA and the European TIBER-EU framework do not apply directly here. National requirements apply instead, above all FINMA Circular 2023/01 on operational risks and resilience at banks, in force since 1 January 2024. It obliges supervised institutions to identify, manage, and regularly test their operational resilience. FINMA explicitly expects institutions to verify the effectiveness of their protective, detective, and responsive measures under realistic conditions, which is what a red teaming assessment does.

Switzerland has no mandatory national TIBER implementation. In the same circular, however, FINMA requires risk-based scenario cyber exercises built on each institution's own threat landscape, which can include red team exercises. DORA covers only EU-regulated entities, for example the EU subsidiaries of a Swiss group; where such a subsidiary has to perform a TLPT, the active red teaming phase of that TLPT lasts at least twelve weeks. A threat-led exercise (Threat-Led Penetration Testing) can therefore serve two purposes: it addresses FINMA's expectation of tested resilience and, for EU subsidiaries, lays the groundwork for a formal DORA TLPT.

For the processing of personal data, the revised Federal Act on Data Protection (revDSG), in force since 1 September 2023, is also relevant. Because red teaming, and social engineering in particular, frequently touches real employee data and production systems, clear rules of engagement, a sound data-processing agreement, and a documented legal basis are part of every serious Swiss engagement plan.

What to look for when choosing a provider

Red teaming is a matter of trust, because a capable team moves covertly through your production environment. When choosing a provider in Switzerland, pay attention to the following:

• A dedicated red team, not generalists: The provider should run red teaming as a core business and bring verifiable certifications (OSCP, OSEP, CRTO).
• Threat-led methodology: A serious assessment starts with realistic threat intelligence and reproduces the TTPs of relevant attacker groups.
• Regulatory experience: familiarity with FINMA Circular 2023/01, with TLPT/DORA-aligned processes, and with the requirements for documentation and evidence.
• Clean rules of engagement and data protection: a clearly defined scope, emergency communication channels, revDSG-compliant data processing, and transparent handling of production systems.
• A clear report and knowledge transfer: The value of red teaming lies in learning from it. A good provider explains attack paths in an understandable way and derives concrete, prioritized measures for the blue team.

Red teaming providers in Switzerland

• Compass Security: Swiss security firm (Rapperswil-Jona), Red Teaming and penetration testing
• NVISO: Red Teaming and offensive security, covers Switzerland through its DACH entity (offices in Frankfurt, Munich and Vienna)
• Oneconsult: Cybersecurity services, Zurich, Red Teaming and incident response
• Redguard: Penetration testing and security assessments, Bern
• scip AG: Security research, Red Teaming and penetration testing, Zurich

→ All Red Teaming Providers in the DACH Region
→ All Pentesting Providers in the DACH Region
→ Physical Security Providers in Austria, Germany and Switzerland