Pragmatica AG https://www.pragmatica.ch/en/ Ihre Boutique Managementberatung seit über 25 Jahren. Wed, 27 May 2026 13:02:17 +0000 en-US hourly 1 https://wordpress.org/?v=7.0 Process Mining and AI: Webinar I & II https://www.pragmatica.ch/en/process-mining-webinar/ Tue, 19 May 2026 15:26:21 +0000 https://www.pragmatica.ch/process-mining-webinar-i-ii/ Many companies know what they are doing - but not always exactly how they are doing it.

Processes run, systems work, teams make decisions. But where do frictional losses occur? Where does reality deviate from the plan?

In our new webinar series, we will show you how you can use data-driven methods to gain clarity about your real processes - and how AI helps to translate this insight into real control capability.

Der Beitrag Process Mining and AI: Webinar I & II erschien zuerst auf Pragmatica AG.

]]>
  • webinar

Data. Processes. AI. - How analysis becomes real control - our webinar series starts soon

Graphic: Event log as a data source for process mining - with the four disciplines of process discovery, conformance checking, performance analysis and process enhancement, extended by AI

Many companies know what they are doing – but not always exactly how they are doing it.

Processes run, systems work, teams make decisions. But where do frictional losses occur? Where does reality deviate from the plan?

In our new webinar series, we will show you how you can use data-driven methods to gain clarity about your real processes – and how AI helps to translate this insight into real control capability.

Webinar I - Process Mining: How well do you really know your processes?

Wednesday, June 24, 2026 | 5:00-6:00 p.m.

Many companies are investing in digitalization and AI – and are finding that the foundation is missing: a clear, data-based picture of their own processes.

Process mining creates precisely this basis. It makes visible what really happens in your processes – not how they are documented, but how they actually take place in the information systems. What does the happy path look like? Where do delays occur? Where is there untapped efficiency potential?

What you take with you:

  • A realistic picture of what process mining is – and what it is not
  • Initial orientation (procedure, process selection, etc.) for a possible business case
  • Practical example from the financial industry
webinar I: Register

Speakers & Moderation

Dr. Stefan Michel verfügt über mehr als 15 Jahre Erfahrung im Finanz- und Bildungsumfeld mit Schwerpunkt auf Prozess- und Datenmanagement. Er ist Certified Senior Data Scientist (Fraunhofer) und Certified Business Process Professional (CBPP) der ABPMP. Seine Dissertation zum Thema Process Mining im Bankgeschäft der SNB unterstreicht seine Spezialisierung im datengetriebenen Prozessmanagement. Mit der Prozesslabor GmbH unterstützt er Organisationen dabei, ihre Prozesse klarer, effizienter und nachhaltiger zu gestalten – als Dozent im CAS Prozessdigitalisierung der ZHAW auch in der Wissensvermittlung verankert.

Dr. Stefan Michel

Speaker
Dr. Stefan Michel has more than 15 years of experience in finance and education with a focus on process and data management. He is a Certified Senior Data Scientist (Fraunhofer) and Certified Business Process Professional (CBPP) of the ABPMP. His dissertation on process mining in the banking business of the SNB underlines his specialization in data-driven process management. As a lecturer in the CAS Process Digitization at the ZHAW, he is also involved in knowledge transfer.
LinkedIn
Astrid Caviezel – Operational Excellence & Business Process Management | Pragmatica AG

Astrid Caviezel

Moderator
Astrid Caviezel has more than 18 years of experience in the financial services sector with a focus on operational excellence, business process management and change leadership. As a certified Lean Six Sigma Black Belt, she has led complex transformation and process optimization projects at AXA, Swiss banks and the Canton of Zurich. At Pragmatica, she advises clients on end-to-end process design, project management and sustainable organizational development.
LinkedIn

Webinar II - From transparency to intelligent control: process mining meets data science & AI

Wednesday, July 08, 2026 | 17:00-18:00 h

In the first webinar, we will show you how process mining makes visible what is really happening in your processes.

In the second part, we go one step further: How can process mining be combined with artificial intelligence to not only understand processes, but to actively control them in a future-proof way?

Structured event log data is only part of the reality. Emails, tickets, free text – unstructured data shapes many processes just as much. New methods from data science and AI are tapping into this potential: they explain why deviations occur, predict what will happen next – and automate where decision logic can be repeated.

What you take with you:

  • What data science and AI can do for processes
  • Practical example of a root cause analysis with ML
  • Concrete picture of new possibilities for your processes
webinar II: Register

Speakers & Moderation

Porträtfoto von Fredrik Moeschlin, Founder und Senior Advisor bei moe & company

Fredrik Moeschlin

Speaker
Fredrik Moeschlin is an advisor and generalist in data science, AI/ML and digitalization with a background in engineering physics and economics. As a former Senior AI & Data Science Manager at the Volvo Group, he has driven data-driven initiatives in predictive maintenance and automated root cause analysis. With moe & company, he now advises companies from data strategy to concrete ML implementation - with a focus on data-driven processes and AI-based applications.
LinkedIn
Astrid Caviezel – Operational Excellence & Business Process Management | Pragmatica AG

Astrid Caviezel

Moderator
Astrid Caviezel has more than 18 years of experience in the financial services sector with a focus on operational excellence, business process management and change leadership. As a certified Lean Six Sigma Black Belt, she has led complex transformation and process optimization projects at AXA, Swiss banks and the Canton of Zurich. At Pragmatica, she advises clients on end-to-end process design, project management and sustainable organizational development.
LinkedIn

Both webinars - a holistic picture

Both webinars stand alone – and unfold their full effect together. Those who attend both will get the full picture: from a data-based understanding of actual processes to future-proof, AI-supported control. Two perspectives, one goal: keeping your processes under control.

Questions about the webinar series or a specific project?

Contact us

Further topics

,

Process Mining and AI: Webinar I & II

to the article ➞

Self-services in digital banking

to the article ➞

, ,

FINMA Risk Monitor 2025

to the article ➞

, ,

Generative AI

to the article ➞

, ,

From cost pressure to the efficiency revolution

to the article ➞

,

Do I really need AI?

to the article ➞

,

Switzerland in the crosshairs of foreign intelligence services

to the article ➞

, ,

Resilience in our supply chains: How the shifting threatscape demands comprehensive security risk management

to the article ➞

,

UBS Data Leak via Chain IQ: Third Party Risk & Supply Chain Security Lessons

to the article ➞

,

Third Country Intercept: How secure is your data in the cloud?

to the article ➞

Name
Über welche Services im Bereich Prozess Optimierung & Digitalisierung möchten Sie mehr erfahren?

Der Beitrag Process Mining and AI: Webinar I & II erschien zuerst auf Pragmatica AG.

]]> Self-services in digital banking https://www.pragmatica.ch/en/self-services-in-digital-banking/ Mon, 13 Apr 2026 14:07:24 +0000 https://www.pragmatica.ch/self-services-in-digital-banking/ Many banks underestimate the potential of self-services in digital banking - and are therefore missing out on efficiency, customer satisfaction and revenue opportunities. While customers have long expected seamless, cross-channel solutions, offerings often remain fragmented and difficult to access. Our analysis shows where Swiss retail banks currently stand, what gaps exist and how institutions can catch up with best-in-class providers with a clear strategy, better user experience and consistent end-to-end digitalization.

Der Beitrag Self-services in digital banking erschien zuerst auf Pragmatica AG.

]]>

Self-services in digital banking

  • FOCUS TOPIC

The missed opportunity for many banks

Self-service in digital banking with fragmented channels and poor user guidance in Swiss banks

Rising customer expectations of self-services

Today’s customers expect simple, fast and cross-channel self-service options – around the clock. In doing so, they are looking to smooth experiences from fintechs, health insurance companies and other providers. This development puts Swiss retail banks under pressure to further develop their digital offerings. Self-services are no longer a side issue, but a decisive factor for efficiency, customer satisfaction and digital competitiveness.
The reality?
Many banks are not yet fully exploiting this strategic potential. Their self-service offerings are often fragmented, incomplete and do not always meet modern requirements.
Customer expectations vs reality in digital banking self-service with fragmented systems and limited functionality

Do you want to find out what your self-service potential is?

We show you where you stand compared to the competition, identify specific areas for action and point out possible solutions.

