UK's Cyber Essentials Scheme Grows, But Most Small Businesses Still Aren't Covered

The UK government's Cyber Essentials certification scheme awarded a record 61,430 certificates between July 2025 and June 2026, a 20% increase on the previous year. Most of these were basic, self-assessed certifications, with a smaller share going through the more rigorous, third-party audited CE+ level. However, nearly three-quarters of this year's total came from businesses renewing existing certificates rather than new organisations joining, and the overall numbers remain small next to the estimated 5.7 million small and medium businesses in the UK.

The update coincides with new research from security vendor ESET, which found that 49% of UK SMEs experienced a cybersecurity incident in the past year, with the average business taking over four weeks to identify and recover from a breach. The report pointed to phishing, unpatched software, weak passwords, and poor monitoring as leading causes, all issues that basic security hygiene frameworks like Cyber Essentials are designed to address.

Industry commentators say the gap between the risks facing small businesses and the precautions they take remains too wide. John Pepper, CEO of Managed 247, said cyber security often competes with the daily pressures of running a business, but warned that smaller firms are not exempt from today's threat landscape. He urged SMEs to focus on fundamentals such as secure configurations, strong access controls, regular software updates, and malware protection as an ongoing part of doing business, rather than a reaction to an incident.