Original research, published 15 October 2026
UK Cyber Essentials Uptake Report 2026
Cyber Essentials is the government-backed baseline for cyber security. We compared the official count of certificates issued with the number of UK businesses. Uptake is growing fast, but outside larger firms it is still rare: for every 100 small businesses, about 7 certificates were issued in the last year.
By the ATS Connection team, offices in Arundel and Chichester. How we did it
Headline finding
3.3
Cyber Essentials certificates issued for every 100 UK businesses with employees, July 2025 to June 2026
Sources: DSIT Cyber Essentials management information (to June 2026) and DBT business population estimates 2025.
3.3
Cyber Essentials certificates for every 100 UK employers
1.4
per 100 micro employers
7.4
per 100 small businesses
40%
growth in certificates over two years
Key findings
Cyber Essentials is growing, but most small firms still do not have it.
Cyber Essentials checks five basic controls: firewalls, secure configuration, security updates, user access and malware protection. The figures below compare the certificates issued with the number of UK businesses of each size.
3.3
Only about 3 in every 100 employers
46,245 Cyber Essentials certificates were issued in the year to June 2026, against 1,417,730 UK businesses with employees. That matches the government’s own survey, which found 3% of businesses hold Cyber Essentials.
1.4
Micro businesses have barely started
There were 16,555 certificates for micro businesses, against 1,150,875 micro employers. That is fewer than 2 for every 100.
7.4
About 7 in 100 small businesses
Firms with 10 to 49 staff received 16,237 certificates, against 220,085 businesses. Among medium firms the rate is 23.8 per 100.
+40%
Uptake is growing fast
46,147 certificates were issued in the year to June 2026, up from 32,933 two years earlier. New certificates rose 43%, from 8,690 to 12,402.
39.7%
Customer confidence is now the top reason
18,301 certificates were sought to give customers confidence, up from 31.0% of certificates two years earlier. Contracts that require it account for 23.9%.
73%
Most certificates are renewals
33,745 of the 46,147 certificates in the latest year were recertifications. Once a business has Cyber Essentials, it tends to keep it.
Why it matters
The basics stop the most common attacks
The National Cyber Security Centre describes Cyber Essentials as the minimum standard of cyber security recommended by the Government for organisations of all sizes, built around five controls designed to prevent the most common internet-based threats. It also notes that a growing number of organisations require suppliers to be certified to bid for work.
The NCSC’s 2025 annual review cites insurance data showing that organisations with Cyber Essentials are 92% less likely to make a claim on their cyber insurance. Yet the government’s Cyber Security Breaches Survey 2025 found that only 12% of businesses were aware of the scheme, and 3% held it.
Our guide to what Cyber Essentials costs sets out the fees by business size and what affects the total.
The findings in detail
Who holds Cyber Essentials, and why.
All figures cover the UK. Hover or tap a bar for the underlying numbers.
Cyber Essentials certificates per 100 businesses, by size
Certificates issued July 2025 to June 2026, against UK private sector businesses with employees at the start of 2025
View the data as a table
| Size | Cyber Essentials certificates | Of which Plus | Businesses | Per 100 businesses |
|---|---|---|---|---|
| Micro (up to 9 staff) | 16,555 | 4,555 | 1,150,875 | 1.4 |
| Small (10 to 49) | 16,237 | 4,801 | 220,085 | 7.4 |
| Medium (50 to 249) | 9,151 | 3,679 | 38,435 | 23.8 |
| Large (250 or more) | 4,302 | 2,150 | 8,335 | 51.6 |
Certificates are not the same as organisations: a large organisation can hold more than one, and certificates also go to charities and public bodies. Treat the large-firm figure in particular as an upper bound.
Certificates issued each year
Cyber Essentials certificates, years to June
View the data as a table
| Quarter | Certificates | New | Renewals | Plus |
|---|---|---|---|---|
| Jul to Sep 2023 | 7,314 | 2,009 | 5,305 | 2,074 |
| Oct to Dec 2023 | 8,390 | 2,132 | 6,258 | 2,830 |
| Jan to Mar 2024 | 8,545 | 2,237 | 6,308 | 2,986 |
| Apr to Jun 2024 | 8,684 | 2,312 | 6,372 | 2,623 |
| Jul to Sep 2024 | 8,762 | 2,172 | 6,590 | 2,660 |
| Oct to Dec 2024 | 9,790 | 2,446 | 7,344 | 3,388 |
| Jan to Mar 2025 | 10,064 | 2,507 | 7,557 | 3,273 |
| Apr to Jun 2025 | 9,967 | 2,470 | 7,497 | 3,142 |
| Jul to Sep 2025 | 10,786 | 3,037 | 7,749 | 3,254 |
| Oct to Dec 2025 | 11,383 | 2,907 | 8,476 | 4,008 |
| Jan to Mar 2026 | 12,336 | 3,271 | 9,065 | 4,036 |
| Apr to Jun 2026 | 11,642 | 3,187 | 8,455 | 3,857 |
Every Cyber Essentials Plus certificate also comes with a Cyber Essentials certificate, so Plus is included in these totals. Quarterly figures for the latest year add up to 46,147, slightly below the running total of 46,245, because some certificates are issued retrospectively.