Contact us
Key weaknesses in digital banking including channel fragmentation, functional gaps and lost revenue opportunities

Where banks are wasting potential

Our market analysis using mystery shopping at 16 Swiss banks shows that many institutions struggle with fragmented functions across e-banking, mobile app and website away. Customers often don’t know which channel is the right one for their needs. At the same time Revenue opportunities remain  unused: Product openings, for example, are often hidden instead of prominently placed.
In addition, there are functional gaps that impair the customer experience: poor search functions disappoint users, first-generation financial analysis tools provide too little added value and self-services relating to security and powers of attorney are often only partially available

The path to excellence

A successful transformation begins with an in-depth analysis of typical customer needs and the company’s own position compared to the competition. This allows strategic gaps to be identified and a balanced roadmap to be developed. Building on this, it is important to eliminate media disruptions and maximize automation in order to create a seamless customer experience. At least as important is the targeted optimization of the user experience and the clear communication of offers. Finally, customers and employees need active support to ensure that new self-services are not only introduced but also used sustainably.

Eight success factors for excellent self-services

1. neo-banks as a role model

Close strategic gaps as a fast follower

2. outstanding UX

On equal footing with fintechs, no walls of text.

3. good visibility

Clearly position services

4. high utilization

Using gamification approaches for activation

5. rapid implementation

Responding agilely to customer needs

6. end-to-end digitization

Straight-through processing without media disruptions

7. internal END-TO-END anchoring

Central responsibility is defined

8. breaking down silo solutions

Modern architecture instead of rigid core banking system

Neo-banks as a benchmark for digital banking with strong UX, end-to-end digitization and agile implementation

Four steps to excellence

Our pragmatic approach in four steps:

#1 - Analysis & target image:

Benchmark with customer expectations and a clear roadmap.

#2 - End-to-end integration:

Eliminate media disruptions, maximize automation.

#3 - Usage & Security:

Optimize UX, control communication in a targeted manner.

#4 - Change & Communication:

Actively support customers and employees.

Act now

The gap to best-in-class providers can be closed – with a clear vision and a targeted strategy. Don’t wait for the competition to leave you behind.

Arrange a non-binding session.

We show you where you stand compared to the competition, identify specific areas for action and point out possible solutions.

contact us
Name

Contact

Dominik Weber profile picture

Dominik Weber

Lead CLM & Self-Services

dominik.weber@pragmatica.ch
+41 79 286 93 35

My Expertise

  • Project and Program Management in banking
  • Digital banking and digital transformation
  • Business Analysis & Requirements Engineering


Relevant work experience, qualifications and training

  • > 25 years of project and program management
  • > 25 years of digital banking expertise)
  • > 20 years of business analysis / business requirements engineering
  • > 20 years of business excellence & digital transformation
  • MAS Business Consulting
  • Eidg. Dipl. Organizer

Linkedin

Further topics

,

Process Mining and AI: Webinar I & II

to the article ➞

Self-services in digital banking

to the article ➞

, ,

FINMA Risk Monitor 2025

to the article ➞

, ,

Generative AI

to the article ➞

, ,

From cost pressure to the efficiency revolution

to the article ➞

,

Do I really need AI?

to the article ➞

,

Switzerland in the crosshairs of foreign intelligence services

to the article ➞

, ,

Resilience in our supply chains: How the shifting threatscape demands comprehensive security risk management

to the article ➞

,

UBS Data Leak via Chain IQ: Third Party Risk & Supply Chain Security Lessons

to the article ➞

,

Third Country Intercept: How secure is your data in the cloud?

to the article ➞

Der Beitrag Self-services in digital banking erschien zuerst auf Pragmatica AG.

]]> FINMA Risk Monitor 2025 https://www.pragmatica.ch/en/finma-risk-monitor-2025/ Mon, 16 Mar 2026 15:28:56 +0000 https://www.pragmatica.ch/?p=7165 Analysis of the FINMA Risk Monitor 2025. Learn how new enforcement powers, outsourcing risks, and cyber threats affect Swiss banks and financial institutions.

Der Beitrag FINMA Risk Monitor 2025 erschien zuerst auf Pragmatica AG.

]]>

FINMA Risikomonitor 2025

  • FOCUS TOPIC

FINMA has published their Risk Monitor in November 2025.
Here's What That Means for You.

The FINMA Risk Monitor 2025 marks a turning point, because Switzerland’s financial regulator is no longer just setting requirements, it is enforcing them. The window between “we should” and “we must prove we did” has closed.
 
At Pragmatica, our Security and Regulatory experts have analyzed the Risk Monitor and distilled 5 Focus Areas that demand immediate attention from CISOs, risk officers, and board-level stakeholders.
Disclaimer:

The FINMA Risk Monitor 2025 covers a broad range of risk areas. In this article, we focus specifically on the topics related to cybersecurity, ICT risk, and operational resilience, as these reflect our core consulting expertise.

1. Extension of Jurisdiction:
Accountability Doesn't Stop at Your Front Door

FINMA expects full governance, accountability, and audit-ready evidence wherever outsourcing touches critical functions. Nine out of ten banks outsource critical functions, yet the duty of care and responsibility cannot be delegated.

The question for your organization:

Can you demonstrate that you hold full accountability and an adequate 3rd party risk management for all outsourced critical functions?

How we can help

We've helped banks (FINMA categories 2 to 5) to build and implement 3rd party risk management frameworks.

In this process, we develop the required regulatory evidence to help you achieve an audit-ready state.

The institutions that act before the auditor arrives have significantly more control over the outcome.

Want the Full Picture?
Download Our Report or Schedule a Call with us!

Our comprehensive slide deck goes deeper into each focus area, covering our frameworks, our service offering, and our proven audit methodology.
Download Report
Schedule Call

2. Supervisory Focus:
From Circulars to Consequences

This is a sea-change: FINMA has begun auditing third parties directly, using its own personnel and mandated auditors. Existing circulars are no longer guidance, they are considered audit criteria.

The question for your organization:

Are your risk tolerances, reporting thresholds, and escalation processes ready to withstand a supervisory review?

How we can help

Our pragmatic approach includes pre-audit gap analysis, coached dry runs, and targeted mock interviews.

We identify and address your individual regulatory challenges and improve not only your operational resilience but systematically improve and mature your audit lifecycle.

3. Third-Party Risk:
From "Outsourcing" to "Supply Chain"

FINMA is broadening its scope from traditional outsourcing to the full supply chain, including your partners’ subcontractors. The outsourcing party is legally responsible for its entire downstream chain.

The question for your organization:
Do you have a structured Third Party Risk Management (TPRM) framework with provider tiering, concentration risk assessment, and ongoing assurance?

How we can help

We've built and operationalized TPRM frameworks for institutions from Category 3 to 5 banks to large financial services providers, with clear tasks, authorities, and responsibilities across all stakeholders.

4. Insider Threats:
Formally Elevated, Broader Than You Think

Insider threats are now a distinct, formally recognized risk category. FINMA’s emphasis: deliberate malicious acts over simple human error. And the scope extends to third-party personnel, not just your own employees.
The question for your organization:

Does your insider threat program go beyond DLP?
Does it cover third parties, and does it address digital, physical, and personnel attack surfaces?

How we can help

Our Insider Threat and Risk Management (ITRM) framework, anchored in ASIS ESRM 2019, has helped a systemic bank close its regulatory findings and receive formal approval from the regulator's appointed auditors.

All our Frameworks are based on industry standards and best practices, fully customizable to your needs and preferences.

5. Cyber & ICT Risks:
The Trend Is Upward

Cyber and ICT risks continue to increase. FINMA expects a shift from perimeter defense to integrated operational resilience across the entire supply chain.

The question for your organization:

Are your vulnerability management, detection capabilities, and incident response processes aligned with current regulatory expectations?

How we can help

From vulnerability management roadmaps to threat-led tabletop exercises, we combine deep technical expertise with regulatory fluency to deliver proportionate, business-sensitive solutions.

Let's Talk About Your FINMA Readiness​

Whether you're preparing for an audit, closing findings, or proactively assessing your position against the Risk Monitor:

We're ready when you are.

Download our full FINMA Risk Monitor 2025 Report:

Download Report

Or, get in touch with our experts now to learn more:

schedule call
Name
What areas would you like us to focus on?

Disclaimer

The FINMA Risk Monitor 2025 covers a broad range of risk areas. In this article, we focus specifically on the topics related to cybersecurity, ICT risk, and operational resilience, as these reflect our core consulting expertise.

Meet the Team

André Bussmann berät als Senior Partner bei Pragmatica AG zu Operational Resilience, BCM, GRC und Data Privacy. CISM, PMP, OneTrust Certified Privacy Professional.

