Inside the UK's £14.7bn Cybersecurity Boom and Why Its Startups Can't Scale

 

The UK cyber security sector generated £14.7 billion in revenue in the year to the government's latest count, up 11% on the £13.2 billion recorded the year before (DSIT, Cyber Security Sectoral Analysis 2026). That headline sits alongside a second, less flattering number: only nine cyber security scaleups exist in the country's startup pipeline, despite a 252% surge in new company formation (Wavestone, 2026 UK Cybersecurity Startup Radar). The UK is producing cyber security founders faster than ever. It is not yet producing cyber security companies that grow.

That gap between formation and growth is the real story of the sector right now, and it matters well beyond cyber specifically. It's a live case study in what happens when a market gets genuinely hot record firm creation, rising government spend, a widening AI-driven product wave while early-stage capital stays thin.

UK cyber security sector hits £14.7bn, but the growth is uneven

The UK now has 2,603 active cyber security firms, up 20% on the 2,165 recorded a year earlier, according to DSIT's annual sectoral analysis, published 12 May 2026. Total Gross Value Added for the sector reached roughly £9.1 billion, a 17% jump, and GVA per employee rose from £116,200 to £131,200.

Employment tells a different story. The sector added around 2,300 jobs to reach 69,600 full-time roles, a 3% rise that DSIT flags as the slowest employment growth recorded since the study began in 2018. Revenue and value creation are accelerating faster than headcount, a pattern consistent with a sector where AI tooling and automation are doing more of the work per employee.

Most of that revenue concentrates at the top. Large firms 240 of them, or roughly 9% of the market by count — generated £10.4 billion between them, around 70% of total sector revenue, while employing 43,310 people, according to analysis of the DSIT data by ICAEW. The remaining 77% of firms, mostly micro and small businesses, split the other 30%.

Public money is flowing in too. Government procurement awarded 967 cyber security contracts worth £1.5 billion in 2025, a 62% jump in value on 2024 and a sixfold increase since 2019.

A record year for new startups, a bad year for scaling them

New cyber security company formation rose 252% in 2026, from 44 startups identified the year before to 155, according to Wavestone's 2026 UK Cybersecurity Startup Radar, which tracked 235 UK organisations across startups, scaleups and unicorns. The number of scaleups in that same tracked population stayed flat at nine.

Geography has shifted alongside the surge. More than 86% of the newly identified startups 134 of 155 — were based outside London, up from 52% (23 of 44) the year before. Cyber security company formation is spreading into regional clusters rather than concentrating in the capital, a pattern DSIT's own data echoes: greater London and the South East still account for an estimated 72% of registered-office employment, but the founder population is clearly moving.

"UK cybersecurity innovation is growing at record pace and increasingly outside of London," said Florian Pouchet, Partner and Head of Cybersecurity and Operational Resilience at Wavestone. "However, founders are struggling to identify prospects, and scaling remains rare, while growth capital continues to contract. If the UK wants to become a sovereign cybersecurity force, the domestic market needs to back the companies it is successfully producing."

AI adoption inside the products themselves has moved just as fast. Wavestone found that 62% of the tracked organisations now build AI into their offerings, up from 30% in 2025 a shift DSIT's own AI-focused chapter corroborates, identifying 111 UK firms offering AI-specific cyber security products or services, 32 of them focused exclusively on AI.

Where the funding gap actually bites

UK-dedicated cyber security firms raised £184 million across 47 deals in 2025, according to DSIT's sectoral analysis a modest figure set against a sector already generating £14.7 billion in annual revenue. Wavestone's founder survey adds texture to that number: funding below £2.5 million increased, with the sharpest growth in rounds under £100,000, while cheques above that threshold kept shrinking from an already low base.

That distribution matters because it's the larger rounds that typically carry a company from early product-market fit into sustained sales expansion and hiring. A market generating plenty of very small cheques but few larger ones can keep producing startups without producing scaleups, which is close to exactly what the data shows.

Founders themselves point to demand, not just capital, as the bottleneck. Some 38% of respondents in Wavestone's survey named finding prospects as their single biggest challenge, ahead of product development or technical execution. Meanwhile 67% of the organisations surveyed said they were already selling outside the UK, suggesting many founders are chasing larger addressable markets abroad rather than waiting for the domestic buyer base to mature.

