🇨🇭 Switzerland isn't in the EU – yet NIS2 keeps landing on the desks of Swiss and other non-EU companies. In episode 2 of Cyberopex Briefing, Christian Serra walks through the three paths by which the EU directive reaches you – and what to do now.

🎧 In this episode:

• 📰 News radar: ransomware attack on pension fund software vendor PK Softech (Publica) and a fraud warning from Zurich police · 115,000 customer records from an Offerz test environment · actively exploited flaws in Cisco Secure Email Gateway and Palo Alto firewalls
• 🔍 Deep dive: NIS2 from outside the EU – EU subsidiaries, digital service providers and the supply chain, plus Switzerland's own reporting duty and five concrete steps
• 💡 Practical tip: three questions for your three most important software providers – done in under an hour

📚 Sources:

• Cash/AWP: Attack on Publica supplier (German)
• SRF: How did sensitive pension data end up at an external software firm? (German)
• Zurich cantonal police: fraudsters target pension funds after cyberattack (German)
• Cash/AWP: Attack on Offerz – 115,000 customer records (German)
• Help Net Security: CISA flags exploited flaws in Palo Alto, Cisco and Ahsay products
• EU: Directive (EU) 2022/2555 (NIS2), Articles 21 and 26
• Börse Express: BSI registration for 29,500 companies (German)
• SECJUR: Austria's NISG 2026 (German)
• Blick: Swiss reporting duty for critical infrastructure – first-year review (German)

🤖 This episode uses an AI-generated version of Christian Serra's voice. Christian reviews and approves all content and sources himself.

✉️ Contact: info@cyberopex.com · 🌐 cyberopex.com

Since 11 September, manufacturers selling into the EU must report actively exploited vulnerabilities within 24 hours – including Swiss and other non-EU companies. In the first episode of Cyberopex Briefing, Christian Serra explains what that means in practice and what to do on Monday.

In this episode:

• News radar: attacks on Swiss organizations up 36% · EU AI Act transparency rules (Art. 50) now in force · Amgen and third-party cloud risk
• Deep dive: Cyber Resilience Act – the 24-hour reporting clock, ENISA's Single Reporting Platform and five steps to take now
• Practical tip: the 30-minute, 24-hour drill for your response team

Sources:

• Netzwoche: Cyberattacks on Swiss companies up 36% in August (German)
• European Commission: Cyber Resilience Act – Reporting obligations
• ENISA: The CRA Single Reporting Platform is launched
• McCann FitzGerald: CRA reporting obligations apply from 11 September 2026
• McCann FitzGerald: EU AI Act transparency compliance (Art. 50)
• BleepingComputer: Amgen cloud data breach

This episode uses an AI-generated version of Christian Serra's voice. Christian reviews and approves all content and sources himself.

Contact: info@cyberopex.com · cyberopex.com