3AUG

UK cyber sector clears 14.7bn pounds

4 min read

16:08UTC

DSIT put the UK cyber sector at 14.7 billion pounds and announced 90 million pounds aimed at SMEs and NHS suppliers, the exact chain that recent breaches exposed.

← Back to KEV deadlines fell from 14 days to three Jump to analysis ↓

TechnologyDeveloping

Key takeaway

A 14.7 billion pound sector still leaves NHS and SME suppliers as the chain that 90 million pounds now chases.

The Department for Science, Innovation and Technology (DSIT) reported in its May newsletter that the UK cyber security sector now turns over £14.7 billion, up 11 per cent year on year, across 2,603 companies (up 20 per cent) employing 69,600 people, with 2,300 net new jobs ¹. DSIT runs the government's cyber policy and digital infrastructure. Alongside the figures it announced £90 million in new funding aimed at small and medium-sized enterprises and NHS suppliers.

That money chases the exposure recent breaches have exposed. NHS suppliers are where the Stryker device wipe and the £963,900 South Staffs Water fine bit hardest, upstream of the hospitals and the taps. DSIT also set out a voluntary Cyber Resilience Pledge: signatories commit to a board-level cyber lead, enrolment in the NCSC's free Early Warning service, and Cyber Essentials across their supply chains, with a formal launch in summer 2026 and signatories published on GOV.UK.

The Cyber Security and Resilience Bill sets the regulatory backdrop, and it is not fresh news. DSIT frames it as having cleared its Commons committee and due back for Report stage before the Lords . The open question is whether a voluntary pledge moves boards that statute has not yet reached, or whether it stays a press release. A pledge with no enforcement teeth tends to attract the firms that already comply, and to leave the under-resourced SME suppliers, the ones the £90 million is meant for, exactly where they were.

Deep Analysis

In plain English

Every year the UK government publishes figures on how large Britain's cybersecurity industry is. In May 2026, it reported the sector brought in £14.7 billion in revenue, employed nearly 70,000 people, and added 2,300 new jobs, roughly the same size as the UK's aerospace maintenance sector. At the same time, the government launched a voluntary programme called the Cyber Resilience Pledge. Companies that sign up agree to three things: appoint a board-level executive responsible for cybersecurity, register for a free government alert service run by the National Cyber Security Centre (NCSC), and obtain a basic security certification called Cyber Essentials across their supply chains. The £90 million announced alongside the Pledge is specifically aimed at smaller businesses that supply the NHS, because a cyberattack on a small supplier can disrupt hospital operations even if the hospital itself has strong defences. The Pledge is voluntary for now, but a new law currently going through Parliament would make similar requirements legally binding once it passes.

Deep Analysis

Root Causes

UK cyber regulation operates in a dual-track gap: large enterprises above roughly 250 employees face ICO enforcement, NCSC guidance, and growing Cyber Essentials procurement pressure, while the SME supply chain, which includes most NHS tier-2 and tier-3 suppliers, sits below the practical enforcement threshold of every existing instrument.

The £90m funding allocation targets this gap directly, but the funding mechanism, grants and subsidies rather than subsidised certification, does not address the capacity problem: SMEs lack the internal technical personnel to implement Cyber Essentials controls, not the certification fee.

The Cyber Resilience Pledge's formal launch is timed to precede Royal Assent of the Cyber Security and Resilience Bill (CS&R Bill). DSIT is using the voluntary instrument to build a cohort of compliant suppliers before the statutory 24-hour incident-reporting obligation arrives, so that the compliance infrastructure exists before the reporting obligation creates the demand for it.

The sequencing is deliberate, but it also means the Pledge's first cohort is drawn from organisations that already have board-level cyber awareness and can respond to a voluntary signal.

What could happen next?

Consequence
The adverse-selection dynamic means the Pledge's first-cohort compliance data will overstate supply-chain coverage; DSIT's summer 2026 launch signatory list will not represent the uncertified SME tail that the £90m funding is designed to reach.
Short term · Assessed
Precedent
If DSIT follows the Cyber Essentials procurement-mandate model, board-level cyber lead designation will become a condition of NHS and central-government supplier approval within 18 to 24 months of the Pledge's formal launch.
Medium term · Assessed
Risk
The UK-EU regulatory divergence widens: NIS2 imposes statutory fines on essential entities across 18 sectors, while the UK Pledge remains voluntary pre-CS&R Bill. UK-headquartered suppliers operating across both markets must now track two separate compliance timelines and board-governance models.
Medium term · Assessed

Source Landscape

This story draws on mixed-leaning sources from United Kingdom (includes United Kingdom state media)

United Kingdom

Primary parallel: The UK's 2014 voluntary Cyber Essentials scheme followed identical logic: a government-backed, non-statutory baseline certification that over-indexed on already-compliant larger suppliers and under-reached the SME tail, until 2014 MOD procurement rules made Cyber Essentials mandatory for defence contracts handling personal or government data.

Adoption among uncertified SMEs only rose sharply after the procurement mandate, not after the scheme launched. The Cyber Resilience Pledge mirrors the pre-mandate Cyber Essentials phase.

Counter-parallel: The EU's NIS2 Directive took the opposite approach from the start, imposing statutory obligations and proportional fines (up to 2% of global turnover for essential entities) rather than launching with a voluntary pledge.

