12OCT

UK cyber sector clears 14.7bn pounds

4 min read

10:55UTC

DSIT put the UK cyber sector at 14.7 billion pounds and announced 90 million pounds aimed at SMEs and NHS suppliers, the exact chain that recent breaches exposed.

← Back to China alert puts old bugs on a 3-day clock Jump to analysis ↓

TechnologyDeveloping

Key takeaway

A 14.7 billion pound sector still leaves NHS and SME suppliers as the chain that 90 million pounds now chases.

The Department for Science, Innovation and Technology (DSIT) reported in its May newsletter that the UK cyber security sector now turns over £14.7 billion, up 11 per cent year on year, across 2,603 companies (up 20 per cent) employing 69,600 people, with 2,300 net new jobs⁠¹. DSIT runs the government's cyber policy and digital infrastructure. Alongside the figures it announced £90 million in new funding aimed at small and medium-sized enterprises and NHS suppliers.

That money chases the exposure recent breaches have exposed. NHS suppliers are where the Stryker device wipe and the £963,900 South Staffs Water fine bit hardest, upstream of the hospitals and the taps. DSIT also set out a voluntary Cyber Resilience Pledge: signatories commit to a board-level cyber lead, enrolment in the NCSC's free Early Warning service, and Cyber Essentials across their supply chains, with a formal launch in summer 2026 and signatories published on GOV.UK.

The Cyber Security and Resilience Bill sets the regulatory backdrop, and it is not fresh news. DSIT frames it as having cleared its Commons committee and due back for Report stage before the Lords. The open question is whether a voluntary pledge moves boards that statute has not yet reached, or whether it stays a press release. A pledge with no enforcement teeth tends to attract the firms that already comply, and to leave the under-resourced SME suppliers, the ones the £90 million is meant for, exactly where they were.

Deep Analysis

In plain English

Every year the UK government publishes figures on how large Britain's cybersecurity industry is. In May 2026, it reported the sector brought in £14.7 billion in revenue, employed nearly 70,000 people, and added 2,300 new jobs, roughly the same size as the UK's aerospace maintenance sector. At the same time, the government launched a voluntary programme called the Cyber Resilience Pledge. Companies that sign up agree to three things: appoint a board-level executive responsible for cybersecurity, register for a free government alert service run by the National Cyber Security Centre (NCSC), and obtain a basic security certification called Cyber Essentials across their supply chains. The £90 million announced alongside the Pledge is specifically aimed at smaller businesses that supply the NHS, because a cyberattack on a small supplier can disrupt hospital operations even if the hospital itself has strong defences. The Pledge is voluntary for now, but a new law currently going through Parliament would make similar requirements legally binding once it passes.

Deep Analysis

Root Causes

UK cyber regulation operates in a dual-track gap: large enterprises above roughly 250 employees face ICO enforcement, NCSC guidance, and growing Cyber Essentials procurement pressure, while the SME supply chain, which includes most NHS tier-2 and tier-3 suppliers, sits below the practical enforcement threshold of every existing instrument.

The £90m funding allocation targets this gap directly, but the funding mechanism, grants and subsidies rather than subsidised certification, does not address the capacity problem: SMEs lack the internal technical personnel to implement Cyber Essentials controls, not the certification fee.

The Cyber Resilience Pledge's formal launch is timed to precede Royal Assent of the Cyber Security and Resilience Bill (CS&R Bill). DSIT is using the voluntary instrument to build a cohort of compliant suppliers before the statutory 24-hour incident-reporting obligation arrives, so that the compliance infrastructure exists before the reporting obligation creates the demand for it.

The sequencing is deliberate, but it also means the Pledge's first cohort is drawn from organisations that already have board-level cyber awareness and can respond to a voluntary signal.

What could happen next?

Consequence
The adverse-selection dynamic means the Pledge's first-cohort compliance data will overstate supply-chain coverage; DSIT's summer 2026 launch signatory list will not represent the uncertified SME tail that the £90m funding is designed to reach.
Short term · Assessed
Precedent
If DSIT follows the Cyber Essentials procurement-mandate model, board-level cyber lead designation will become a condition of NHS and central-government supplier approval within 18 to 24 months of the Pledge's formal launch.
Medium term · Assessed
Risk
The UK-EU regulatory divergence widens: NIS2 imposes statutory fines on essential entities across 18 sectors, while the UK Pledge remains voluntary pre-CS&R Bill. UK-headquartered suppliers operating across both markets must now track two separate compliance timelines and board-governance models.
Medium term · Assessed

Source Landscape

This story draws on mixed-leaning sources from United Kingdom (includes United Kingdom state media)

United Kingdom

Primary parallel: The UK's 2014 voluntary Cyber Essentials scheme followed identical logic: a government-backed, non-statutory baseline certification that over-indexed on already-compliant larger suppliers and under-reached the SME tail, until 2014 MOD procurement rules made Cyber Essentials mandatory for defence contracts handling personal or government data.

Adoption among uncertified SMEs only rose sharply after the procurement mandate, not after the scheme launched. The Cyber Resilience Pledge mirrors the pre-mandate Cyber Essentials phase.

Counter-parallel: The EU's NIS2 Directive took the opposite approach from the start, imposing statutory obligations and proportional fines (up to 2% of global turnover for essential entities) rather than launching with a voluntary pledge.

