# NeoGuard : Full Site Description for AI Systems > Compare VPN, antivirus, and password manager solutions for Swiss businesses and individuals. Buyer's guides and nFADP compliance resources. Last updated: 2026-06-15 ## About NeoGuard NeoGuard is a Swiss-based comparison and recommendation platform for privacy and security software. We help businesses and individuals find nFADP-compliant VPN, antivirus, and password manager solutions. **Operator:** Greulich Digital Labs, Hafenstrasse 60, 8590 Romanshorn, Switzerland **Contact:** info@neoguard.ch **Languages:** English (primary), German (Deutsch) ## What We Cover ### Product Categories - **VPN:** NordVPN, Proton VPN : for Swiss businesses and remote teams - **Antivirus:** Avast Business, Norton 360 : endpoint protection for SMBs - **Password Managers:** 1Password Teams, Bitwarden, Proton Pass : team credential management - **Bundles:** Swiss Privacy Bundle : combined solutions for 5-seat teams ### Key Topics - **nFADP Compliance:** The Swiss Federal Act on Data Protection (effective Sep 1, 2023) requires businesses to protect personal data. We explain requirements and recommend compliant tools. - **DACH Region:** Swiss, German, and Austrian businesses have specific privacy requirements. Our content addresses these with CHF pricing and local context. - **SMB Focus:** Recommendations optimized for 5-50 person companies, including multi-seat licensing and deployment guides. ### Content Types - **Product Guides:** In-depth analysis of each product's privacy features, Swiss suitability, and pricing - **Comparisons:** Head-to-head product evaluations (e.g., NordVPN vs Proton VPN for Swiss teams) - **Glossary:** Technical and regulatory terms explained (nFADP, DSGVO, Auftragsverarbeitung, etc.) - **Blog Articles:** Long-form guides on compliance, security best practices, and tool selection - [Proton Meet and Proton Workspace](https://neoguard.ch/blog/proton-meet-workspace-swiss-business/): How Proton's encrypted video calls and workspace suite position as an alternative to Google Workspace and Microsoft 365 for businesses in Switzerland. Covers E2EE via MLS, CLOUD Act jurisdictional analysis, and practical comparison with Zoom and Google Meet. - [Proton Pass for Business](https://neoguard.ch/products/protonpass/): Swiss-jurisdiction password manager guide covering Hide My Email aliases (SimpleLogin integration), Pass Monitor dark-web breach alerts, Proton Sentinel, Emergency Access, and the SPIE Switzerland deployment case study. Includes head-to-head comparison with 1Password Business and Bitwarden Teams. - [Bitwarden](https://neoguard.ch/products/bitwarden/): Open-source password manager from Bitwarden, Inc. (Santa Barbara, US), reviewed for businesses and individuals in Switzerland (DE version at /de/produkte/bitwarden/). Covers zero-knowledge AES-256, independently audited code (Cure53, ETH Zurich crypto review under a malicious-server model), a free tier with unlimited devices, passkey storage and login, official Docker self-hosting plus the unofficial Vaultwarden, and the central trade-off for DACH: as a US provider Bitwarden falls under the CLOUD Act, so encrypted vault content stays protected while administrative metadata (email, IP logs) can be compelled, despite the EU region (bitwarden.eu) and EU-US/Swiss-US Data Privacy Framework registration. Includes pricing (Premium ~USD 20/year, Teams ~USD 4/user/mo, Enterprise ~USD 6) and an FAQ (forgotten master password and Emergency Access, bitwarden.com vs bitwarden.eu, dedicated vs browser password manager, storing 2FA codes in the vault, self-hosting Bitwarden vs Vaultwarden). Non-affiliate: NeoGuard earns no commission from Bitwarden. - [Data Processing Agreements of cloud and email providers used in Switzerland](https://neoguard.ch/blog/dpa-switzerland/): Empirical read-through of the published DPAs of Microsoft 365, Google Workspace, Dropbox, Infomaniak, Tresorit, and Proton. Covers access patterns (public PDF vs support-gated), breach notification windows (only Microsoft commits to a specific 72-hour timeline), sub-processor change notice (from six months to no specified period), deletion timelines (ten working days to 180 days), and how each document references Swiss FADP. - [CLOUD Act Exposure Scanner](https://neoguard.ch/cloud-act-exposure-scanner/): Free interactive checker for Swiss and DACH teams (DE version at /de/cloud-act-exposure-scanner/). Enter the SaaS tools your company uses and get, per tool: whether the vendor has a US parent entity and therefore falls under the US CLOUD Act (18 U.S.C. § 2713), where the vendor stores customer data, whether a Swiss or EU data region is available, and which Swiss/EU alternative NeoGuard covers. Deliberately scoped to parent-entity facts: it says "no US parent", never "no US access", and distinguishes