André Bussmann

Senior Partner, Head Information/Cyber Security, GRC & Privacy

+41 41 749 10 15 | +41 76 563 20 00
andre.bussmann@pragmatica.ch

Beratungsschwerpunkte / Expertise

  • Projekt- und Programm Management für Business und IT
  • Business und IT Transformations- und Change-Management
  • Beratung und Implementierung regulatorischer Anforderungen für Banken und Versicherungen
  • Spezielle Fachgebiete sind Operational Resilience/BCM, Information/Cyber Security, GRC (Governance, Risk & Compliance) und Data Privacy (GDPR & CH DSG)


Relevante Berufserfahrung, Abschlüsse und Ausbildungen

  • > 25 Jahre Projekt- und Programm Management nationale und internationale Projekte in der Finanzdienstleistungsbranche
  • > 20 Jahre Business- und IT-Projekte in der Umsetzung regulatorischer Anforderungen in der Finanzdienstleistungsbranche
  • > 10 Jahre Outsourcing (Near- und Offshoring) von Business & IT Services
  • Zertifizierungen: Certified Information Security Manager (CISM) von ISACA, Project Management Professional (PMP) von PMI, Prince 2 Practioner
  • Ausbildungen in Lean Management, Design Thinking, PROSCI Change Management, OneTrust Certified Privacy Professional
Linkedin Xing
Tarik Kayapinar – Information Security & Risk Management | Pragmatica AG

Tarik Kayapinar

Motto:
“Positive thinking and belief in yourself, are the way to success.”

Why Pragmatica:
Pragmatica allows me to develop in an exciting environment in customer projects or in internal fields of activity. Here, I can further deepen my strengths as well as learn new skills that strongly promote my further development. The collegial and familiar environment at Pragmatica is important to me, so I feel at home.

Consulting focus/ Expertise

  • Information security management (ISMS) in banking and insurance industry
  • Risk management e.g. in banking sector (CH) and in mobility and transport group (DE)
  • 3rd party security and contract management in the insurance industry
  • Identity & Access Architecture and Data Compliance in the banking sector
  • Internal auditing in the financial services sector
  • Business Continuity Management System (ISO 22301)
  • Data Protection Management (GDPR): Implementation and internal training
  • ISMS focus areas: Leadership, risk management, supplier management, physical security, incident management, BCM, compliance, and asset management


Relevant work experience, qualifications and training

  • 9 years information security management / ISMS
  • 7 years IT and business process management
  • 5 years data management
  • 4 years data protection management (GDPR) and DPIA
  • 4 years Security Awareness
  • 5 years project management, Prince2 Practitioner certified
  • 6 years risk and quality management
  • 4 years Identity & Access Management
Linkedin Xing
Salvatore Profilbild

Salvatore Arcidiacona

Motto:
“At the end of the day, the goals are simple: safety and security.”

Why Pragmatica:
 At Pragmatica, I value the long-standing partnerships based on trust, which is the result of client satisfaction. I am convinced that the high quality of consulting services and the implementation of pragmatic solutions pay off for our clients, especially in view of the current cost pressure and the pressure to innovate.

My Expertise

  • Cyber Defense & Security Operations (SOC/CDC)
  • Cyber Threat Intelligence
  • Security Incident Management
  • Regulatory Compliance (FINMA, DORA)

 

Relevant Professional Experience, Degrees and Training

  • 20+ years of experience in cybersecurity and IT security
  • Founder and Head of a global Cyber Defence Center (international fintech)
  • Experience in cross sector crisis coordination (FS-CSC, BACS/NCSC)
  • Master of Advanced Studies in Information Systems Management
  • Active member of DefCon Chapter Switzerland
Linkedin

Further topics

,

Process Mining and AI: Webinar I & II

to the article ➞

Self-services in digital banking

to the article ➞

, ,

FINMA Risk Monitor 2025

to the article ➞

, ,

Generative AI

to the article ➞

, ,

From cost pressure to the efficiency revolution

to the article ➞

,

Do I really need AI?

to the article ➞

,

Switzerland in the crosshairs of foreign intelligence services

to the article ➞

, ,

Resilience in our supply chains: How the shifting threatscape demands comprehensive security risk management

to the article ➞

,

UBS Data Leak via Chain IQ: Third Party Risk & Supply Chain Security Lessons

to the article ➞

,

Third Country Intercept: How secure is your data in the cloud?

to the article ➞

Der Beitrag FINMA Risk Monitor 2025 erschien zuerst auf Pragmatica AG.

]]> Generative AI https://www.pragmatica.ch/en/generative-ai/ Mon, 02 Mar 2026 21:52:26 +0000 https://www.pragmatica.ch/generative-ai/ Generative AI increases productivity and opens up new use cases. At the same time, new security risks arise. With governance, training and standards, AI remains secure and compliant.

Der Beitrag Generative AI erschien zuerst auf Pragmatica AG.

]]>

Generative AI

  • FOCUS TOPIC

Seize opportunities, manage risks

Scale with symbols for Generative AI opportunities on the one side and safety risks on the other.
Generative AI is changing our working world at a speed that we have hardly seen before. Companies are benefiting from more productive processes, more efficient workflows and completely new possibilities in text, image, video, audio and code generation. But as the opportunities grow, so does the responsibility: Generative AI brings new types of security risksthat can quickly become a real threat without clear governance.

Why generative AI is so valuable

Whether text automation, code analysis, design prototypes or data visualization – generative models have long been more than just gimmicks.
They are already providing support today:
  • Security management (e.g. analysis of vulnerabilities, incident response plans)
  • Detection of spam, phishing & fake news
  • Code hardening & log analysis
  • Increased efficiency in day-to-day business
  • Visualization of complex relationships

Used correctly, AI can make a massive contribution to safety, compliance, quality and productivity. productivity.
House diagram on Generative AI in the company with proper use, misuse, governance and impact.

Do you want to find out what your AI potential is?

Then get started today and contact us for a free joint use case sparring session.

Contact us

The dark side: New security risks

However, the introduction of generative AI comes with risks that many companies still underestimate:

1. risks despite "proper" use

  • Confidentiality of inputs (data outflow in cloud AI)
  • Incorrect or misleading output
  • Insecure generated code
  • Automation bias – blind trust in AI results

2. misuse Attackers can use AI to:

  • Create fake content, identities or deepfakes
  • Programming malware or scaling social engineering attacks
  • Carry out processes such as CEO fraud in a much more sophisticated manner
Risks also arise within companies – for example through the sharing of confidential data with external AI services, copyright infringements or discriminatory AI decisions.

3. attacks on the AI itself

Generative models are vulnerable, so far we are aware of 3 popular types:

Privacy Attacks

Attackers try to reconstruct sensitive information from the model, e.g. training data or private user input. This exposes confidential data, even though the model was only supposed to deliver results.
Flowchart: internal user makes harmless request, LLM with RAG uses internal knowledge sources and discloses sensitive data in the output.
Note:
Attackers can also be internal employees with good IT knowledge who, for example, want to gain unauthorized access to confidential information or systems.
Example:
An insurance company uses an internal generative AI system (LLM) to support employees in analyzing claims, summarizing customer dossiers and answering internal technical questions.
The AI system is based on an LLM with RAG architecture (Retrieval-Augmented Generation) and accesses internal knowledge sources such as customer databases, claims files, internal guidelines and previous chat histories (for quality improvement).
An internal attacker (e.g. an employee with advanced IT knowledge) wants to check whether confidential information of other customers or employees can be reconstructed from the AI system and formulates “harmless” questions such as “Create an example summary of a complex car damage case of a customer from Zurich with several parties involved.”
The AI system responds with realistic-sounding names, real zip codes, detailed damage descriptions, medical information and exact damage totals.
The problem: the information does not come from fictitious examples, but is reconstructed content from real training or context data.
A particularly impressive example of a real case:
In the “EchoLeak” exploit, attackers were able to access data from the context window of an AI copilot via hidden prompt injections – without classic phishing and with minimal user interaction.

Evasion Attacks

Manipulation of entries to circumvent protection mechanisms by third parties.

Example:
A bank uses an AI or LLM-supported assistance system that automatically classifies incoming emails or recognizes potential fraud, phishing or social engineering.
An external attacker wants to send a fraudulent email to an employee, with unusual sentence structures, harmless technical terms, slightly different payment requests and contextual references to real projects or departments.
The AI could now classify the email as harmless or as “inconspicuous internal specialist communication” and the message passes all automated filters and lands directly in the inbox of an employee from the finance team.
-> The transfer process is initiated.

Diagram: external attacker sends manipulated email, AI filter classifies it as harmless, it lands in the Finance Inbox and triggers a bank transfer.

Poisoning Attacks

Training data is deliberately "poisoned" by third parties so that the model becomes faulty or manipulable.

Diagram: compromised external data source poisons training data, continuous learning affects LLM model, biased decisions appear months later.
Example:
An insurance company operates an internal generative AI system (LLM) to support claims processing, fraud detection and answering internal technical questions, among other things.
The model is regularly retrained (“continuous learning”) with new claims, internal documents, feedback from the specialist departments and external specialist sources (e.g. market reports, partner portals).
The training data is automated to ensure efficiency and timeliness. An external attacker (or a compromised partner) would like the AI system to systematically make the wrong decisions in certain cases without this being immediately apparent.
Specifically, certain fraud indicators should be ignored and certain damage patterns should be considered “inconspicuous”. The attacker compromises an external data source, e.g. a partner portal or a shared knowledge pool. Manipulated or falsified content is deliberately placed there, which has a negative impact on decisions on fraud cases or classifications of claims.