Germany's national NIS2 implementation law came into force in December 2025, but by the March 2026 registration deadline only around one-third of covered entities had registered. Statutory obligation without enforcement capacity produces the same adoption gap as a voluntary pledge without procurement leverage, suggesting the mandate model is necessary but not sufficient.

The £14.7bn revenue figure represents 11% year-on-year growth against an estimated UK GDP growth rate of approximately 1% for the same period, making the cyber sector one of the UK's fastest-growing technology verticals.

With 2,603 active firms, the sector has a mean revenue of roughly £5.65m per company, but the distribution is highly skewed: a small number of large-managed-security-service and SaaS vendors account for the majority of revenue, while the median firm is an SME with under 20 employees.

The £90m SME and NHS supplier funding targets approximately the bottom 80% of that firm distribution by revenue. At an estimated average grant of £30,000 to £50,000 per beneficiary, based on analogous DSIT innovation fund tranches, the funding reaches roughly 1,800 to 3,000 firms. This covers between 70% and 115% of the approximately 2,600 NHS-contracted IT suppliers identified in DSIT's own sector census, depending on how 'NHS supplier' is defined in the Pledge's eligibility criteria.

Consensus view: RUSI's cyber policy research team and techUK's 2025 cyber growth report both identify adverse selection as the central structural weakness of voluntary compliance pledges: the firms that self-select as early signatories are disproportionately those already meeting or exceeding the pledge's requirements.

RUSI's 2024 paper on the UK's voluntary cyber frameworks found that NCSC's Cyber Essentials scheme, the predecessor model for the Pledge's supply-chain requirement, had a renewal rate above 85% among existing certified suppliers but a first-time adoption rate below 12% among uncertified SME suppliers to government.

Counter-view: DSIT economists and researchers at the Cambridge Centre for Digital Innovation argue that the adverse-selection critique understates the Pledge's function as a market-signalling instrument.

On this reading, the Pledge's purpose is not to change behaviour in the first cohort of signatories but to create an auditable board-level commitment that procurement Teams at large NHS trusts and government departments can use as a screening criterion in supplier due-diligence, shifting the incentive to the buyer side of the market.

Key tension: Whether the Pledge's board-level cyber lead requirement can be operationalised in organisations with fewer than 50 employees, where the typical NHS tier-3 supplier operates, or whether it functions only as a compliance signal for mid-market and enterprise suppliers who can absorb the governance overhead.

Sources:GOV.UK (Department for Science, Innovation and Technology)·GOV.UK (Department for Science, Innovation and Technology)·GOV.UK (Department for Science, Innovation and Technology)

Mentions:DSIT →NCSC →Cyber Security and Resilience Bill →NIS2 →Parliament →Germany →GOV.UK →RUSI →Cambridge →Cyber Essentials →Early Warning →NHS →Cyber Resilience Pledge →Royal Assent →

First Reported In

Update #5 · GitHub's own code cloned via VS Code add-on

GOV.UK (Department for Science, Innovation and Technology)· 29 May 2026

Read original →

Causes and effects

Caused by

EU CRA guidance; German NIS2 missed

The Cyber Resilience Pledge and £90m funding operate within the regulatory context of the CS&R Bill, aiming to move board-level cyber compliance ahead of the Bill reaching Royal Assent.

Occurred 3 Mar 2026

Read story →

This Event

UK cyber sector clears 14.7bn pounds

The funding and the voluntary Pledge target supply-chain exposure that statute has not yet reached, with no enforcement teeth attached.

Led to

UK cyber bill drops payment regime

DSIT's £14.7 billion UK cyber sector report and Cyber Resilience Pledge provide the commercial context framing the CS&R Bill's passage as paired supply-chain accountability alongside sector strength.

Occurred 10 Jun 2026

Read story →

Different Perspectives

ENISA

ENISA's 22 September threat report found only 23.8 per cent of NoName057(16)'s assessed claims were confirmed by independent availability checks, though the group produced 48 per cent of ideology-driven activity. The agency's numbers show public administration taking 31.8 per cent of attacks, mostly ideological DDoS.

LKA Hamburg

Hamburg's State Criminal Police Office led the operation that took the KillSec leak site on 30 September, with ten countries, Europol and Eurojust. Investigators link the group to around 1,000 suspected attacks, at least 70 in Germany, and the seizure blocks access to at least 110 terabytes of victims' data.

ASOS

ASOS said an unauthorised party reached names and contact details on third-party platforms after obtaining an employee's credentials by impersonating a trusted contact. It said it does not believe payment cards or account passwords were affected, and is investigating.

Check Point

Check Point updated its advisory on 20 September to say its 9.8-rated VPN certificate flaw had been exploited on Spark firewalls since 12 September, five days after the advisory first appeared, and shipped fixes including R81.20 Take 166. It told customers using only pre-shared-key VPN communities they were not exposed.

Japan's National Police Agency

Japan's National Police Agency and National Cybersecurity Office signed advisory AA26-281A and published it on 9 October, naming SoftEther VPN, MicroScan and office-cli and indicators detected since January 2016. Tokyo says the evidence comes from several FBI criminal investigations and that it will deepen cooperation with allies.

CISA

CISA gave federal agencies three days to fix five flaws from 2015 to 2023 on the day the China advisory named Integrity Technology Group, and set the same clock on 34 of 43 September listings. It treats a named state-linked operation as reason enough to patch old software within the week.