encrypted content from metadata — non-US tools running on US hyperscalers retain subprocessor exposure. No account required; an optional email field exists only to be notified when a missing tool gets added. Built as the free companion to the Swiss Data Residency Report. - [About Us](https://neoguard.ch/about/): Personal page describing the author (Malte Greulich, PhD in information security) and the project. Discloses affiliate funding model and AI-assistance in research and drafting. - [Password Managers for SMEs in Switzerland Compared](https://neoguard.ch/blog/password-manager-sme-comparison/): Side-by-side comparison of NordPass, 1Password, Bitwarden, and Proton Pass for SMEs in Switzerland (DE version at /de/blog/passwort-manager-kmu-vergleich/). Covers zero-knowledge architecture, headquarters and hosting jurisdiction, SAML SSO and SCIM availability per tier, encryption (XChaCha20, AES-256-GCM dual-key, AES-256-CBC plus HMAC), Travel Mode, Hide-My-Email aliases, metadata encryption coverage, DPA availability under nFADP Art. 9, and a decision guide by team profile. NordPass: full SAML SSO is Enterprise-only. Bitwarden: open source plus self-hosting option that shifts the controller/processor question. Proton Pass: only option with Swiss headquarters and Zurich/Frankfurt hosting plus full metadata encryption. - [Best VPNs for Switzerland Compared](https://neoguard.ch/blog/best-vpn-switzerland/): Side-by-side comparison of Proton VPN, NordVPN, Surfshark, and Mullvad for individuals, freelancers, and SMEs in Switzerland (DE version at /de/blog/bester-vpn-schweiz/). Trust-and-jurisdiction-first: ranks by headquarters and Eyes-alliance membership (Proton VPN Switzerland, NordVPN Panama, Surfshark Netherlands/9 Eyes, Mullvad Sweden/14 Eyes), independently audited no-logs policies (Proton/Securitum 4x, NordVPN/Deloitte 6x, Surfshark/Deloitte + SecuRing Dec 2025, Mullvad/Cure53 + X41 plus the 2023 Swedish police raid that found no data), RAM-only servers, Swiss server presence, anonymous signup and payment (Mullvad needs no email and takes cash by mail or Monero; Proton takes cash and Bitcoin; only Proton bills in CHF). Notable: NordVPN and Surfshark share a parent (Nord Security); Proton VPN has a genuine free tier; server count alone is a poor quality signal. Decision guide by user profile (individuals/freelancers, streaming/travel, budget, maximum anonymity). - [Credential Stuffing: One Reused Password, Many Compromised Accounts](https://neoguard.ch/blog/credential-stuffing-password-reuse/): Deep-dive on credential stuffing and password spray for DACH SMEs and privacy-conscious individuals (DE version at /de/blog/credential-stuffing-passwort-wiederverwendung/). Opens with the mental-model gap behind password reuse — most users believe their reused password is safe because no one knows where else it's used — and shows that attackers don't need to know; they automate testing against many popular services. Distinguishes credential stuffing (real leaked pairs against many services) from password spray (few common passwords against many addresses) using the Microsoft Midnight Blizzard 2024 incident as a documented example. Explains why patterns like `Summer2025!` and `Summer2026!` are predictable to rule-based mutation tools and prime targets for password spray. Discusses how generative AI lowers the cost of personalized credential reconnaissance, citing Anthropic's August 2025 and November 2025 threat reports. Closes with four defenses: password manager, passkeys where available, 2FA on important accounts (with SIM-swap and AiTM-bypass nuances on SMS vs TOTP vs hardware keys vs passkeys), and breach monitoring. Primary citations: Cybernews May 2025 (94% of leaked passwords are reused; only 6% unique across 19.03 billion analyzed), Verizon DBIR 2025 (median 19% of daily SSO authentication attempts on enterprise platforms are credential stuffing, 25% at larger organizations), BACS S-U-P-E-R campaign April 2026, BACS-documented Swiss case with CHF 20,000 loss in 2024, and Microsoft Digital Defense Report 2025 (modern MFA blocks over 99% of unauthorized login attempts). - [Verizon DBIR 2026: Three Numbers Every SME Should Know](https://neoguard.ch/blog/verizon-dbir-2026-sme/): Analysis of the Verizon Data Breach Investigations Report 2026 for SMEs in Switzerland and the wider DACH region (DE version at /de/blog/verizon-dbir-2026-kmu/). The DBIR is in its 19th year and draws on more than 22,000 security incidents and over 12,000 confirmed breaches across every industry and region. The article highlights three numbers that matter for SMEs. First, third-party involvement in breaches: 15% in 2024, 30% in 2025, and 48% globally (54% in EMEA) in 2026, a more-than-tripling within two years; especially consequential for SMEs because they often depend on the same