Bexxo supports Swiss SMEs in their IT security.
SwissLabel
Swiss Label Certification
Bexxo is Swiss Label certified, the quality label guaranteeing that our services are provided in Switzerland, by a Swiss company, according to Swiss quality standards.
CyberSafe Switzerland Partner
Bexxo is a certified CyberSafe Switzerland partner, the official Swiss Confederation programme dedicated to promoting cybersecurity for Swiss businesses.
Our Cybersecurity Services
Website Security
01 Complete audit and vulnerability detection
A Bexxo web audit is a comprehensive technical examination of the company's website: automated and manual analysis of vulnerabilities (OWASP Top 10, SQL injections, XSS, CSRF, server configuration), report classified by criticality, and prioritized action plan. Our clients fix an average of 12 to 15 vulnerabilities per engagement, with a clear remediation plan, before they could be exploited.
02 Protection against attacks
Bexxo deploys protections against the most frequent attack vectors: SQL injections, XSS, CSRF, brute force and ClickJacking. These vectors account for 88% of recorded web attacks (Verizon DBIR 2025): identifying and blocking them is enough to eliminate the vast majority of risk. Each measure is documented in the audit report with its criticality level.
03 Data security
The nLPD (in effect since September 1, 2023) sets clear obligations for securing personal data for all Swiss companies. Bexxo supports SMEs in assessing their nLPD compliance, identifying gaps and implementing the required technical measures. Fines of up to CHF 250,000 simply don't apply to our clients.
Enterprise Network Security
01 Network infrastructure audit and analysis
Our network audit maps all exposed attack vectors of your infrastructure, with an ISO 27001 and NIST CSF compliant report. In 2024, the Federal Office for Cybersecurity recorded 62,954 incidents in Switzerland. The audit tells you exactly where you stand.
02 Global IT infrastructure protection
CVE Find, Bexxo's proprietary tool, integrates the MITRE, NVD and CISA KEV databases in real time and sends an alert as soon as a known vulnerability affects the client's systems. Without active monitoring, the average detection time for a network breach reaches 241 days (IBM Cost of a Data Breach 2025). CVE Find reduces that to a matter of hours.
03 Securing access and sensitive data
Bexxo audits authentication policies, assesses password strength, deploys MFA and secures administrator and VPN access. Compromised credentials are behind 22% of data breaches (Verizon DBIR 2025): the most frequent vector, and also the easiest to fix with the right measures.
Our Cybersecurity Solutions
We analyze your entire IT infrastructure to identify potential flaws and improve the security of your connections, equipment, and protocols.
Learn more
We conduct an in-depth diagnosis of your website to detect vulnerabilities and strengthen its protection against cyberattacks, such as SQL injections, XSS flaws, and brute-force attacks.
Learn more
Our experts assist you in developing and optimizing your IT security policy. Together, we define a tailored strategy to secure your systems, reduce risks, and ensure your compliance with current regulations.
Learn more
We implement advanced technologies to protect your infrastructures, networks, and sensitive data. From access management to information encryption, we ensure effective protection against cyber threats.
Learn more
Why choose Bexxo?
Latest Thinking
How we collaborate with you
Listening and understanding
An initial meeting (30–60 min) to identify your systems, sensitive data and legal obligations (Swiss DSA, ISO 27001). No jargon, we speak your language.
In-depth analysis
Manual and automated analysis of your web and network systems. Duration: 3 to 10 days depending on complexity. Result: a complete vulnerability map ranked by criticality.
Correction and reinforcement
You receive a detailed report with a prioritised action plan. Our teams can implement corrections directly or support your IT teams in the remediation process.
Permanent vigilance
Continuous monitoring via CVE Find, real-time alerts on new vulnerabilities affecting your systems, and regular follow-up reports.
Measure, train, learn: one platform, one score
Security Culture Score, PhishTrainer and Bexxo Academy work together: evaluate your security culture, test your teams' reflexes, train them in a targeted way and track progress with a global score out of 1000, broken down by organisation, groups and employees.
01 Measure
Security Culture Score evaluates your security culture.
02 Train
PhishTrainer tests reflexes with realistic simulations.
03 Learn
Bexxo Academy trains with learning paths adapted to every profile.
04 Progress
Scores measure progress and guide next steps.
