Government · UK · Department for Science, Innovation and Technology (DSIT)
UK cyber sector hits £14.7bn revenue with 2,603 firms
The UK cyber security sector now turns over £14.7 billion across 2,603 firms, with 69,600 staff and a 17% jump in Gross Value Added. The market is still expanding, but workforce growth has slowed to its weakest rate since the time series began in 2018.
Source published Summarised
Read the full report from Department for Science, Innovation and Technology (DSIT)
Key findings at a glance
- £14.7bn Total UK cyber security sector revenue in the most recent financial year, up 11% on £13.2 billion last year. Large firms generate 70% of that total.
- 2,603 Active UK firms providing cyber security products or services. That is 438 new firms (+20%) since the previous study identified 2,165.
- 69,600 Full-time equivalents working in cyber security roles, up 3% (around 2,300 jobs). It is the slowest annual employment growth recorded since 2018.
- £9.1bn Total Gross Value Added by the sector, up 17% on £7.8 billion last year. GVA-to-turnover has improved from 0.59 to 0.62, suggesting rising productivity.
- £131,200 Estimated GVA per cyber security employee, up 13% from £116,200 last year. The sector is moving up the productivity curve quickly.
- +62% Year-on-year growth in UK public sector cyber procurement value, reaching £1.5 billion across 967 contracts in 2025. Since 2019 the total has grown nearly six-fold.
- £8.6bn UK cyber security exports in 2024, up 19% on £7.2 billion in 2023. Cyber now accounts for 67% of total UK security export value (£12.9 billion).
- 46% Share of 2025 cyber investment value going to small firms (10 to 49 staff), up from 17% in 2024. Investor appetite has rotated toward earlier stages.
- £184m Total equity raised by UK dedicated cyber security firms across 47 deals in 2025. That is down 11% on 2024, but the rate of decline has softened.
- 33% Share of UK cyber security office locations based in London. Just over half (51%) of office locations sit outside London and the South East combined.
- 414 UK-headquartered dedicated cyber security firms with a physical presence in international markets. The US and EU/EEA tie at 62% as the top trading regions.
- 27 Average cyber security team size in 2025, down from 31 the previous year and from 204 to 180 in large enterprises. Lean teams are doing more.
What the report covers
The 2026 Cyber Security Sectoral Analysis is the eighth instalment in DSIT's annual study of the UK cyber security industry, published on 12 May 2026 and delivered by Ipsos with Perspective Economics. The study covers 2,603 active firms supplying cyber security products or services and triangulates Companies House data, Beauhurst investment records, an Ipsos survey of 230 cyber businesses run from July to October 2025, and over 25 industry and investor consultations.
Headline numbers show a sector that is still expanding on revenue (£14.7bn, +11%), firm count (+20%) and Gross Value Added (£9.1bn, +17%), but with employment growth slowing sharply to 3%, the lowest annual rate since 2018. Investment activity has rotated downward, with 46% of 2025 value landing in small firms (up from 17% in 2024). Public sector demand has strengthened materially, with cyber procurement contract value up 62% year on year to £1.5 billion.
This year's report also delivers the first proper update to the AI-in-cyber section that was introduced in 2025. AI now features in virtually every investor pitch and is functioning as both a product layer (AI-powered detection, automation, pen testing) and a separate buyer concern (securing AI workloads and agentic systems). It sits alongside the UK AI sectoral analysis as the two main industrial scoreboards for the UK's frontier-tech economy.
What this means for UK marketers
Three operational reads for UK B2B marketers and ecommerce operators selling to, or adjacent to, the cyber security sector.
The addressable market has widened, but pitch quality matters more. 438 new UK cyber firms appeared in 12 months, and the bulk of 2025 investment is now flowing to small (10-49 staff) and micro (1-9 staff) companies. That is good news for any UK B2B marketing programme selling visibility, lead generation or website work to growth-stage cyber clients: the prospect pool is bigger and weighted toward firms still figuring out their go-to-market. The risk is generic positioning. Investors quoted in the report flag that "every single company has some sort of AI story" and they actively interrogate whether the claim is real. Marketers should help cyber clients lead with specific capability evidence (case data, deployment metrics, certification scope) rather than category language. Generic "AI-powered cyber" copy is now the noise floor, not the differentiator.
Regulation is the timing trigger, not the AI cycle. The report finds that cyber buyers act on contractual or regulatory deadlines far more than intrinsic motivation, with one operator estimating that 90% of inbound demand is driven by "I need this for a government contract" rather than risk awareness. For UK B2B marketers, that means treating Cyber Security and Resilience Bill milestones, NIS2 transposition deadlines and procurement framework refreshes as campaign-timing events. Cyber Essentials, the UK government-backed baseline scheme, is a useful tripwire to track: when it becomes contractually mandatory for a new buyer cohort (the report cites legal aid contracts as the most recent example), demand spikes within weeks. The same logic applies to ecommerce brands. The M&S and Jaguar Land Rover breaches in 2025, plus the CrowdStrike incident, have raised buyer expectations around trust signals, so visible security messaging on UK consumer sites is no longer optional.
Public procurement is now a major buyer. Public sector cyber contract value grew 62% in 2025 to £1.5 billion and has multiplied nearly six-fold since 2019. For agencies, SaaS marketers and fintechs serving the cyber vertical, that is a structural shift in where deal value sits. Marketing content that explicitly addresses public sector procurement requirements (CCS frameworks, G-Cloud, Cyber Essentials Plus, Crown Commercial Service language) is higher-intent than generic enterprise messaging. SEO programmes serving cyber clients should prioritise procurement-aligned terms over broad-match category keywords. Two emerging themes deserve their own content tracks: AI security (agentic risk, AI workload protection, model red-teaming) and post-quantum cryptography, where NCSC's migration guidance is now driving budget conversations at critical national infrastructure operators. London still hosts 33% of office locations and 56% of 2025 investment value, but exports (£8.6 billion, up 19%) are growing faster than the domestic market, so regional and international ICP layers matter more than they did two years ago.
How they got the data
The study runs as an annual time series since 2018 with a consistent methodology. Firm identification combines Companies House records with Perspective Economics web-data classification against a published cyber security taxonomy. Revenue, employment and Gross Value Added figures rely on the most recent financial year of company accounts (typically 2024/25), with revenue-per-employee modelling used where company-level data is incomplete. The 230-firm Ipsos survey ran from July to October 2025 and gives a sampling margin of error of c.4 to 6 percentage points depending on the metric. Investment data comes from Beauhurst, covering full-year 2025 activity.
This year's methodology refinements include expanded AI and software security identification, an update to UK company size thresholds and a broader set of web-data sources via the Perspective Economics research team. The full report is available as an HTML version on gov.uk alongside a 79-page PDF, and builds on the eight prior editions beginning with the 2018 baseline.
Government · UK
Read the full report
From Department for Science, Innovation and Technology (DSIT) · published 12/05/2026