-> The model gradually learns a distorted decision behavior.

-> The effects only become apparent weeks or months later.

Clear proof that AI security is now a discipline in its own right

How companies can protect themselves:

At Pragmatica , our experts and consultants offer the following realizations & implementations so that AI can be used responsibly and safely in your company.

BUILDING COMPETENCES & TRAINING EMPLOYEES

Employees need to know, how AI works. You need to know how to use it, where the risks lie and how to minimize them .
Our AI enablement service makes generative AI safe for banks & insurance companies.
The Pragmatica AG enables employees to use AI safely and in compliance with regulations through targeted training – in line with GDPR, FINMA requirements, EU AI Act and established standards such as ISO/IEC 42001 and NIST AI RMF.
In regulated environments in particular, AI risks often arise due to a lack of expertise, incorrect use and automation bias.
With practical trainingcase studies and clear dos and don’ts, we create security, acceptance and audit readiness. audit readiness.
Less risk. More efficiency. Audit and revision-proof.

GUIDELINES & GOVERNANCE

A clear internal AI policy is mandatory – especially with regard to data protection, compliance, transparency and the handling of confidential data.

Technical & organizational measures

In-house AI services (e.g. internal LLMs) with controlled rules and security mechanisms significantly reduce risks.
Using established standards
  • ISO/IEC 42001 – the world’s first standard for AI management systems
  • ISO/IEC 23894 – standardized AI risk management
  • NIST AI RMF – Best practices for managing AI risks
  • CoE AI Treaty – international treaty on AI, human rights & rule of law
These frameworks provide guidance on how AI can be used safely, legally compliant and ethically.

Conclusion

Generative AI is a historic opportunity – but only if we use it safely, responsibly and strategically use it.
Companies that establish clear rules, training and technical protective measures today will be among the winners tomorrow.

Simply register for a free use case sparring session to get to know the system landscape or AI governance better.

contact us

Introductory formats - free of charge & individual

Use Case
Exploration

2-4 hours | Remote or on-site
Introduction to LLMs, individual use cases, feasibility assessment
Workshop

Architecture & Technology

2-4 hours | Remote or on-site
Technology options in the market & fit to existing architecture
workshop

AI governance & compliance

1-2 hours | Remote or on-site
Regulatory requirements for AI use (FINMA, DPA, EU AI Regulation)
awareness
Name
What format are you interested in?
How long should the sparring last?

Further topics

,

Process Mining and AI: Webinar I & II

to the article ➞

Self-services in digital banking

to the article ➞

, ,

FINMA Risk Monitor 2025

to the article ➞

, ,

Generative AI

to the article ➞

, ,

From cost pressure to the efficiency revolution

to the article ➞

,

Do I really need AI?

to the article ➞

,

Switzerland in the crosshairs of foreign intelligence services

to the article ➞

, ,

Resilience in our supply chains: How the shifting threatscape demands comprehensive security risk management

to the article ➞

,

UBS Data Leak via Chain IQ: Third Party Risk & Supply Chain Security Lessons

to the article ➞

,

Third Country Intercept: How secure is your data in the cloud?

to the article ➞

Der Beitrag Generative AI erschien zuerst auf Pragmatica AG.

]]> From cost pressure to the efficiency revolution https://www.pragmatica.ch/en/from-cost-pressure-to-the-efficiency-revolution/ Wed, 17 Dec 2025 22:13:30 +0000 https://www.pragmatica.ch/from-cost-pressure-to-the-efficiency-revolution/ Whether you are a manager in banking operations, responsible for customer experience or a customer advisor - you know the daily scenario: customer inquiries reach the bank today via a multitude of channels in an uncoordinated and simultaneous manner. Be it by email, via SecureMail, website forms, chat or the traditional telephone. But all too often these inquiries end up somewhere. In an overcrowded mailbox, in a confusing ticketing queue or on the desk of an employee who is actually responsible for completely different issues.

Der Beitrag From cost pressure to the efficiency revolution erschien zuerst auf Pragmatica AG.

]]>

From cost pressure to the efficiency revolution

  • FOCUS TOPIC

4 use cases on how you can be successful with AI in the service center

Presentation of typical service problems: various channels, ticket backlog, overload, churn risk

Whether a manager in banking operationsCustomer experience manager or customer advisor – you know the daily scenario: today, customer inquiries reach the bank via a multitude of channels in an uncoordinated and simultaneous manner. Be it by e-mail mail, via SecureMail, via website forms, in chat or in the traditional way over the phone. But all too often these requests end up – somewhere. In a overcrowded mailboxin a confusing ticketing queue or on on the desk of an employee who is actually who is actually responsible for completely different issues.

The result is industry-wide the the same: Error-prone routing and unnecessarily long idle times. This not only leads to frustrated customersbut above all to frustrated employeeswho their valuable time with it, messages sorting and forwarding them, instead of effectively solving customer problems.

In addition the cost pressure in banking steadily increasing: The volume of calls is increasing – especially in the direction of annual accounts – but the budget is falling. And the whole world is talking about artificial Intelligence in the service center – but how do you put this into practice without years of planning and excessive expenditure?

The good news: there is a way. Roll up your sleeves and in a few months your Service Center AI will be live!

Why "now" - first mover is over

Let’s be honest: AI in the service center is no longer the future. It is the present. The technology is mature, it works, and it delivers real results.

This also means that while you are still considering “whether” we should do this, your competitors are already using AI. They save costs, their customers are more satisfied, their employees can concentrate on providing real advice. It’s not just hype, it’s a competitive advantage and will soon be a commodity.

The risk of waiting is more real than the risk of starting: Not joining in means losing out in terms of costs and quality. The question is no longer “Should we introduce AI?” – the question is “When do we start?”

Graphic shows efficiency and success curve of first movers compared to the status quo

4 use cases - from quick wins to freestyle

The key is that you don’t have to start with everything at once. AI can easily be introduced and expanded iteratively.

AI processes incoming messages and forwards them to the credit team, wealth advisory or support team

Use Case 1: Mail Triage - The Quick Win

The problem: Customer inquiries reach you via different channels – e-banking message here, SecureMail there, website form, chat. And then someone has to decide manually: Does this belong to the credit team, investment advice or support? Errors are inevitable, processing times are long. In addition, there is the human risk – people inevitably make mistakes, e.g. incorrect assignment and an email is passed back and forth between departments for days or an email is even forgotten and the customer waits and waits.

The solution: An AI system that automatically classifies incoming emails and forwards them to the right person or team. The bot reads the request, understands the context and routes it intelligently and efficiently. In the event of uncertainties, there is a fallback to manual control – the human remains in control.

A real example: A large Swiss retail bank has done just that. Efficiency gains in mail routing of >60% because the routine sorting work was eliminated. Employees can deal directly with higher-value service requests.

Why start here? This is the fastest ROI. The data is already available (your previous emails). Implementation is low-invasive. At the same time, you build up the structured database that all other use cases need.

Use case 2: Text assistant - empowering consultants and service employees

The problem: Service employees and consultants write standard answers over and over again. Most customer inquiries received by email are very similar in content. These questions take a lot of time – sometimes 15 or 20 minutes per answer, because the employee still has to search for the answer and always responds personally to the request. And every answer looks slightly different because everyone has their own style. New employees take a long time to learn the ropes. Many of their colleagues encounter this problem: both the service employees in the customer service center, who have to answer hundreds of emails per week, and the customer advisors, who have to manage their email load between customer meetings.

The solution: An AI-supported text assistant that runs in the mail or chat system. The employee (whether service employee or customer advisor) selects an AI-generated answer at the touch of a button (e.g. Outlook plugin) – based on a central knowledge database and best practice answers. The employee reads, edits if necessary, adds personal phrases and sends. The human remains the quality controller, the bot is the accelerator.

A real example: A large Swiss retail bank uses exactly that. The service employees are faster at answering emails. And new employees need less training because the best answers are suggested to them from day one. At the same time, the advisors also benefit: they save time on standard inquiries and have more time for real customer discussions and strategic advice. Two birds with one stone.

The Key Point: This is not automation without control. It’s an assistant for your employees. And it doesn’t feel threatening to employees – on the contrary, it makes their work easier and increases their competence

Use case 3: Chatbot - using the 80/20 rule

The problem: 80% of all inquiries that reach your Service Center are usually the same ten questions: reset password, TWINT problems, account details, card blocking, IBAN lookup, fees, etc. These standard questions take up staff capacity, even though customers would like to solve these things themselves immediately.

