“Simple steps can effectively prevent cyber attacks”

Ordering a meal, checking your bank account, opening a WhatsApp message or simply answering the phone: everyday activities like these can now provide an entry point for a cyber attack. In Switzerland, the Federal Office for Cyber security received more than 27,000 voluntary reports in the first half of 2026. Fraud attempts are also becoming increasingly sophisticated, particularly with the rise of artificial intelligence, which enables attackers to tailor their methods more precisely to their targets.

Against this backdrop, do we all need to become cyber security experts to protect our digital lives? Not necessarily, says Mathias Payer, a professor at EPFL’s HexHive Laboratory. Computer systems have become so complex that eliminating every vulnerability is impossible, but a few basic precautions can protect us against the vast majority of attacks.

Smartphone apps can have up to 100 million lines of code. Is it really possible to make such complex systems secure?

For now there’s no way to ensure that such complicated apps are completely free of vulnerabilities. Smartphones pull together code that was developed by thousands of people over several decades, such as for the operating system, apps, libraries, drivers and network protocols. What’s more, every time a new feature is added, this grab bag of components interacts in new ways. Sometimes there’s unexpected interference between components – and that gives rise to numerous vulnerabilities. A given component could be perfectly fine in isolation but create problems when it starts interacting with other components.

Does that mean hackers start off with an advantage?

It’s true that there is a structural asymmetry. Cyber security defenders try to find and fix all possible vulnerabilities, whereas hackers need to spot just one that fits their needs. So our goal is to quickly remove the easiest-to-reach vulnerabilities, forcing hackers to devote more time, brainpower and money to breaking into a system. And we’ve made significant progress – some cyberattacks that were easy 20 years ago require a hefty amount of resources today.

Much of our digital lives is stored in our phones. What’s at risk if a phone is stolen?

It depends on who the thief is. Someone who finds your phone in a coffee shop won’t have the same capabilities as a government that’s willing to invest considerably to target you personally. Today’s phones are pretty well-protected against attacks requiring access to the physical device. For instance, if your phone is off and a criminal doesn’t have your code to unlock it, they would have a really hard time directly accessing your data, which are encrypted. However, that doesn’t mean today’s phones are impenetrable. If a component or driver has a vulnerability, then interfaces like USB ports, WiFi and Bluetooth connections, or the 5G stack are potential attack surfaces. But here too, exploiting that vulnerability would require specific skills and resources.

How are you able to find vulnerabilities and undermine hackers’ attempts?

One pro-active method we use is called fuzzing. That involves automatically running programs repeatedly with random input to provoke abnormal behavior and reveal bugs. The goal is to create inputs that the software developers hadn’t thought of and see if the software behaves unexpectedly. Another defensive method is mitigation, which means introducing protective measures that don’t eliminate a vulnerability but make it much harder to exploit. Imagine you have information stored in a program’s memory. If the different pieces of information are always stored in the same places, then once a hacker identifies one of them, they can easily find the others. But we can mitigate this risk by having their location change randomly every time the program starts up. The initial bug might still exist, but it would be much harder to take advantage of. Mitigation works a little like an insurance policy. It comes with a cost, since it could slow a program down, and it doesn’t cover all types of risks. But since some bugs will inevitably slip under the radar, these inconveniences are a small price to pay for the additional protection.

Another defensive approach we use is to break very large systems down into smaller components. It’s very difficult to provide a solid security guarantee on 100 million lines of code. But if we isolate a library or other component, we can analyze and test it in much greater depth.

Is AI changing the rules of the game?

Yes. Automated testing was already used to find bugs in very large systems like Linux, Android and Chrome, and AI is speeding up the process even further. I recently came back to a problem related to USB vulnerabilities that I’d studied about ten years ago. Back then, all the research required a great deal of work. But today, with a handful of AI agents, I was able to carry out fuzz testing, automatically putting software through countless scenarios to uncover bugs, on a recently developed Linux kernel in just a couple of days. AI saved me an incredible amount of time.

Does that mean anyone will soon be able to use AI to become a hacker?

It’s true that less and less expertise is needed to spot simple vulnerabilities, and some tasks can be carried out much more easily. But the reason why I can use AI so effectively is because I’ve been working in the field for years and know exactly what I’m looking for. Someone without this kind of knowledge and expertise wouldn’t get the same results. For now, it’s mostly experts that AI is making much more efficient.

Are we about to see a sharp increase in the number of identified vulnerabilities?

We’ll probably find a huge number of them in the coming years. Companies that own the software will be forced to devote more resources to security.

A swarm of AI agents developed by OpenAI recently hijacked a website on their own. Could that start happening regularly?

I wouldn’t phrase it exactly that way. Computer models don’t have free will – somebody has to run the models and give them access to an environment. Anyone who provides an AI model with tools and access to data or a system without putting in place the appropriate boundaries is taking a risk. The responsibility lies with the individuals and organizations employing these models.

Even simple steps are highly effective against the vast majority of cyber attacks that consumers are exposed to. The first step is to install updates – not just for your phone and computer, but also for your apps, Wi-Fi router, printer and any other connected device.

Users are told to be careful, but what about hardware manufacturers, banks and software developers – shouldn’t they take on more of the responsibility?

Security costs money, and market dynamics alone aren’t always enough to convince businesses to make that investment. Manufacturers can lower their costs by shortening the product maintenance time or investing less in product security. The problem is that consumers often discover that only after a cyberattack has been carried out. So I think at least some degree of cyber security regulations and standards is needed. For instance, the manufacturers of connected devices could be required to provide updates over a certain period of time.

What concrete steps can we take at our level?

Even simple steps are highly effective against the vast majority of cyber attacks that consumers are exposed to. The first step is to install updates – not just for your phone and computer, but also for your apps, Wi-Fi router, printer and any other connected device. It’s also important to back up your data regularly and use a password manager so that you can have a different, robust password for each service you use. And you should be careful about the information you disclose. If your password manager suddenly stops entering the password on a given web page, for example, take that as a warning sign – you might be on a phishing website. If someone purporting to be a representative of your bank calls you asking for sensitive information, it’s a good idea to hang up and then call your bank back yourself. This reflex is even more important now with AI, since models can create voices that sound perfectly natural – or even like someone you know.