Germany's national NIS2 implementation law came into force in December 2025, but by the March 2026 registration deadline only around one-third of covered entities had registered. Statutory obligation without enforcement capacity produces the same adoption gap as a voluntary pledge without procurement leverage, suggesting the mandate model is necessary but not sufficient.

The £14.7bn revenue figure represents 11% year-on-year growth against an estimated UK GDP growth rate of approximately 1% for the same period, making the cyber sector one of the UK's fastest-growing technology verticals.

With 2,603 active firms, the sector has a mean revenue of roughly £5.65m per company, but the distribution is highly skewed: a small number of large-managed-security-service and SaaS vendors account for the majority of revenue, while the median firm is an SME with under 20 employees.

The £90m SME and NHS supplier funding targets approximately the bottom 80% of that firm distribution by revenue. At an estimated average grant of £30,000 to £50,000 per beneficiary, based on analogous DSIT innovation fund tranches, the funding reaches roughly 1,800 to 3,000 firms. This covers between 70% and 115% of the approximately 2,600 NHS-contracted IT suppliers identified in DSIT's own sector census, depending on how 'NHS supplier' is defined in the Pledge's eligibility criteria.

Consensus view: RUSI's cyber policy research team and techUK's 2025 cyber growth report both identify adverse selection as the central structural weakness of voluntary compliance pledges: the firms that self-select as early signatories are disproportionately those already meeting or exceeding the pledge's requirements.

RUSI's 2024 paper on the UK's voluntary cyber frameworks found that NCSC's Cyber Essentials scheme, the predecessor model for the Pledge's supply-chain requirement, had a renewal rate above 85% among existing certified suppliers but a first-time adoption rate below 12% among uncertified SME suppliers to government.

Counter-view: DSIT economists and researchers at the Cambridge Centre for Digital Innovation argue that the adverse-selection critique understates the Pledge's function as a market-signalling instrument.

On this reading, the Pledge's purpose is not to change behaviour in the first cohort of signatories but to create an auditable board-level commitment that procurement Teams at large NHS trusts and government departments can use as a screening criterion in supplier due-diligence, shifting the incentive to the buyer side of the market.

Key tension: Whether the Pledge's board-level cyber lead requirement can be operationalised in organisations with fewer than 50 employees, where the typical NHS tier-3 supplier operates, or whether it functions only as a compliance signal for mid-market and enterprise suppliers who can absorb the governance overhead.

Sources:GOV.UK (Department for Science, Innovation and Technology)·GOV.UK (Department for Science, Innovation and Technology)·GOV.UK (Department for Science, Innovation and Technology)

Mentions:DSIT →Cyber Resilience Act →NCSC →Cyber Security and Resilience Bill →NIS2 →Parliament →Germany →GOV.UK →RUSI →Cambridge →Cyber Essentials →Early Warning →NHS →Cyber Resilience Pledge →

First Reported In

Update #5 · GitHub's own code cloned via VS Code add-on

GOV.UK (Department for Science, Innovation and Technology)· 29 May 2026

Read original →

Causes and effects

Caused by

EU CRA guidance; German NIS2 missed

The Cyber Resilience Pledge and £90m funding operate within the regulatory context of the CS&R Bill, aiming to move board-level cyber compliance ahead of the Bill reaching Royal Assent.

Occurred 3 Mar 2026

Read story →

This Event

UK cyber sector clears 14.7bn pounds

The funding and the voluntary Pledge target supply-chain exposure that statute has not yet reached, with no enforcement teeth attached.

Led to

UK cyber bill drops payment regime

DSIT's £14.7 billion UK cyber sector report and Cyber Resilience Pledge provide the commercial context framing the CS&R Bill's passage as paired supply-chain accountability alongside sector strength.

Occurred 10 Jun 2026

Read story →

Different Perspectives

Group-IB

Group-IB, headquartered in Singapore, documented on 19 March that The Gentlemen began inside Qilin's own affiliate programme and split from it over a payment dispute. Its analysis makes this window's leak-site tally readable as a fracture inside one ransomware operation rather than the arrival of an unknown crew.

ENISA

ENISA placed EU drinking water and wastewater in its cyber risk zone for the first time on 28 May, finding one in three water entities had never run a risk assessment. CISA's 30 July advisory to American operators reads as the operational sequel to a gap European regulators had already documented two months earlier.

House of Lords and NCSC

The Cyber Security and Resilience Bill sits at House of Lords committee stage, its amendment paper running to 23 July. Separately, the NCSC guidance CISA cited when directing water operators to disconnect controllers is version 1.0 from March 2024, a two-year-old British document doing operational work in an American alert published last week.

heise online

heise online reported on 27 July that Russian state attackers, named as APT28, ran the hotel WiFi credential-harvesting campaign. Its attribution is firmer than ReliaQuest's own hedged low-to-medium confidence assessment of the same intrusion, a difference in national reporting posture rather than a settled dispute over who is responsible.

CISA and ReliaQuest

CISA compressed remediation deadlines under BOD 26-04 while, in the same window, telling water and wastewater operators to disconnect internet-exposed controllers rather than patch them. ReliaQuest, investigating the hotel WiFi campaign, held its assessment of the intrusion route at low-to-medium confidence and declined to name a state sponsor.

AIVD

AIVD co-signed AA26-204A alongside CISA, the NSA and the FBI, adding its signature to the fifteen-agency coalition naming LAUNDRY BEAR. Dutch involvement continues a pattern of joint Five Eyes-adjacent advisories the agency has co-issued with CISA and NCSC through 2026.