UK Small Firms Get 75% Off Cyber Essentials as Ministers Step Up the Fight Against Online Attacks
Small firms across the UK have been offered a much cheaper route into formal cyber protection. A new government initiative announced on 3 November 2026 cuts the cost of Cyber Essentials certification by 75% for eligible micro, small and medium sized businesses. That leaves firms paying between £80 and £125 plus VAT, a price point ministers hope will turn a scheme many owners had heard of but never got round to into a normal first step.
The timing is hard to miss. The announcement came during the National Cyber Security Centre's Annual Review, at a moment when AI is changing both attack and defence. According to the government, a serious cyber attack on a UK business or organisation can cost an average of £195,000. For a small firm, that kind of bill can wipe out a year of hard work, damage customer trust, and pull staff away from the work that actually brings money in.
What the discount covers
Cyber Essentials is the government's baseline certification scheme. It asks a business to show it has basic controls in place against common online threats, things like keeping software patched, using secure settings, controlling who can access systems, and guarding against malware. Certification does not claim a business is unhackable. It shows that the fundamentals are in place, and that is often what stops the most common attacks.
Under the new initiative, eligible micro, small and medium sized enterprises get a 75% reduction on certification costs. The resulting price range, £80 to £125 plus VAT, depends on the route a firm takes. The government has framed it as a way to remove cost as an excuse, especially for firms without a dedicated IT team or a cyber budget to speak of.
Cyber Security Minister Baroness Liz Lloyd announced the support during her speech at the NCSC Annual Review. She said small and medium sized enterprises employ millions of people across the country and must not be left exposed to growing digital threats. She also stressed that cyber security should be a priority for businesses of every size, whether staff work from a head office or from home.
Help for firms with no cyber specialist
Price is only half the problem for many small firms. The other half is knowing where to start. The new programme tries to answer that too. Selected businesses will get access to a cyber security adviser who can give practical help through the certification process. That support is aimed squarely at organisations that lack specialist expertise or dedicated cyber security staff.
There is also a supply chain angle. The government is expanding its Cyber Resilience Pledge, which now has more than 230 participating organisations. Companies that have signed the pledge will be able to refer groups of smaller businesses within their supply chains for completely free Cyber Essentials certification. The idea is simple: a large company is only as secure as the small suppliers plugged into its systems, so helping those suppliers helps everyone.
That point matters for sectors such as food, banking and essential services, where a weak link in a supplier can cause disruption far beyond one small firm. The initiative is designed to lift protection across whole supply networks, not just inside individual businesses.
Fourteen firms join the software security drive
Alongside the SME discount, the government announced the second cohort of its Software Security Ambassadors. Fourteen organisations have joined: Fortinet, Thales, Capgemini, SANS, Risk Ledger, Zscaler, Acubed IT Solutions Ltd, CloudPeek, Dot On, Hippo Digital, Investec, IoT M2M Council, Nine23 and QinetiQ.
Their job is to promote secure software development and encourage businesses to adopt the Software Security Code of Practice. That code sets out expectations for software developers and suppliers, with the aim of reducing vulnerabilities that criminals could exploit. Ambassadors will push those standards through their own networks and supply chains, in the hope that better software habits spread faster than any single regulation could manage.
The move reflects a wider shift in thinking. A flaw in one piece of software can now create risk for thousands of firms that use it, so securing software at the source has become a national concern, not just a developer's concern.
A wider package announced in the Budget
The SME discount sits inside a broader programme announced in last week's Budget, aimed at strengthening the UK's ability to respond to cyber threats as AI reshapes the field. The package includes £70 million for a National Exposure and Real-Time Vulnerability Centre, to be based within the NCSC, which will build a national picture of vulnerabilities affecting critical infrastructure and the wider economy.
There is also £60 million for a national Cyber Shield, which will use agentic AI to reinforce the country's cyber defences, including a £25 million Challenge Fund for British AI and cyber security innovators. A new AI Cyber Security Centre of Excellence in Manchester will focus on developing and training the next generation of government specialists in cyber security and AI.
Two further investments complete the picture: £40 million for a National Agentic Security Unit, which will develop capabilities to monitor and respond to uncontrolled bots and improve resilience against incidents involving autonomous AI agents, and £24 million to strengthen public sector cyber security, supporting the deployment of advanced AI technologies to protect essential public services.
Taken together, the government says the combination of cheaper certification for smaller businesses, industry cooperation and investment in advanced capabilities will help build a more resilient digital economy. For small firms, the practical message is much simpler: the cheapest credible first step in cyber protection just got a lot cheaper, and help is available to get through it.
Post Comment