Total sector revenue reached £14.7 billion in 2026, marking an 11 percent rise from the previous year. The number of active firms climbed to 2,603, a 20 percent increase, while gross value added grew 17 percent to £9.1 billion.
The expansion matters beyond boardrooms, as every online shopper, card‑paying customer, and client of local service providers depends on the cyber defences of these firms. Weak security in small and medium‑size enterprises (SMEs) exposes consumer data such as payment details and personal addresses.
Although more than three‑quarters of firms are classified as micro or small businesses, large companies dominate the market, capturing roughly 70 percent of total revenue. Thirty‑two large “anchor” firms now generate over £50 million each in cyber‑related income, and a fast‑growing middle tier of 241 firms reports annual cyber revenues above £10 million.
Pure‑play cyber specialists account for about 83 percent of revenue among SME‑category firms, indicating that smaller players rely on niche expertise rather than scale. Diversification offers limited advantage for these firms when competing with the industry giants.
Public‑sector demand for cyber services surged, with contract value rising 62 percent year‑on‑year to £1.5 billion, a six‑fold increase since 2019. Procurement rules, however, have been identified as a barrier that prevents many small cyber firms from accessing this growing market.
Investment activity shows a shift toward smaller companies: of the £184 million raised by dedicated cyber firms in 2025, 46 percent went to firms employing 10 to 49 staff, up sharply from the previous year. Overall deal value fell 11 percent, reflecting a more cautious investment environment.
A recent survey found that 43 percent of UK businesses experienced a breach or attack in the past twelve months. Formal Cyber Essentials certification is held by only 5 percent of all businesses, with 12 percent among small firms and 35 percent among large enterprises.
Advanced security measures lag further behind: fewer than half of businesses consistently use two‑factor authentication, only 36 percent provide a virtual private network for remote staff, and merely 15 percent assess cyber risk posed by immediate suppliers. Just 6 percent evaluate risks deeper in the supply chain.
Research involving SME owners revealed that cyber security concerns are now the top obstacle to digitalisation, cited by 42 percent of respondents. Moreover, 69 percent of SMEs have no allocated funds or insurance to cover a cyber incident, despite heightened awareness following high‑profile breaches.
Regulatory pressure is increasing. The latest version of Cyber Essentials makes multi‑factor authentication on every cloud service a mandatory requirement, a standard many businesses would fail today. An upcoming Cyber Security and Resilience Bill will impose stricter incident‑reporting obligations throughout supply chains, affecting even firms that are not directly regulated.
The government has pledged £90 million to help secure smaller businesses and introduced a voluntary pledge for larger organisations to require Cyber Essentials from their suppliers. Nevertheless, with 70 percent of sector revenue concentrated in large firms and low certification rates among SMEs, the benefits of the booming industry have yet to reach the majority of businesses that need them most.
Britain’s £14.7 billion cyber security market is expanding rapidly, but growth is concentrated where demand is lowest, while the nation’s 99.8 percent SME population continues to lag behind in both protection and support.