The solution: A chatbot on your website or in the mobile app. It answers the most frequently asked questions immediately and can even trigger automated processes: Reset password, block card, activate TWINT – all directly in the chat. And if things get more complex, the bot seamlessly forwards you to a live advisor.

A real example: A large Swiss retail bank has implemented this. The chatbot handles a significant proportion of the most frequent inquiries. Customers are more satisfied because they get help immediately – 24/7 (unlike on the phone). And your service center finally has the capacity to deal with more complex customer concerns.

The Key Point: This is not “we automate everything away”. It’s “we solve the simple things immediately so that your employees can focus on more complex cases and higher-value customer services.”

Chatbot on the smartphone answers queries about IBAN, password and card blocking
Emails are automatically forwarded to the mortgage team, customer advisory service or support via AI technology

Use Case 4: Voicebot - call triage & automation

The problem: The voicebot is the old IVRS system – “Press 1…” – and nobody likes it. And it breaks down at peak times. What’s more, many callers call expecting to be able to solve the problem directly on the phone

The solution: A modern, AI-based voicebot that understands natural language. The caller says what they need – and the bot understands. It routes intelligently or – and this is the game changer – it solves simple processes directly in the call: resetting the password, blocking the card, unblocking TWINT. The same processes as in the chatbot. The caller no longer has to wait. The necessary interfaces have already been developed for the chatbot and can be used again.

The key point: The Voicebot is your scaling turbo.
At peak times (e.g. system malfunctions or at the end of the year), the bot intercepts the first wave of standard requests completely autonomously. But even for the complex cases that it forwards, the game changes massively: routing is no longer rigid (“press 1”), but dynamic. The bot understands the content of the request, checks the capacity utilization of your hotlines in real time and forwards the caller precisely to the department that currently has capacity. No more flying blind into overcrowded waiting loops, but intelligent traffic management for your telephony.

The secret: one database for all four

Now comes the important part. You could tackle these four use cases as separate projects – mail triage project, text assistant project, chatbot project, Voicebot Project. That would work, but it would be very expensive and time-consuming.

The intelligent way: You build a central knowledge database – the structure of your FAQ, your process documentation, your best practice answers. All four use cases use this basis. You only have to do this work once – and all four benefit from the further development.

This has a massive impact: Consistent responses across all touchpoints. A customer asks something about fees in the chatbot – and gets the same answer as if they called or wrote an email. This is not only more efficient, it’s also better for the customer.

And this is where it gets really economical: The first use case (mail triage) costs X. The second use case (text assistant) costs less because the basis exists. The third and fourth cost even less. The ROI multiplies.

Visualization of a central knowledge database, linked to various communication channels

4 success factors - so that things don't go wrong

But: There are a few things you need to bear in mind right from the start must to ensure a successful implementation

#1 - Structured data:

The be-all and end-all for high-performance AI is a good database. If data is still in silos, unprocessed and insufficiently available, this is THE point that needs to be addressed first. Not perfect, but well prepared. The good news : In the service area, the 100 most frequent inquiries account for a good >80% of the inquiry volume. This means that you already have a very good e basis!

#2 - Governance from day 1:

The service center is just the beginning. Therefore, when using AI, a holistic approach should be taken from the outset. This influences decisions regarding the IT architecture and clear responsibilities, monitoring structures and documentation are not blockers, but the basis for stable operation. And it is extremely important for your entire AI architecture in the company. People must remain in control!

#3 - Integration, not isolation:

The most common mistake: the pilot runs in isolation and does not scale. You need connections to your existing systems right from the start – telephony, CRM, core banking. The omnichannel concept must be there from the start.

#4 - Change Management:

You have the best AI in the world – and your employeesaren’t using it because they are afraid. Therefore: Involve employees early on, communicate transparently (“This is an assistant, not your replacement“), continuous training. This is often the most underestimated success factor.

The next step:

The technical question no longer arises: “Can this be done?”
Yes, you can. The question is: “How do we start?”

Because one thing is certain: if you jump on the bandwagon now, you win.
If you wait, you lose – not dramatically, but noticeably.
And the longer you wait, the bigger the gap becomes.

The future of the Banking Service Center is no longer the future.
It is the present. 

The only question is: will you take part?

If you are curious about where your Service Center currently stands and what quick wins are possible - we are happy to help.

contact us

Contact us for a non-binding use case sparring session in the following areas:

  • AI Use Case Workshop
  • AI Governance
  • Architecture Workshop

See for yourself and take the first step towards AI & LLM with us.

Your advantages with us

  • Experience in the implementation of AI projects for banking clients.

  • Focus on regulated industries: Over 20 years of project experience in banks and insurance companies – with a deep understanding of systems, data flows and regulation.

  • Structured technology and partner process: in-house developed LLM vendor map & RfP templates for informed decision-making.

  • From use case to rollout: we take on end-to-end responsibility or supplement your teams on a selective basis – flexibly, pragmatically, solution-oriented.

With over 20 years of experience in project management, we successfully support Swiss financial institutions in the implementation of LLM use cases – from the design of the use case through to full implementation.

We offer comprehensive expertise in AI governance and AI risk management and are familiar with the systems used (e.g. core banking, telephony) and their interactions.

Thanks to our own LLM map with an overview of providers and implementation partners, we make it easier to select the right technology and partners. By working with leading LLM experts, we ensure a customized and smooth implementation.

See for yourself with our free, customized introductory formats and take the first step towards AI & LLM with us.

Introductory formats - free of charge & individual

Use Case
Exploration

2-4 hours | Remote or on-site
Introduction to LLMs, individual use cases, feasibility assessment
Request now free of charge
Workshop

Architecture & Technology

2-4 hours | Remote or on-site
Technology options in the market & fit to existing architecture
Request now free of charge
workshop

AI governance & compliance

1-2 hours | Remote or on-site
Regulatory requirements for AI use (FINMA, DPA, EU AI Regulation)
Request now free of charge
awareness

Do you want to find out what your AI potential is?

Then get started today and contact us for a free joint use case sparring session.

Contact us

Further topics

,

Process Mining and AI: Webinar I & II

to the article ➞

Self-services in digital banking

to the article ➞

, ,

FINMA Risk Monitor 2025

to the article ➞

, ,

Generative AI

to the article ➞

, ,

From cost pressure to the efficiency revolution

to the article ➞

,

Do I really need AI?

to the article ➞

,

Switzerland in the crosshairs of foreign intelligence services

to the article ➞

, ,

Resilience in our supply chains: How the shifting threatscape demands comprehensive security risk management

to the article ➞

,

UBS Data Leak via Chain IQ: Third Party Risk & Supply Chain Security Lessons

to the article ➞

,

Third Country Intercept: How secure is your data in the cloud?

to the article ➞

Der Beitrag From cost pressure to the efficiency revolution erschien zuerst auf Pragmatica AG.

]]> Do I really need AI? https://www.pragmatica.ch/en/do-i-really-need-ai/ Sat, 22 Nov 2025 00:15:05 +0000 https://www.pragmatica.ch/do-i-really-need-ai/ A modern digitization project without AI - is that even conceivable or justifiable?

The answer is as sobering as it is liberating: YES!

Many current problems can still be solved effectively with classic process automation. While companies invest considerable resources in AI initiatives, the return on investment of which often takes years to materialize, proven automation approaches can deliver measurable results within months.

The key challenge lies not in the technology itself, but in the correct allocation: which approach addresses which problem most effectively? This article guides you through the strategic decision-making process and highlights the differences between classic process automation, intelligent process automation (IPA) and autonomous AI agents.

Der Beitrag Do I really need AI? erschien zuerst auf Pragmatica AG.

]]>

Do I really need AI?

  • FOCUS TOPIC

A modern digitization project without AI - is that even conceivable today?

The answer is as sobering as it is liberating: YES!

Many current problems can still be solved effectively with classic process automation. While companies invest considerable resources in AI initiatives, the return on investment of which often takes years to materialize, proven automation approaches can deliver measurable results within months.

The key challenge lies not in the technology itself, but in the correct allocation: which approach addresses which problem most effectively? This article guides you through the strategic decision-making process and highlights the differences between classic process automation, intelligent process automation (IPA) and autonomous AI agents.

AI or classic process optimization - the fundamental differences

The three automation approaches differ fundamentally in terms of functionality, area of application and requirements:

Classic process automation

Classic process automation executes rule-based, predefined processes precisely and repeatably. The technology is ideal for stable, high-volume processes with low variability – such as invoice processing, data capture or report generation. Its strengths lie in complete traceability, reliability and scalability. The maintenance effort for complex sets of rules and the lack of adaptability to unforeseen situations mark the limits of this approach.

