The verdict in three sentences
CISOs and CIOs in Zurich increasingly open a vendor search by asking AI assistants like ChatGPT for a short list of pentest, SOC or incident response providers that fit a Swiss context, often in German and English. The firms that come up tend to have precise, verifiable public facts: services described one by one, certifications stated exactly as held, named experts, a visible incident hotline and consistent mentions in Swiss and international sources. Work on this channel is young and priced on the market at roughly CHF 4,000 to 10,000 for a diagnostic and CHF 3,000 to 9,000 per month for ongoing work (2026 ballpark), and the only honest yardstick is a dated record of the answers over several months.
The questions security buyers in Zurich now put to AI assistants
A security buyer rarely asks for "a cybersecurity company". The question carries a regulator, a sector, a language and often some urgency. That specificity decides which firms an assistant can name.
| Question (example) | Typical asker | Fact the answer needs to find about you |
|---|---|---|
| "Which Zurich firms offer 24/7 incident response with German speaking responders?" | CIO of a mid-size industrial group | Hotline, on-call model, languages, response region |
| "Pentest providers in Switzerland with CREST accreditation" | CISO, procurement | Accreditation as actually held, scope, testers' certifications |
| "SOC as a service for a Swiss private bank under FINMA Circular 2023/1" | CISO of a bank | Sector page, operational resilience scope, data location |
| "Who can run DORA threat-led penetration testing for our EU subsidiary from Zurich?" | Group CISO, insurer | DORA page, TLPT capability, EU coverage |
| "Help after a ransomware attack, Swiss SME, what to do and who to call" | SME owner, under stress | Emergency page, first steps, hotline |
| "ISO 27001 implementation consultant Zurich, cost and timeline" | COO of a fintech | Service page with scope and indicative duration |
| "Red team exercise provider in Switzerland for a pharma company" | Head of security, life sciences | Red team page, sector experience in general terms |
Buyers in Zurich switch between German and English. A firm visible in English answers can be invisible in German ones, and the reverse. Each language deserves its own pages and its own measurement.
What makes a security firm appear, and what keeps it out
Assistants compose answers from sources they can read and cross check. Several factors keep coming up in this niche.
- Exact certifications. "ISO 27001 certified" and "ISO 27001 aligned" are different claims. State the certificate, the scope and the certifying body, and keep CREST or other accreditations accurate.
- One page per service. Penetration testing, managed detection, incident response, red teaming, compliance support for NIS2, DORA or FINMA requirements. Each page states for whom, where and how.
- Named people. Experts with their background, talks, published research or CVEs they disclosed, where that is public and accurate.
- Third-party traces. Conference programmes, Swiss industry associations, media interviews, vendor partner directories. These confirm what your own site says.
- Consistency. Company name (with AG or GmbH), address, hotline and descriptions match across the site, the commercial register, LinkedIn and directories.
- Freshness. Advisories and analysis dated in 2026, not a blog that stopped two years ago.
Two things to avoid: never invent clients or incidents, and never imply you handled a public breach unless the client has made it public. An assistant that repeats an exaggeration creates a reputational problem for a firm whose product is trust.
Privacy is part of the picture. Your forms and analytics fall under the revised Federal Act on Data Protection (revFADP, in force since 1 September 2023), overseen by the FDPIC, and the GDPR can apply when you target EU residents. This is not legal advice: confirm with your counsel.
What the work covers and what the market charges
In broad terms: an audit of how assistants describe the firm today in German and English, correction of inconsistent public facts, rewriting of service, expert and emergency pages, structured data, and a plan for credible third-party mentions. Technical validation of every claim stays with your team.
| Item | 2026 ballpark in Zurich (CHF) | Remarks |
|---|---|---|
| Diagnostic, 40 to 60 questions in DE and EN | 4,000 to 10,000 | Typical agency quotes |
| Rewrite of 8 to 12 service and expert pages | 6,000 to 15,000 | Expert review time not included |
| German or French adaptation of key pages | 3,000 to 8,000 | Specialist translator, third party |
| Structured data and technical fixes | 2,000 to 6,000 | Depends on the CMS |
| Ongoing monthly programme | 3,000 to 9,000 per month | Content, mentions, monthly answer record |
| Media and conference visibility | 2,000 to 6,000 per month | Often a PR provider |
These are prudent ranges from typical agency quotes and public rate pages, not from a survey. Kolonell works on quote, after a diagnostic.
Reading the results without wishful thinking
Ask the same questions, the same way, every month, and keep the answers. Then read them.
Need a professional website?
Kolonell builds websites that attract clients, optimized for the Sénégalese market. Free quote in 2 minutes.
| What you track | How | Realistic direction over 6 months |
|---|---|---|
| Share of answers naming the firm | Mentions out of total questions, per language | From 4 of 50 to 12 of 50 |
| Accuracy | Services, certifications, location stated correctly | All mentions accurate |
| Right context | Named on services you actually offer | No mention on out-of-scope topics |
| Competitor presence | Which firms appear alongside you | Stable or fewer ahead of you |
| Sources echoed | Distinct sources reflected in answers | Up from 2 to 6 |
Answers vary between sessions, so read three month trends. No serious provider promises that an assistant will name you.
Mini case study
Illustrative example, fictional firm. Limmat Secure AG, 25 people in Zurich, sells managed detection and incident response. Its CEO runs 50 questions in German and English: the firm appears in 4 answers, one of which lists a certification it does not hold. She budgets a CHF 6,000 diagnostic and six months at CHF 4,000: 6,000 + 6 × 4,000 = CHF 30,000. A typical managed detection contract for her firm is worth about CHF 60,000 a year, so 30,000 / 60,000 = 0.5: half of one new contract in the first year would cover the spend. Correcting the false certification claim alone justifies the diagnostic.
FAQ
Is this the same as SEO for a cybersecurity firm?
It overlaps, but the measure is whether assistants name and describe you correctly in a direct answer. Consistency across 10 to 20 external sources often weighs as much as your own pages.
How quickly do changes show up?
Usually 2 to 6 months, depending on how often sources are refreshed. That is why the record runs over at least 6 months, in each language.
Should we publish client names or incident stories?
Only with written client consent, and many Swiss clients will refuse. Anonymised, general descriptions of engagement types are safer; about 70% of the questions above look for scope and credentials, not names.
Do we need German pages if our clients are international?
For Zurich buyers, yes: German versions of 6 to 10 key pages are a reasonable start. French matters if you target Geneva and Lausanne.
What does Kolonell charge?
Kolonell works on quote, after a diagnostic of what assistants say about your firm today. Market references above put a diagnostic at CHF 4,000 to 10,000.
Find out how AI assistants describe your firm. We record what they say today about your pentest, SOC and incident response services, in German and English, and show what needs correcting. Request a diagnostic quote: reply within 48 hours.
Mohamed Bah
Fondateur, Kolonell
Passionate about digital and entrepreneurship in Africa, Mohamed has been helping Sénégalese businesses with their digital transformation since 2020. Founder of Kolonell, he believes every SME deserves a professional and accessible online présence.