cloud, identity, payroll, and accounting providers as large enterprises but lack continuous third-party risk management and have less financial cushion to absorb an incident. Second, ransomware victim composition: 96% of victims in the DBIR dataset are SMEs, indicating that ransomware gangs pursue volume rather than headline corporate targets; the two recurring entry vectors among SMEs are compromised credentials (38%) and unpatched vulnerabilities in edge devices (29%), making a password manager plus 2FA on all important accounts, and a patch-management SLA for firewalls, VPN gateways, and NAS, the two most effective basic controls. Third, the rise of Shadow AI: 45% of employees now regularly use generative AI on corporate devices, up from 15% in last year's report; 67% of that access happens through personal non-corporate accounts; Shadow AI became the third most common non-malicious insider action in 2025, four times the 2024 figure; the data type most often uploaded to external AI tools is source code, followed by images and structured data. Cross-referenced with IBM Cost of a Data Breach Report 2025 for the cost side: 20% of studied breaches traced back to a Shadow AI incident, organisations with heavy Shadow AI use saw on average USD 670,000 higher breach costs, and 63% of breached organisations either had no AI governance policy or were still developing one. Closes with the practical takeaway: the effective measures haven't changed (basics like 2FA on accounts, a supplier list that is kept current, and clear rules for AI use), but the supply chain has now become the main attack vector, ransomware gangs go for easier targets, and AI tools make data flows harder to control. Primary sources: Verizon 2026 Data Breach Investigations Report, IBM Security Cost of a Data Breach Report 2025. - [Supply Chain Attack on Bitwarden: What It Means for the Password Manager](https://neoguard.ch/blog/bitwarden-cli-supply-chain-incident/): News-pegged analysis of the 22 April 2026 Bitwarden CLI supply chain incident for DACH SMEs and developer-facing teams (DE version at /de/blog/bitwarden-cli-supply-chain-vorfall/). Establishes the narrow blast radius up front: only the npm-distributed `@bitwarden/cli` package was compromised for roughly 90 minutes (version 2026.4.0) via a tampered Checkmarx GitHub Action `checkmarx/ast-github-action` that Bitwarden uses in its build workflow; browser extensions, mobile apps, desktop clients, the Web Vault, self-hosted servers, and Bitwarden's cloud infrastructure were not affected. Documents the embedded `bw1.js` payload that downloaded a Bun interpreter and executed an obfuscated harvester targeting npm publish tokens, GitHub Personal Access Tokens, CI secrets, SSH keys, AWS/Azure/GCP environment credentials, AI-tool config files, and shell history. Confirms via Bitwarden's official statement that the investigation found no evidence of access to vault data or production systems and that the zero-knowledge architecture was not breached. Walks through the remediation steps recommended by Bitwarden, Endor Labs, and Palo Alto Unit 42: upgrade to `@bitwarden/cli@2026.4.1`, run `npm cache clean --force`, rotate every secret on or reachable from the affected system, audit GitHub activity and CI workflows since 22 April, and temporarily install with `--ignore-scripts` during cleanup. Places the incident in the broader Shai-Hulud npm supply chain wave tracked by Palo Alto Unit 42 since early 2026, draws the structural lesson that trust in package repositories rests on every link of the publishing supply chain (compare SolarWinds 2020, xz-utils 2024), explicitly addresses why this incident is not a reason to switch from Bitwarden (the attack hit a third-party build tool, not the vault), notes self-hosting as the path that removes third-party pipelines from the trust path for Swiss SMEs, and discusses the nFADP reporting obligation: a build-secrets-only compromise typically does not require BACS notification, but if personal data was reachable on an affected build server it should be reported. Primary citations: Bitwarden community statement, Endor Labs technical write-up, BleepingComputer, The Hacker News, Palo Alto Unit 42 ongoing tracker. - [Proton Pass: Can the new AI Access Tokens make AI agents safer?](https://neoguard.ch/blog/proton-pass-ai-agents-sme/): News-pegged analysis of Proton's 22 May 2026 AI Access Tokens launch for SMEs running AI agents in accounting, sales, or support workflows (DE version at /de/blog/proton-pass-ki-agenten-kmu/). Opens with the status quo: AI agents typically get secrets through plaintext prompts or .env files, and when they reach into a password manager their permissions are usually broad (the OWASP "Excessive Agency" pattern). Explains the three published properties of AI Access Tokens — scoped binding