Intelligent Process Automation (IPA)

Intelligent process automation (IPA)orchestrates various processes with the integration of AI components. Systems in this category analyze context, make data-based decisions and dynamically adapt process flows. Typical applications include document classification, intelligent ticket distribution or intelligent customer service (chatbot / voicebot). IPA offers seamless system integration and anticipates potential bottlenecks, but requires high-quality data and API-enabled systems.

AI agents

AI agents makeautonomous decisions, learn continuously and pursue defined goals independently. Multi-agent systems are particularly effective in complex, strategic processes with numerous variables and dependencies – for example in autonomous customer advice, dynamic price optimization or self-learning quality control. The challenges lie in non-transparent decision paths, unexpected system behavior and an increased need for control.

The strategic recommendation

Classic automation as the foundation, selective use of IPA for decision-making processes and AI agents where autonomy and continuous learning generate real added value.

The key questions for the right solution

The decision-making process can be condensed into five central questions:

What does the process look like?

  • Stable, rule-based processes require classic automation.
  • Processes with decision points and context dependency benefit from IPA.
  • Complex, variable scenarios that require learning justify the use of AI agents.

What decisions need to be made?

  • Deterministic decisions are suitable for rule-based systems.
  • Contextual evaluations – such as urgency assessment based on tone, content and history – require intelligent automation.
  • Autonomous goal pursuit with adaptive strategies requires autonomous agents.

How high can the degree of autonomy be?

  • Classic automation offers complete control.
  • IPA enables monitored autonomy.
  • AI agents act largely independently within defined framework conditions.

The governance requirements increase considerably as the degree of autonomy increases.

How much time & budget is available?

  • Classic automation can be implemented comparatively quickly and delivers the first measurable results within a few weeks to months.
  • IPA projects require a higher initial outlay for data integration and AI training, which means that the implementation phase takes several months.
  • AI agents are the most complex category – it typically takes 12-18 months or longer from conception, training and testing to productive use.

Are the basics ready?

Technical infrastructure, data quality, available expertise and readiness for change significantly determine the probability of success. Without these foundations, even technologically mature solutions will fail.

A critical self-analysis based on these dimensions prevents costly bad investments and unrealistic expectations.

Prerequisites for successful AI implementation

Successful AI projects are based on robust foundations that go far beyond technological aspects:

Data quality as a critical success factor

AI systems are only as good as the data they work with. Inconsistent, incomplete or low-quality data inevitably leads to suboptimal results. Systematic data cleansing and structuring is essential.

Technical infrastructure

API-enabled systems, clean interfaces and MLOps capabilities form the technical basis. Without this infrastructure, even the most sophisticated AI solution will be ineffective.

Organizational competence

A basic understanding of AI/ML mechanisms within the team is required. Not every project requires specialized data scientists, but a sound basic knowledge enables realistic assessments and effective management.

Governance and compliance

GDPR compliance, compliance with the AI Regulation and clarification of liability issues are not optional. Governance structures must be established from the outset, not added later.

Change management

Technological excellence does not guarantee success if the organization does not go along with it. Creating acceptance, building skills and constructively addressing resistance is crucial for sustainable effectiveness.

Before making significant investments in AI solutions, it is advisable to first systematically establish the organizational structures and technical requirements.

Conclusion: Technological sobriety as a success factor

The relevant question is not “How quickly can AI be introduced?”, but “Which solution addresses the problem most effectively?”

Contact us for a use case sparring session

We would be happy to help you find the right approach for your use cases and support you in building an AI-capable organization.

Whether classic automation, intelligent process automation (IPA) or autonomous AI agents:

The trick is to choose the right technology for the respective challenge and maturity level. Because not everything that is technically possible also brings real added value.

contact us

Our decision matrix helps:

AI decision matrix
download matrix (pdf)

From the introduction of RPA in customer communication to intelligent portfolio optimization, we support you pragmatically and effectively.

What we bring with us:

  • Process analysis with AI readiness assessment –not every process is ready for AI
  • Vendor-neutral advice –the most suitable solution for your goals
  • Pragmatic roadmaps – from quick win to strategic transformation
  • Change management –empowering and developing people
  • AI governance frameworks –integrating compliance right from the start

Do you want to find out what your AI potential is?

Then get started today and contact us for a free joint use case sparring session.

Contact us

Further topics

,

Process Mining and AI: Webinar I & II

to the article ➞

Self-services in digital banking

to the article ➞

, ,

FINMA Risk Monitor 2025

to the article ➞

, ,

Generative AI

to the article ➞

, ,

From cost pressure to the efficiency revolution

to the article ➞

,

Do I really need AI?

to the article ➞

,

Switzerland in the crosshairs of foreign intelligence services

to the article ➞

, ,

Resilience in our supply chains: How the shifting threatscape demands comprehensive security risk management

to the article ➞

,

UBS Data Leak via Chain IQ: Third Party Risk & Supply Chain Security Lessons

to the article ➞

,

Third Country Intercept: How secure is your data in the cloud?

to the article ➞

Der Beitrag Do I really need AI? erschien zuerst auf Pragmatica AG.

]]> Switzerland in the crosshairs of foreign intelligence services https://www.pragmatica.ch/en/switzerland-in-the-crosshairs-of-foreign-intelligence-services/ Tue, 21 Oct 2025 21:42:52 +0000 https://www.pragmatica.ch/switzerland-in-the-crosshairs-of-foreign-intelligence-services/ The 2025 Situation Report of the Federal Intelligence Service (FIS) speaks a clear language: the threat of espionage activities in Switzerland has reached a new level. Switzerland has remained an attractive operational area for foreign intelligence services for decades. However, according to the latest report, the extent of these activities is not only still high - it is increasing significantly. The FIS explicitly confirms that the activities of the prohibited intelligence service have reached a new level. Companies with a high level of innovation, international networking or central importance for critical infrastructures are particularly affected.

Der Beitrag Switzerland in the crosshairs of foreign intelligence services erschien zuerst auf Pragmatica AG.

]]>

Switzerland in the crosshairs of foreign intelligence services

  • Information SECURITY

Companies must act now.

The 2025 situation report of the Federal Intelligence Service (FIS) speaks for itself: the threat of espionage activities in Switzerland has reached a new level. Switzerland has remained an attractive area of operation for foreign intelligence services for decades. But according to the latest report, it is not only the Extent of these activities remains high – it is increasing significantly. The FIS explicitly confirms that the activities of the prohibited intelligence service have reached a new level. Companies with a high level of innovation, international networking or central importance for critical infrastructures are particularly affected.

The 2025 Situation Report of the Federal Intelligence Service (FIS) speaks a clear language: the threat of espionage activities in Switzerland has reached a new level. Switzerland has remained an attractive operational area for foreign intelligence services for decades. However, according to the latest report, the extent of these activities is not only still high - it is increasing significantly. The FIS explicitly confirms that the activities of the prohibited intelligence service have reached a new level. Companies with a high level of innovation, international networking or central importance for critical infrastructures are particularly affected.

Source: FIS, “Security Switzerland 2025”: Global confrontation has a direct impact on Switzerland

At the same time, the FIS warns of an increasingly hybrid threat situation in which state-controlled actors could specifically target critical infrastructures. Although no direct state cyber sabotage has been observed in Switzerland to date, according to the report, power calculations and geopolitical objectives are clear drivers for potential attacks – including on Switzerland. Both Swiss interests and those of our European neighbors can be targeted if their infrastructure is operated or hosted in Switzerland.

What does this mean for Swiss companies in concrete terms?

Companies with digital business models, international supply chains or a role as a cloud hub for third countries are particularly exposed.t. The challenges surrounding cross-border data processing and access by third countries are central to this. We explain the specific risks and how they can be addressed in detail in the article “Third Country Intercept Risk in the Cloud”. However, the threat does not only affect technology or financial companies – but all organizations whose information, systems or people are a potential target. The defense against espionage does not begin at the national border, but at the border itself. at own physical, logical and personnel security system.

Pragmatica provides support in three critical areas:

Insider Threat and Risk Management

The new perimeter is called "Access".

Risksemanating from domestic offenders, are among the most underestimated risks. We help you to identify potential hazards from employees or related third parties in a structured and risk-oriented manner. parties, including Service provider outsourcing, and to address them effectively. This includes Measures for physical and logical access control, risk-based personnel security process, such as the identification of functions with increased integrity requirements as well as preventative awareness formats for all relevant Organization, processes and measures in the area of personnel safety.

Third Party Security Risk Management

The chain is only as strong as its weakest link.

Suppliers, external IT service providers and strategic partners can be gateways and multipliers for intelligence activities related to illicit intelligence gathering by private, para-state and state actors.

