Cyber Essentials Statistics
Certificates issued, July 2023 to March 2026

Cyber Essentials uptake is higher than a simple comparison with the full UK business population would suggest. The UK has around 5.5 million private sector businesses, but only about 1.4 million have employees and form the basis of analysis here. Against that base, the rolling-year total of 44,472 certificates represents 3.14% of businesses with employees. A comparison with all 5.5 million businesses would imply uptake below 1%.

This is an estimate rather than a precise share of organisations, since the source counts certificates and one organisation may hold several. The remaining gap is concentrated among smaller employers, with uptake of 7.11% among small businesses and 1.37% among micro businesses.

Cyber Essentials sits within a wider effort to improve cyber resilience across UK supply chains. Survey-based studies, including the DSIT Cyber Security Breaches Survey, record what organisations report about their controls, policies and experiences. They are useful for understanding practice and behaviour, but where they cover Cyber Essentials they ask respondents whether they hold it, rather than counting certificates issued.

This analysis asks a different question: how widely is the scheme being used, and what is driving adoption? It brings together two government-published sources, the quarterly Cyber Essentials management information and the Department for Business and Trade business population estimates, to assess uptake by organisation size. It also looks at the balance between new certificates and renewals, the reasons organisations give for certifying, and the potential role of the Cyber Resilience Pledge in extending adoption through supply chains.

The result is an estimate based on published certificate records rather than self-reported behaviour. It has limits: the source counts certificates rather than unique organisations, and DSIT classifies the series as management information rather than official statistics. It nevertheless gives a more direct view of participation in the scheme.

The gap between retention and reach.

Cyber Essentials has an established base of participants, but coverage remains limited across the wider business population. In the year to March 2026, certificates represented about 50% of large employers, 23% of medium-sized firms, 7.1% of small businesses and 1.4% of micro businesses.

Micro and small businesses make up 96.7% of UK private sector businesses with employees. They account for around 71% of certificates issued, but their coverage remains low. Certificate counts therefore give a misleading impression of broad adoption. The scheme is more established among larger employers than among the businesses that make up most of the economy.

The renewal figures suggest that existing participants are generally staying engaged. Quarterly implied renewal rates range from about 86% to 90%. This is not a cohort retention measure, because the data does not follow the same organisations over time. It is nevertheless consistent with stronger retention among existing participants than first-time adoption. The main constraint appears to be reach, rather than organisations leaving the scheme.

The reasons for certification show a mixture of voluntary demand and commercial pressure. The largest individual reason was giving customers confidence, at 17,360 certificates, or 39.0% of the year to March 2026. Although recorded as voluntary, that category may still reflect market pressure where customers expect suppliers to show basic controls without making certification a formal contractual requirement.

Cyber Essentials Plus represented 32.5% of standard certificates in the rolling quarterly series, but about half of certificates issued to large employers. Larger organisations are therefore more likely both to certify and to buy the additional technical assurance that Plus provides.

The Cyber Resilience Pledge and practical starting points

The Cyber Resilience Pledge provides a potential route from larger organisations to their suppliers. Signatories commit to board-level responsibility for cyber security, joining the NCSC's Early Warning service, auditing Cyber Essentials coverage across their supply chains through the Cyber Essentials Supplier Check Tool, and taking a risk-based approach to requiring Cyber Essentials from suppliers.

The pledge will have the greatest effect if those commitments increase certification among smaller suppliers, rather than reinforcing adoption among large organisations. Future releases of this data can test that. The micro and small business uptake rates above are the main figures to watch.

For organisations starting out, and for sole traders and businesses without employees that sit outside the denominator used here, the NCSC Cyber Action Toolkit is a practical starting point. It offers free, tailored baseline guidance and the NCSC describes it as a pathway towards Cyber Essentials certification. It does not replace certification, but it can help organisations take the first steps.

Conclusion

Cyber Essentials is established in parts of the market, particularly among larger employers, and existing participants show high levels of renewal. It has not yet become normal practice across the wider business population.

CyberSmart is a founding signatory of the Cyber Resilience Pledge.