UK cybersecurity startups surge as scaleups stay rare

Wavestone has identified 155 new cybersecurity startups in the UK in 2026. Its annual survey found only nine scaleups in the sector.

The figures point to a sharp rise in company formation but limited progress from early-stage businesses into larger operations.

The consultancy's 2026 UK Cybersecurity Startup Radar tracked 235 UK organisations across startups, scaleups and unicorns. It portrays a market generating new entrants at speed while struggling to turn that activity into a broader base of scaling businesses.

New company creation rose 252% from 44 startups identified a year earlier to 155 in 2026. Yet the number of scaleups remained at nine, underlining what the report describes as a weak conversion rate between startup formation and later-stage growth.

Regional shift

Much of the expansion came from outside the capital. More than 86% of the newly identified startups, or 134 out of 155, were based beyond London, compared with 52% the previous year, when 23 of 44 new startups were located outside the city.

The shift suggests cybersecurity entrepreneurship is becoming more geographically dispersed across the UK. It also reflects a broader pattern of regional technology clusters taking a larger share of new business formation.

London remains an important centre for the industry, but no longer dominates the flow of new entrants in the same way. A wider spread of startups could broaden access to talent and customers, though it also raises questions about whether local funding and support networks are strong enough to help firms grow.

Funding gap

The report also found a shift in the size of investment rounds. Funding below £2.5 million increased, with the strongest growth in rounds below £100,000, while investment above that level continued to fall from an already low base.

That matters because larger rounds often help young companies move from product development and early sales into sustained expansion. A market with more very small rounds but fewer larger cheques may support company creation without solving the challenge of scaling.

The findings point to a financing gap at the stage when startups need fresh capital to hire, expand sales and enter new markets. In sectors such as cybersecurity, where buyers can include governments and large companies with long procurement cycles, limited access to growth funding can slow the path from concept to meaningful revenue.

Sales pressure

Founders said generating prospects was their biggest challenge. About 38% cited it as the main hurdle ahead, making customer acquisition a more immediate concern than product development or technical execution.

The survey also found that 67% of organisations were already selling outside the UK. That suggests many cybersecurity startups are looking overseas early in their development, either to find larger markets or to offset constraints in domestic demand.

International sales can provide an important route to growth, but they can also stretch small teams still trying to establish themselves at home. Early cross-border expansion often requires extra spending on compliance, hiring and market knowledge, which may be harder if funding remains concentrated at the smallest end of the market.

AI adoption

Another notable shift was the growing use of artificial intelligence in cybersecurity products. The study found that 62% of the organisations now use AI in their offerings, up from 30% in 2025.

The increase shows how quickly AI has moved from a differentiator to a more common feature in the sector. For many startups, it is becoming part of product design rather than a separate line of research, especially in areas such as automation, detection and analysis.

Rising AI use also suggests competition among cybersecurity startups may be harder to sustain through technology claims alone. If most new entrants adopt similar tools, companies may need to stand out through execution, distribution and customer relationships rather than by simply adding AI to products.

Florian Pouchet, Partner and Head of Cybersecurity and Operational Resilience at Wavestone, said: "UK cybersecurity innovation is growing at record pace and increasingly outside of London. However, founders are struggling to identify prospects, and scaling remains rare, while growth capital continues to contract. If the UK wants to become a sovereign cybersecurity force, the domestic market needs to back the companies it is successfully producing."

Overall, the study shows a cybersecurity sector with strong entrepreneurial momentum but a narrow path to maturity. With 235 organisations mapped across the market and only nine scaleups identified, the gap between startup creation and sustained growth remains one of the clearest findings in the data.