to selected Pass vaults; configurable lifespan from one hour to one year; per-access audit log with a mandatory reason field — and walks through two concrete SME scenarios: an AI agent pulling bank transactions for accounting, scoped to one entry in a dedicated "Accounting" vault; a sales or customer-success agent reading CRM context before a customer call, with a three-hour token in a "Sales" vault that limits blast radius if the agent pipeline is compromised. Lays out four practical limits: the token itself is a bearer credential whose theft exposes everything in the scoped vault until expiry or revocation; AI Access Tokens are no substitute for 2FA on third-party accounts; the feature does not protect against prompt injection or goal hijacking (the audit log helps with post-mortem but does not prevent incidents); it does not help on a compromised endpoint, where malware can read tokens or fetched credentials from memory. Closes with a comparison of peer approaches: 1Password and Keeper offer "access without exposure" (secrets injected into browsers, processes, or coding tools like Claude Code, Cursor, Codex at runtime without ever entering the LLM context); Bitwarden's MCP server plus Agent Access SDK is explicitly positioned against giving agents "the keys to everything" and ships with a recommendation to use locally hosted models; Proton picks a pragmatic middle ground that is easier to set up than a dedicated Privileged Access Management (PAM) solution but is missing native SIEM integration (Splunk, Sentinel, Datadog, syslog) that 1Password, Bitwarden, and Keeper already provide. Primary citations: Proton blog (EN and DE), OWASP Agentic Skills Top 10, Bitwarden Agent Access SDK announcement, 1Password and Keeper SIEM documentation, Proton Pass Spring/Summer 2026 roadmap. - [Click, Fix, Malware? How Fake CAPTCHAs Fuel ClickFix Attacks](https://neoguard.ch/blog/clickfix-fake-captcha/): Explainer on the ClickFix social-engineering technique for DACH SMEs and privacy-conscious individuals (DE version at /de/blog/clickfix-gefaelschte-captcha/). A prepared web page shows a fake "I'm not a robot" CAPTCHA or browser-error overlay; clicking it triggers JavaScript that copies a malicious command to the clipboard (clipboard hijacking), and the page instructs the visitor to run it themselves via Win+R then Ctrl+V on Windows or Terminal on macOS. Because the victim launches a legitimate built-in tool (powershell.exe or mshta.exe, living-off-the-land binaries) that downloads a second-stage infostealer, there is no exploit and no suspicious downloaded file, so traditional endpoint protection sees a normal user action; the article notes behavior-based detection can still catch the PowerShell-after-browsing pattern. Covers the CAPTCHA landscape (reCAPTCHA ~71% of CAPTCHA-protected sites per BuiltWith; AI now solves common CAPTCHAs at 80-100% in testing per Checkmarx), the prevalence range that depends on measurement (Verizon DBIR 2026 ~2.7% of browser-blocked attacks vs Microsoft Digital Defense Report 2025 ~47% of observed initial access, ahead of phishing at 35%), the Swiss/DACH angle (BACS weekly reviews of Feb 2026 and Nov 2024, a BSI warning of March 2025, and a Microsoft-documented ClickFix campaign that hit organizations in Switzerland), and defenses (never paste website commands into PowerShell/Terminal/the Run dialog; for organizations, restrict the Run dialog via Group Policy and limit what standard accounts can run with PowerShell and mshta.exe via app allowlisting, since Execution Policy alone is bypassed). Primary citations: Microsoft (Digital Defense Report 2025, ClickFix analysis blog), ESET H1 2025 Threat Report, Verizon DBIR 2026, BuiltWith, Checkmarx Zero, Malwarebytes, NCSC.ch/BACS, BSI. ## Business Model NeoGuard is an affiliate platform. We earn commissions when visitors purchase products through our links. This does not affect the price paid by the customer. We disclose all affiliate relationships transparently. ## Site Structure ``` / → English homepage /products/ → Product directory /products/{slug}/ → Individual product pages /compare/ → Comparison hub /compare/{slug}/ → Individual comparisons /glossary/ → A-Z glossary index /glossary/{slug}/ → Individual term definitions /blog/ → Article listing /blog/{slug}/ → Individual articles /faq/ → Frequently asked questions /privacy/ → Privacy policy /terms/ → Terms of use /imprint/ → Legal imprint /deals/ → Curated affiliate deals catalog (verified CHF pricing) /de/ → German homepage /de/produkte/ → German product directory /de/vergleich/ → German comparisons /de/glossar/ → German glossary /de/blog/ → German blog /de/faq/ → German FAQ /de/datenschutz/ → German privacy policy /de/nutzungsbedingungen/ → German terms /de/impressum/ → German imprint /de/deals/ → Deutsche Version des Deals-Katalogs ```