Why businesses get certified
Main reason given, Cyber Essentials certificates, July 2025 to June 2026
View the data as a table
| Reason | Certificates | Share |
|---|---|---|
| To give confidence to our customers | 18,301 | 39.7% |
| To generally improve our security | 13,765 | 29.8% |
| Required for a commercial contract | 5,736 | 12.4% |
| Required for a government contract | 5,291 | 11.5% |
| Required by a regulatory body | 1,347 | 2.9% |
| Required by an insurer | 894 | 1.9% |
| Other | 628 | 1.4% |
| Required for a grant | 185 | 0.4% |
Reasons are collected for Cyber Essentials only, not Plus.
Getting certified
Four steps to Cyber Essentials
Common sticking points include missing updates, unsupported software and accounts without multi-factor authentication. This is the order we work through with clients.
01
Check your scope
Decide which devices, cloud services and users are in scope. For most small businesses that is everything.
02
Close the gaps
Turn on MFA for cloud services, remove unsupported software, apply updates within 14 days and tidy admin accounts.
03
Answer the questionnaire
Complete the self-assessment honestly. A certification body reviews it and may ask questions.
04
Keep it current
Certificates last 12 months. Most of the work is done once, and renewing is usually quicker.
Methodology
How we did the research
This study uses published government data only. We did not search or collect details of individual certified organisations, and we do not name any organisation.
Using this research. You are welcome to quote or chart these figures. Please credit ATS Connection and link to this page, and cite the underlying government sources.
ATS Connection (2026), UK Cyber Essentials Uptake Report 2026. Published 15 October 2026. https://atsconnection.co.uk/research/cyber-essentials-uptake/
Data sources
- Certificates: Cyber Essentials management information from the Department for Science, Innovation and Technology, covering July 2023 to June 2026 and supplied by IASME. These are management information, not official statistics.
- Businesses: Business population estimates 2025 from the Department for Business and Trade: UK private sector businesses at the start of 2025, by number of employees.
- Awareness and holding: the Cyber Security Breaches Survey 2025.
How we calculated the rates
For each size band we divided the Cyber Essentials certificates issued in the 12 months to June 2026 by the number of businesses in that band. For the overall rate we used all 1,417,730 businesses with employees. Micro businesses with no employees (4,272,535) are left out of the rates.
Limitations
- The certificate figures count certificates, not organisations. Some organisations hold more than one, and certificates also go to charities and public bodies, which are not in the business count. The rates are therefore an upper bound on the share of businesses certified.
- The size bands in the two sources are close but not identical. The certificate data defines micro as up to 10 staff.
- The certificate data is not broken down below UK level, so we cannot report results for Sussex or other areas.
Contains public sector information licensed under the Open Government Licence v3.0.
Free Confidential Senior engineer 30 minutes
Get Cyber Essentials
without the guesswork
A free, confidential readiness review with one of our senior engineers, from our offices in Arundel and Chichester. We check your devices, cloud services and accounts against the five controls and tell you exactly what to fix before you apply.
Cyber Essentials readiness review
- Your current position against all five Cyber Essentials controls
- The specific gaps that would fail the assessment
- A clear quote for the fixes and the certification
- Help with Cyber Essentials Plus when you need it
Cyber Essentials Certified
Microsoft Partner
If it is urgent, call us on 01903 255 159.
FAQ
Cyber Essentials uptake: common questions
Straight answers about Cyber Essentials and what these figures mean for your business.
What is Cyber Essentials?
Cyber Essentials is a government-backed certification that shows an organisation has five basic security controls in place: firewalls, secure configuration, security update management, user access control and malware protection. Cyber Essentials Plus adds an independent technical audit.
How many UK businesses have Cyber Essentials?
About 3 in every 100. In the year to June 2026, 46,245 Cyber Essentials certificates were issued, against 1,417,730 UK businesses with employees. The Cyber Security Breaches Survey 2025 also found that 3% of businesses held it.
Is Cyber Essentials mandatory?
Not for most businesses. The NCSC says a growing number of organisations require suppliers to be certified to bid for work, and contracts are among the main reasons businesses give for getting certified.
How much does Cyber Essentials cost?
The certification fee depends on the size of the organisation. Our Cyber Essentials cost guide sets out current fees and what affects the total, including any fixes needed before you apply.
What is the difference between Cyber Essentials and Cyber Essentials Plus?
Cyber Essentials is a verified self-assessment. Cyber Essentials Plus covers the same controls but adds hands-on technical testing by the certification body. You need Cyber Essentials before you can get Plus.
Can you show figures for Sussex?
Not from official data. The government certificate figures are not broken down below UK level, so we have not published local estimates.
Can I use these figures?
Yes. You are welcome to quote or chart the findings. Please credit ATS Connection, link to this page and cite the government sources listed in the methodology.
Next steps
Tools and guides
Cyber Essentials certification
Readiness review, fixes and submission for Cyber Essentials and Cyber Essentials Plus, from a provider certified itself.
See the service: Cyber Essentials certificationCyber Essentials cost in 2026
What you will pay by business size, what is included and how to pass first time.
Read the guide: Cyber Essentials cost in 2026Free DMARC and SPF checker
Test your email domain in seconds and see whether it can be spoofed, with a plain-English fix list.
Check your domain: Free DMARC and SPF checkerSussex Business Email Security Report
Our study of 1,924 Sussex businesses and charities: 71.9% do not enforce DMARC.
Read the report: Sussex Business Email Security ReportCare and Health Provider Email Security Report
Our study of 10,774 CQC-registered providers: 83.4% do not enforce DMARC.
Read the report: Care and Health Provider Email Security ReportUK Law Firm Email Security Report
Our study of 1,307 law firms: 59.6% do not enforce DMARC.
Read the report: UK Law Firm Email Security Report
