UK Cybersecurity Market: Size, Growth, Jobs and What It Means

The UK cybersecurity market is the sector of UK-registered firms that sell cyber security products and services, from software vendors to consultancies and managed security providers. According to the DSIT Cyber security sectoral analysis 2026, published on 12 May 2026, it comprised 2,603 firms, generated £14.7 billion in revenue and supported around 69,600 full-time equivalent jobs.

These are government figures drawn from a firm list as at December 2025, with financial data mostly from 2024/25 accounts. They describe the supply side of the market: the businesses selling security. They do not measure how much UK organisations spend or how well protected they are.

This article uses only official sources opened in October 2026, dates each figure, and then explains what the market looks like for a UK business choosing a supplier.

How big is the UK cybersecurity market?

The Department for Science, Innovation and Technology (DSIT) publishes an annual sectoral analysis. The 2026 edition reports the following, with comparisons to the previous year's report:

Source: DSIT Cyber security sectoral analysis 2026, published 12 May 2026. The report states that the firm list is as at December 2025 and the financial data covers mostly 2024/25 accounts.

The report defines in-scope firms as UK-registered businesses with an active commercial presence that sell cyber security products or services. Charities, universities and individual contractors are excluded, so the figures understate the wider workforce.

Growth, investment and exports

The headline pattern is strong growth in the number of firms and in value generated per employee, with employment growing more slowly. A rise in GVA per employee of 13% suggests firms are producing more value from each role, though the report's figures alone do not explain why.

The same report gives UK cyber security exports of about £7.2 billion in 2023 and £8.6 billion in 2024, a rise of 19%. Cyber security made up 67% of total UK security export value of £12.9 billion, and Europe was the largest regional export market at 55%.

The report also includes an update on AI in the sector. It records rapid growth of firms securing AI systems and using AI to identify vulnerabilities, and 13% of firms mentioned AI security, assurance and governance among their offerings. Investors cited AI security as a key area. That reflects a market that is changing quickly, so any supplier comparison should ask how recently a firm's offering was updated.

What kinds of firms make up the sector

The sector is dominated by small businesses by number, and by large firms by employment.

Source: DSIT Cyber security sectoral analysis 2026 (2026 edition, firm list as at December 2025).

By activity, 72% of firms are service businesses, including managed security service providers and resellers, and 29% are product firms. Some firms do both. The report counted 644 managed security service providers. Information risk assessment and management and cyber professional services were each offered by 80% of firms, network security by 52%, and threat intelligence, monitoring, detection and analysis by 45%.

For a buyer, this tells you the market you are buying from is mainly service-led and made up of small specialists. That is useful context when you compare a boutique consultancy with a large provider.

Regional clusters across the UK

The sector is concentrated in the south but is not confined to it. The report shows the share of 5,374 active office locations and the estimated share of jobs by region.

Source: DSIT Cyber security sectoral analysis 2026 (2026), figures 3.1 and 4.5. The report names Greater Manchester, Bristol and Bath, Cheltenham, Belfast, Glasgow, Edinburgh, Newcastle and the Oxford-Cambridge Growth Corridor as hotspots.

The North West holds a slightly larger share of jobs than of offices, which suggests larger teams. If you buy in Greater Manchester, our IT support in Manchester page describes our local presence, and the same applies in London through our London IT support team.

Jobs and the skills picture

Sector size does not mean organisations can find the skills they need. DSIT's Cyber security skills in the UK labour market 2025 report, first published on 19 September 2025, found:

• About 143,000 people in the UK cyber security workforce at the end of 2024, up 5% from about 136,800 the year before.
• An estimated workforce gap of 3,800 individuals in the 2025 report, compared with 11,100 in 2023 and 3,500 in 2024.
• A basic skills gap in 49% of businesses, 59% of charities and 14% of public sector organisations. Basic skills include setting up firewalls and detecting malware.
• An advanced skills gap in 30% of businesses, 29% of charities and 21% of public sector organisations. Advanced skills include forensic analysis and penetration testing.
• Core cyber security job postings averaging 2,698 a month in 2024, down 33% on 2023, with a median advertised salary of £55,000.

The gap between supply and organisations' needs is therefore less about the total number of workers and more about which organisations can access the right skills. Smaller organisations may find it hard to recruit and retain specialists at those salary levels, which is one reason many consider outsourced providers. Our comparison of outsourced and in-house IT sets out the trade-offs. The skills figures also show that gaps are most common in basic tasks, which is why a consistent baseline matters.

Government strategy, NCSC and regulation

The National Cyber Security Centre (NCSC), part of GCHQ, describes its mission as making the UK the safest place to live and work online. It provides guidance, tools and frameworks, responds to attacks and supports skills development.

On regulation, the government set out proposals for a Cyber Security and Resilience Bill in a policy statement laid before Parliament on 1 April 2025. It proposes bringing managed service providers into scope, which the government expected to cover about 900 to 1,100 additional providers regulated by the ICO, and requiring significant incidents to be notified within 24 hours, with a full report within 72 hours. As at 20 October 2026, Parliament's bills page shows the Bill in the House of Lords, so its final content may still change.

Many UK customers already expect baseline assurance from suppliers. The Cyber Essentials scheme is one way to show that, and our certification guide explains how it works.

What the UK cybersecurity market means for buyers

The figures point to practical conclusions.

• Choice is wide. With 2,603 firms and a large share of micro and small businesses, you can find specialists, but you need to check their depth and capacity.
• Services dominate. Most firms sell services, so the quality of people and processes matters as much as the product.
• Skills are scarce for smaller organisations. A managed provider can give access to monitoring and response that would be hard to recruit.
• Regulation is moving towards providers. Ask any MSP how it manages its own security and what it will report if it has an incident.
• Location is less important than capability. Clusters exist across the UK, and what matters is whether a supplier can support your sites and systems.

When comparing suppliers, our guide on how to choose an IT support company provides a framework, and our managed IT support and small business cybersecurity pages show how we deliver it. If you want to know where your own defences stand first, an independent cyber security audit is a sensible starting point.

Using UK cybersecurity market data

The UK cybersecurity market is large, growing and dominated by small firms, with significant clusters outside London. Official figures give useful context but they describe suppliers, not your risk. Judge any supplier on scope, accreditation, support and how it protects its own systems.

If you would like help assessing your position or choosing a provider, contact us via our contact page.

Frequently Asked Questions (FAQs)