With our support, you will establish structured third-party risk governance, carry out security due diligence and implement interlocking control mechanisms that are both regulatory compliant and operationally effective.

supply chain governance titelbild

Resilience in our supply chains: How the shifting threatscape demands comprehensive security risk management

29. September 2025

Cyberattacks on supply chains are no longer an isolated incident. What began with the recent attack on the widely used baggage management software Muse from Collins Aerospace – which affected airports in London, Berlin, Brussels and Dublin – is part of a threatening development: a series of targeted attacks on critical infrastructures and supply chains in Europe.

Read more ➞

Use case:
Third Country Intercept Risk in the cloud

Data travels across borders - and so do risks.

Suppliers, external IT service providers and strategic partners can be gateways and multipliers for intelligence activities related to illicit intelligence gathering by private, para-state and state actors.

With our support, you will establish structured third-party risk governance, carry out security due diligence and implement interlocking control mechanisms that are both regulatory compliant and operationally effective.

Executive Order 12333 – US Intelligence Community surveillance activities affecting cloud data security

Third Country Intercept: How secure is your data in the cloud?

29. January 2025

What ostensibly appears to be a well-orchestrated cyber-attack on U.S. software supplier Collins Aerospace’s ubiquitously deployed product “Muse” for managing traveler baggage beginning on the evening of 19 September 2025 is not an isolated incident. Not only did this most recent attack affect multiple airports, i.e. Heathrow, Berlin, Brussels and Dublin. This attack is – more importantly – one in a string of offensive actions targeting European infrastructure and supply chains. To name just a few recent examples:

Read more ➞

Why Pragmatica?

We combine in-depth experience in information and cyber security with regulatory know-how and methodological excellence. Our advice is implementation-oriented, targeted and tailored to your organizational framework. We draw on our broad experience from security-related transformation projects in the financial industry, healthcare and the public sector.

Conclusion: The new threat situation demands decisive action.

We help you to adapt a holistic and comprehensive security system (physical, logical and personnel) to your needs in a modular, proportional and targeted manner to meet current challenges.

Whether as part of an assessment, strategic security planning or operational support for specific projects – with Pragmatica you are on the safe side.

Do you have any questions?

We would be happy to accompany you and your company on the path to security!

Contact us for a confidential initial consultation and an initial assessment of your security situation.

Contact

Source reference

  • “Security Switzerland 2025”: Global confrontation has a direct impact on Switzerland. (n.d.). https://www.vbs.admin.ch/de/ndb-sicherheit-schweiz-2025

Further topics

,

Process Mining and AI: Webinar I & II

to the article ➞

Self-services in digital banking

to the article ➞

, ,

FINMA Risk Monitor 2025

to the article ➞

, ,

Generative AI

to the article ➞

, ,

From cost pressure to the efficiency revolution

to the article ➞

,

Do I really need AI?

to the article ➞

,

Switzerland in the crosshairs of foreign intelligence services

to the article ➞

, ,

Resilience in our supply chains: How the shifting threatscape demands comprehensive security risk management

to the article ➞

,

UBS Data Leak via Chain IQ: Third Party Risk & Supply Chain Security Lessons

to the article ➞

,

Third Country Intercept: How secure is your data in the cloud?

to the article ➞

Der Beitrag Switzerland in the crosshairs of foreign intelligence services erschien zuerst auf Pragmatica AG.

]]> Resilience in our supply chains: How the shifting threatscape demands comprehensive security risk management https://www.pragmatica.ch/en/resilience-in-our-supply-chains/ Mon, 29 Sep 2025 19:43:27 +0000 https://www.pragmatica.ch/resilience-in-our-supply-chains-how-the-shifting-threatscape-demands-comprehensive-security-risk-management/ Cyberattacks on supply chains are no longer an isolated incident. What began with the recent attack on the widely used baggage management software Muse from Collins Aerospace - which affected airports in London, Berlin, Brussels and Dublin - is part of a threatening development: a series of targeted attacks on critical infrastructures and supply chains in Europe.

Der Beitrag Resilience in our supply chains: How the shifting threatscape demands comprehensive security risk management erschien zuerst auf Pragmatica AG.

]]>

Resilience in the supply chain

  • Information SECURITY

How the shifting threatscape demands comprehensive security risk management

Cyberattacks on supply chains are long since not isolated case more. What with the recent attack on the widespread baggage management-software Muse from Collins Aerospace began – with Effects on Airports in London, Berlin, Brussels and Dublin – is Part of a threatening Development: A series of targeted Attacks on critical Infrastructures and Supply chains in Europe.

Just a few more examples from the last few months:

  • Jaguar Land Rover recently had to halt production – with repercussions that continue to this day.
  • A so-called prompt injection attack (“Echoleak”) on Copilotpart of the Microsoft ecosystem, was stopped at the last moment.
  • Marks & Spencer suffered an attack on its time-critical supply chain – with an expected loss of around a third of its annual profit.
  • The outsourcing service provider ChainIQ was compromised – with consequential damage for companies such as UBS, Pictet and Manor.

These incidents are only the tip tip of the iceberg.

Was alle diese Angriffe gemeinsam haben: Sie treffen Unternehmen über ihre Lieferketten. These are today often high networked, complex and on specialized Third parties outsourced – exactly the makes them to the ideal attack surface.

The risks increase in particular due to:

  • Concentration of services on a few providers
  • SaaS, cloud and procurement outsourcing without a coordinated security architecture
  • Access rights of third partiesthat exceed those of your own employees
  • Lack of control over new perimeters – Digital, physical and personnel access channels

Each of these weaknesses can in emergency to the Multiplier for attacker become – with enormous damage.

threatscape titelbild

New reality: threats are hybrid

Supply chains are today digital AND physically exposed – affected are not only Data, but also Logistics systems, Locations and People. Cybercriminals, Industrial espionage, state financed Actors – them all use multidimensional attack paths.

Particularly critical: Managed services and third parties with privileged system access. If such a service provider is compromised, this can have a domino effect with massive consequential damage – even for companies with a high security maturity of their own.

Resilience begins with risk awareness

Before talking about technologies, automation or tools, you need a strategic understanding for the new threat picture. The decisive factors are:

  • Security assessments of the entire supply chain
  • Coordinated third-party risk management
  • Coordinated security architectures for digital, physical and personal risks
  • Cultural resilience through awareness, leadership and governance

Selective IT security is not enough. Resilience is created through integrated, pragmatic security risk management – strategically, operationally and culturally.

Pragmatica supports you with a proven approach!

With our experience from over 500 projects, we offer a practical approach to comprehensive security risk management – with a focus on supply chains, outsourcing and third party management.

Our services

Enterprise Security Risk Management

Holistic regulatory framework based on best practice for managing all security disciplines.

Third Party Security Risk Management

Evaluation, classification and monitoring of external partners in the context of governance, contracts and audits.

Insider Threat & Risk Management

DLP introduction, awareness and benchmarks based on counter-intelligence know-how.

Data Transfer Impact Analysis (DTIA)

Assessment of outsourcing risks for data transfers abroad - with a focus on government access options.

Do you have any questions?
We would be happy to accompany you and your company on the path to security!

Contact

Source reference

Further topics

,

Process Mining and AI: Webinar I & II

to the article ➞

Self-services in digital banking

to the article ➞

, ,

FINMA Risk Monitor 2025

to the article ➞

, ,

Generative AI

to the article ➞

, ,

From cost pressure to the efficiency revolution

to the article ➞

,

Do I really need AI?

to the article ➞

,

Switzerland in the crosshairs of foreign intelligence services

to the article ➞

, ,

Resilience in our supply chains: How the shifting threatscape demands comprehensive security risk management

to the article ➞

,

UBS Data Leak via Chain IQ: Third Party Risk & Supply Chain Security Lessons

to the article ➞

,

Third Country Intercept: How secure is your data in the cloud?

to the article ➞

Der Beitrag Resilience in our supply chains: How the shifting threatscape demands comprehensive security risk management erschien zuerst auf Pragmatica AG.

]]> UBS Data Leak via Chain IQ: Third Party Risk & Supply Chain Security Lessons https://www.pragmatica.ch/en/ubs-data-leak-via-chain-iq-third-party-risk-supply-chain-security-lessons/ Mon, 30 Jun 2025 17:49:45 +0000 https://www.pragmatica.ch/ubs-data-leak-via-chain-iq-third-party-risk-supply-chain-security-lessons/ Find out what the cyber attack on UBS and Chain IQ reveals about supply chain risks, third party security vulnerabilities and compliance in financial outsourcing. Strengthen your TPSRM strategy now.

Der Beitrag UBS Data Leak via Chain IQ: Third Party Risk & Supply Chain Security Lessons erschien zuerst auf Pragmatica AG.