The rounds getting done in 2026

Money hasn't disappeared from UK cyber security. It has concentrated in specific categories: identity, AI-native detection, supply chain and encryption. Leeds-based Cytix raised a €6 million Series A in August 2026, led by Northern Gritstone with Auriga Cyber Ventures and Northern Powerhouse Investment Fund II participating, to expand a platform that assesses security risk from rapid, AI-assisted software change. London's RevEng closed a $15 million Series A in May 2026 with Index-connected investors. Quantum-safe encryption specialist Sitehop raised £7.5 million backed by Amadeus Capital Partners, whose broader Amadeus V Technology Fund carries £110 million earmarked for early-stage European deep tech, cybersecurity and quantum among its priorities.

The specialist investor base backing these rounds has itself scaled its 2026 activity. Balderton Capital made 22 UK cybersecurity and enterprise software investments in 2025 and a further 14 in early 2026, while a separate active fund reported 18 investments in 2025 and six more in early 2026. That’s capital chasing a narrower set of themes rather than capital disappearing altogether which lines up with global figures from Crunchbase showing privacy and cybersecurity startups pulled in $10.6 billion worldwide across the first half of 2026, including $4.4 billion in Q2 alone, even as that marked a roughly 30% pullback from the prior quarter.

Government steps in: bill, procurement and SME support

The Cyber Security and Resilience Bill reached the House of Commons report stage in May 2026 and is expected to gain Royal Assent during the 2026–27 parliamentary session, having been introduced in November 2025. The bill will extend stricter incident-reporting obligations further down supply chains, meaning even businesses never directly regulated will feel pressure through customer contracts and supplier questionnaires.

That pressure has a clear trigger. The Jaguar Land Rover cyber attack that began in August 2025 was modelled to have caused a £1.9 billion economic impact, the costliest cyber incident in British corporate history, affecting more than 5,000 organisations across the company's supply chain, according to the Cyber Monitoring Centre. The government's own Cyber Security Breaches Survey 2025/26, published in April 2026 and covering 2,112 businesses and 1,085 charities, found that 43% of UK businesses an estimated 612,000 organisations suffered a breach or attack in the past year, while just 5% of businesses overall hold Cyber Essentials certification.

Ministers have committed £90 million specifically to help smaller businesses improve their security, paired with a voluntary Cyber Resilience Pledge asking larger signatories to require Cyber Essentials across their own supply chains. Innovate UK, working with DSIT, is separately funding up to £1.8 million in its Cyber Local 2025–2026 programme to build regional cyber clusters and skills outside London, mirroring the geographic shift Wavestone's founder data already shows happening organically.

What it means for founders building in cyber

For founders, the current UK cyber security market rewards a specific kind of positioning: identity and AI-native detection tools that regulated buyers with long procurement cycles are already budgeting for, sold with at least one eye on international markets from day one. The domestic scaleup path remains narrow while cheques above £2.5 million stay scarce, so a startup planning to raise its way through UK-only growth capital should treat that as the harder route, not the default one.

The regulatory calendar gives founders a genuine tailwind to build around. The Cyber Security and Resilience Bill, the £1.5 billion procurement pipeline, and the incoming ransomware payment restrictions are all pushing mid-market and enterprise buyers toward compliance spend on a fixed timetable which is exactly the kind of forced-budget demand that early-stage security vendors can sell into now, ahead of the rush.

FAQ

1. How big is the UK cyber security sector in 2026? 

The UK cyber security sector generated £14.7 billion in revenue in 2026, up 11% on the previous year, across 2,603 active firms employing 69,600 people full-time, according to DSIT's Cyber Security Sectoral Analysis 2026.

2. Why are UK cyber security startups struggling to scale? 

Startups are struggling to scale mainly because larger funding rounds have shrunk. UK-dedicated cyber firms raised just £184 million across 47 deals in 2025, and growth in investment concentrated in rounds under £2.5 million rather than the larger cheques that fund expansion.

3. What is the Cyber Security and Resilience Bill? 

The Cyber Security and Resilience Bill is UK legislation that extends stricter incident-reporting duties across supply chains. It reached Commons report stage in May 2026 and is expected to gain Royal Assent in the 2026–27 parliamentary session.

Sources: Department for Science, Innovation and Technology, Cyber Security Sectoral Analysis 2026 (published 12 May 2026); DSIT/Home Office Cyber Security Breaches Survey 2025/26 (April 2026); Wavestone, 2026 UK Cybersecurity Startup Radar, via SecurityBrief UK (21 July 2026); ICAEW cyber security industry profile; Cyber Monitoring Centre statement on the Jaguar Land Rover incident; Osborne Clarke UK Regulatory Outlook, May 2026; EU-Startups; Crunchbase News. Figures reflect the most recent available data at the time of writing.

The EP+ Editorial Desk covers UK startups, founder stories, and venture capital. All editorial content is independently produced and human-reviewed before publication.