Cybersecurity tailored to your challenges
Cyberattacks are becoming increasingly sophisticated and can have disastrous consequences for businesses: loss of critical data, reputational damage, regulatory penalties, and business interruptions. A structured, continuously maintained cybersecurity strategy prevents these risks.
At Bexxo, we offer tailor-made protection solutions, adapted to your needs and compliant with the most demanding security standards, such as ISO 27001/27002 and NIST. In line with NCSC recommendations, we analyze, detect, and correct vulnerabilities in your infrastructure.
Stay ahead with the latest critical security vulnerabilities.
CVE-2026-108707 - CRITICAL
11/10/2026
Wukong_HRM through commit 186115e contains an authentication bypass vulnerability in ParamAspect that allows unauthenticated attackers to call every HRM API endpoint by omitting the AUTH-TOKEN header. Attackers gain HR administrator access to read payslips, salary history and employee personal data, download attachments, and modify or delete company-wide HR records.
authorisationproblemOWSAP: A07
CVE-2026-108708 - HIGH
11/10/2026
Wukong_HRM through commit 186115e contains a missing authorization vulnerability because EmployeeAspect assigns every caller the HR administrator role and EmployeeUtil data-scope checks return all employees. Any authenticated low-privileged employee can read payslips, salary records, bank cards and personal data, edit bank cards, and delete employees, departments and contracts company-wide.
authorisationproblemOWSAP: A01
CVE-2026-81797 - CRITICAL
10/10/2026
Unauthenticated PHP Object Injection in Buzz Stone | Magazine & Viral Blog WordPress Theme <= 1.0.2 versions.
OWSAP: A08
CVE-2026-78535 - CRITICAL
10/10/2026
Unauthenticated PHP Object Injection in Photolia <= 1.0.3 versions.
OWSAP: A08
CVE-2026-78533 - CRITICAL
10/10/2026
Unauthenticated PHP Object Injection in Qwery <= 3.6.1 versions.
OWSAP: A08
CVE-2026-78531 - CRITICAL
10/10/2026
Unauthenticated PHP Object Injection in Jacqueline <= 2.22 versions.
OWSAP: A08
CVE-2026-78529 - CRITICAL
10/10/2026
Unauthenticated PHP Object Injection in Alliance <= 3.11 versions.
OWSAP: A08
CVE-2026-66569 - CRITICAL
10/10/2026
Unauthenticated PHP Object Injection in Kicker <= 2.2.1 versions.
OWSAP: A08
CVE-2026-66568 - CRITICAL
10/10/2026
Unauthenticated PHP Object Injection in Original <= 1.9.0 versions.
OWSAP: A08
CVE-2026-66567 - CRITICAL
10/10/2026
Unauthenticated PHP Object Injection in Anesta <= 1.5.3 versions.
OWSAP: A08
CVE-2026-66565 - CRITICAL
10/10/2026
Unauthenticated PHP Object Injection in FC United <= 1.1.1 versions.
OWSAP: A08
CVE-2026-66564 - CRITICAL
10/10/2026
Unauthenticated PHP Object Injection in ShiftCV <= 3.0.14 versions.
OWSAP: A08
CVE-2026-66563 - CRITICAL
10/10/2026
Unauthenticated PHP Object Injection in Windsor <= 2.10 versions.
OWSAP: A08
CVE-2026-66483 - CRITICAL
10/10/2026
Unauthenticated PHP Object Injection in Education Center <= 3.6.12 versions.
OWSAP: A08
CVE-2026-66482 - CRITICAL
10/10/2026
Unauthenticated PHP Object Injection in Drone Media <= 2.2.0 versions.
OWSAP: A08
CVE-2026-62129 - CRITICAL
10/10/2026
Contributor Arbitrary File Upload in Creator LMS <= 1.2.21 versions.
fileinclusionOWSAP: A04
CVE-2026-62125 - CRITICAL
10/10/2026
Unauthenticated PHP Object Injection in Asia Garden <= 1.3.1 versions.
OWSAP: A08
CVE-2026-62124 - CRITICAL
10/10/2026
Unauthenticated PHP Object Injection in N7 | Golf Club Sports & Events <= 2.21 versions.
OWSAP: A08
CVE-2026-62123 - CRITICAL
10/10/2026
Unauthenticated PHP Object Injection in Invetex <= 2.18 versions.
OWSAP: A08
CVE-2026-62120 - CRITICAL
10/10/2026
Unauthenticated PHP Object Injection in Law Office <= 3.20 versions.
OWSAP: A08