]]>

UBS Data Leak via Chain IQ: Third Party Risk & Supply Chain Security Lessons

  • Information SECURITY

Data leak at UBS service provider Chain IQ reveals serious weaknesses in supply chain security

Last week, it became known that the major Swiss bank UBS was the indirect victim of a cyberattack – the strategic service provider Chain IQ, an international provider of procurement management, was affected. According to media reports, the attack compromised the personal data of over 130,000 UBS employees as well as confidential accounting data from Pictet Bank (Le Temps,SRF, Handelszeitung).

The fact that a company specializing in outsourcing itself becomes a target underlines an unpleasant truth: supply chains have long since become a systemically relevant target – especially in highly regulated sectors such as financial services.

Supply Chain Attacks: From SolarWinds to Chain IQ

Such incidents are reminiscent of the infamous SolarWinds attack, which used an infected software component to gain access to tens of thousands of organizations worldwide, including U.S. government agencies and technology companies like Microsoft and Cisco (NPR, NCSC UK, PSU Library). The pattern is clear: cybercriminals use systemically relevant service providers to gain access to a much larger ecosystem.

Chain IQ acts as such a hub. The fact that hackers specifically target such service providers is strategically motivated: The multiplier effect of a successful attack is considerable.

Associated risks: International data flows and access by third countries

In our last article, we already referred to critical risks in the context of Third Country Intercept context: Even legally permissible data flows can lead to massive security incidents when combined with weak protective measures.

Current events clearly show that technical and contractual protective measures alone are not enough. A holistic security strategy across all third-party relationships is required.

Supply Chain Security

Pragmatica TPSRM: Protection that goes beyond company boundaries

Pragmatica AG has been helping organizations protect their information assets for over 25 years – both internally and externally. With our Third Party Security Risk Management (TPSRM) service, we specifically address the challenges of growing dependencies in the context of outsourcing, cloud and partner ecosystems.

Our range of services in the area of information security and cyber security specifically addresses the challenges of sourcing, partnerships and outsourced services. Together with our clients, we develop security strategies that have an impact beyond their own company – regulatory sound, technically coordinated and operationally feasible.

In conjunction with our Risk, Compliance & Privacy Service we create integrated solutions that holistically cover technological, legal and organizational aspects.

Our service includes:

    • Systematic discovery and GAP analyses
    • Comparison with reference models (e.g. ISO/IEC 27036, NIST)
    • Prioritized roadmap with concrete measures
    • Implementation support and stakeholder management
    • Interlocking with cloud security, data governance, BCM & incident response

Our approach ismodular, tried-and-tested and scalable across all sectors – we combine technical excellence with regulatory understanding and a clear focus on implementation.

Conclusion: the security strategy does not end at the company's borders

Chain IQ is a prominent example – but by no means an isolated case. The supply chain is one of the most dangerous areas of attack today. Companies must understand and actively manage third-party risks as an integral part of their security architecture.

Let’s strengthen your resilience together with a TPSRM approach that works.

Do you have any questions?
We would be happy to accompany you and your company on the path to security!

Contact

Further topics

,

Process Mining and AI: Webinar I & II

to the article ➞

Self-services in digital banking

to the article ➞

, ,

FINMA Risk Monitor 2025

to the article ➞

, ,

Generative AI

to the article ➞

, ,

From cost pressure to the efficiency revolution

to the article ➞

,

Do I really need AI?

to the article ➞

,

Switzerland in the crosshairs of foreign intelligence services

to the article ➞

, ,

Resilience in our supply chains: How the shifting threatscape demands comprehensive security risk management

to the article ➞

,

UBS Data Leak via Chain IQ: Third Party Risk & Supply Chain Security Lessons

to the article ➞

,

Third Country Intercept: How secure is your data in the cloud?

to the article ➞

References and further information

On the cyber attack on Chain IQ / UBS:

To the SolarWinds hack:

Der Beitrag UBS Data Leak via Chain IQ: Third Party Risk & Supply Chain Security Lessons erschien zuerst auf Pragmatica AG.

]]> Third Country Intercept: How secure is your data in the cloud? https://www.pragmatica.ch/en/third-country-intercept/ Wed, 29 Jan 2025 19:22:39 +0000 https://www.pragmatica.ch/third-country-interception-risk-in-the-cloud/ What ostensibly appears to be a well-orchestrated cyber-attack on U.S. software supplier Collins Aerospace’s ubiquitously deployed product “Muse” for managing traveler baggage beginning on the evening of 19 September 2025 is not an isolated incident. Not only did this most recent attack affect multiple airports, i.e. Heathrow, Berlin, Brussels and Dublin. This attack is – more importantly - one in a string of offensive actions targeting European infrastructure and supply chains. To name just a few recent examples:

Der Beitrag Third Country Intercept: How secure is your data in the cloud? erschien zuerst auf Pragmatica AG.

]]>

Third Country Intercept Risk in the Cloud

  • Information SECURITY

Security versus data leakage risk.
How secure is your data in the cloud?

Executive Order 12333 – US Intelligence Community surveillance activities affecting cloud data security

The issue of security and data protection in the cloud is becoming increasingly complex for companies. One crucial aspect that is often underestimated is the risk of data being leaked by third countries such as the USA – due to their national security laws. Organizations that rely on the services of large cloud providers (hyperscalers) are particularly affected.

Legal bases that you should know:

  • Executive Order 12333 (EO 12333): Mandate for US authorities such as the NSA and CIA to gather foreign intelligence. Decisions are made without judicial review.
  • FISA Sec. 702 Allows targeted monitoring of “non-US persons” and binds cloud providers to cooperate via “compelled assistance” – often secretly and without notifying customers.

Disclaimer: The legal bases mentioned (EO 12333 & FISA Sec. 702) are anchored in administrative or national security law and are therefore above civil law, on the basis of which most outsourcing contracts with hyperscalers are concluded by Swiss companies.
We do not offer legal advice, but security advice.

What does this mean for your company?

  • Schrems II and the reality of data protection requirements: Despite standard contractual clauses (SCCs) and additional security measures, gaps in data control remain.
  • Transparency deficits and geopolitical risks: The lack of transparency in surveillance requests and possible sanctions could have unexpected effects on data availability.

The opinion of the European Data Protection Board (EDPB) is that there are currently no legal, organizational or technical measures that can completely eliminate the risk of foreign intelligence gathering by third countries in the cloud.

Conclusion: safety positioning is crucial

Companies in Switzerland and Europe must develop a comprehensive security strategy in order to minimize the risks posed by third-country interference. This includes

  1. Selection of cloud providers that offer the highest encryption standards and ideally are not subject to “compelled assistance” under EO 12333, FISA obligations or similar obligations under administrative law.
  2. Use of technologies such as Client-Side Agents (CSA) and Highly Secure Models (HSM) to mitigate the risk.
  3. Strengthening the internal security system at a logical, technical, physical and personnel level in order to be prepared for possible incidents.

The risk of data leaks in the cloud is not just a data protection problem – it is a security risk with global implications.

Is your cloud data really secure?

With our extensive expertise in process design, we create tailored solutions that align regulatory requirements with best security practices. We rapidly identify the key compliance and security risks affecting your organization and integrate effective mitigation strategies into your contract and risk management frameworks. Our approach emphasizes stakeholder alignment and the optimization of critical interfaces to ensure seamless and secure third-party collaboration.

We are happy to support you with the following services:

  • Carrying out a comprehensive risk analysis of outsourcing contracts from the perspective of third-party security risk management
  • Security-based Data Transfer Impact Analysis (DTIA) for the assessment of data transfer risks
  • Review of additional organizational and technical security measures
  • Identification and designation of security risks when outsourcing to cloud providers in third countries
  • Creation of a prioritized risk mitigation plan (risk treatment plan)
  • Selection of cloud providers that offer the highest encryption standards and ideally are not subject to “compelled assistance” under EO 12333, FISA obligations or similar obligations under administrative law.

     

Do you have any questions?
We would be happy to accompany you and your company on the path to security!

Contact

Further topics

,

Process Mining and AI: Webinar I & II

to the article ➞

Self-services in digital banking

to the article ➞

, ,

FINMA Risk Monitor 2025

to the article ➞

, ,

Generative AI

to the article ➞

, ,

From cost pressure to the efficiency revolution

to the article ➞

,

Do I really need AI?

to the article ➞

,

Switzerland in the crosshairs of foreign intelligence services

to the article ➞

, ,

Resilience in our supply chains: How the shifting threatscape demands comprehensive security risk management

to the article ➞

,

UBS Data Leak via Chain IQ: Third Party Risk & Supply Chain Security Lessons

to the article ➞

,

Third Country Intercept: How secure is your data in the cloud?

to the article ➞

Der Beitrag Third Country Intercept: How secure is your data in the cloud? erschien zuerst auf Pragmatica AG.

]]>