Cyber Essentials Statistics
Certificates issued, July 2023 to June 2026

Cyber Essentials is more widely used than a comparison with every UK business would suggest. The UK has about 5.5 million private sector businesses, but only about 1.4 million of them have employees, and those are the businesses this page compares against. On that basis, the 46,245 certificates issued in the year to June 2026 cover 3.26% of businesses with employees. Measured against all 5.5 million businesses, the figure would be under 1%.

This is an estimate, not an exact count of certified organisations. The data counts certificates, and one organisation can hold several. The gap is largest among smaller firms: 7.38% of small businesses and 1.44% of micro businesses hold a certificate.

Cyber Essentials is one part of a wider effort to make UK supply chains more resilient. Surveys such as the DSIT Cyber Security Breaches Survey ask organisations what controls they have in place and what has happened to them. They are useful, but on Cyber Essentials they ask people whether they hold a certificate rather than counting the certificates issued.

This page asks a different question: how widely is the scheme used, and what drives organisations to certify? It combines two government sources, the quarterly Cyber Essentials figures and the Department for Business and Trade's count of UK businesses, to estimate uptake by organisation size. It also looks at renewals against new certificates, the reasons organisations give, and what the Cyber Resilience Pledge might do to extend the scheme through supply chains.

The result rests on certificate records rather than on what organisations say about themselves. It has limits. The data counts certificates rather than organisations, and DSIT classes it as management information rather than official statistics. Even so, it gives a more direct view of who is taking part.

Cyber Essentials has a settled base of organisations that renew reliably, but it still reaches only a small part of the wider economy. In the year to June 2026, about 52% of large employers held a certificate, along with 24% of medium-sized firms, 7.4% of small firms and 1.4% of micro firms.

Micro and small businesses make up 96.7% of UK businesses with employees. They take about 71% of certificates, yet only a small share of them are certified. Certificate counts alone therefore give a misleading picture of how far the scheme has spread. It is far better established among large employers than among the firms that make up most of the economy.

The renewal figures suggest that organisations that join tend to stay. Quarterly implied renewal rates have ranged from about 85% to 90%. The latest quarter, April to June 2026, is the lowest at 85%. One quarter does not make a trend, but it is the figure to watch in the next release. This is not a true retention measure, because the data does not follow the same organisations from one year to the next. Even so, it points to a scheme that keeps the organisations it has, and whose main limit is reach.

The reasons given show a mix of choice and pressure. The single largest reason was to give customers confidence: 18,301 certificates, or 39.7% of the four quarters to June 2026. That is recorded as a voluntary reason, but it may still reflect customers expecting suppliers to show basic controls without writing it into a contract.

Cyber Essentials Plus made up 32.8% of certificates in the year to June 2026. Among large employers that certified, about half went on to Plus. Larger organisations are more likely to certify, and more likely to pay for the extra technical check that Plus adds.

The Cyber Resilience Pledge and practical starting points

The Cyber Resilience Pledge offers a route from large organisations to their suppliers. Signatories commit to board-level responsibility for cyber security, to joining the NCSC's Early Warning service, to checking Cyber Essentials coverage across their supply chains with the Cyber Essentials Supplier Check Tool, and to requiring Cyber Essentials from suppliers where the risk warrants it.

The pledge will do most good if those commitments raise certification among smaller suppliers, rather than adding to adoption among large organisations. Future releases of this data can test that. The micro and small business uptake rates above are the figures to watch.

For organisations starting out, and for sole traders and businesses without employees who fall outside the comparison used here, the NCSC Cyber Action Toolkit is a practical first step. It gives free, tailored baseline guidance, and the NCSC describes it as a pathway towards Cyber Essentials. It does not replace certification, but it helps organisations take the first steps.

Conclusion

Cyber Essentials is well established in parts of the market, above all among large employers, and organisations that hold it tend to renew. It has not yet become normal practice across the wider business population.

CyberSmart is a founding signatory of the Cyber Resilience Pledge.