UK cybersecurity employment is still expanding, but much more slowly than sector revenue. The government's 2026 analysis estimates around 69,589 full-time-equivalent roles across identified cyber-security firms, up about 2,300 from the previous study.
The 3% growth rate was the lowest recorded since the sectoral series began in 2018. At the same time, revenue rose 11% and GVA increased 17%, which means the industry's latest expansion has been more productivity-led than headcount-led.
Product companies are driving the employment increase
The official analysis estimates that product companies employ roughly 27,164 cyber FTEs, around 39% of the sector total. Most of the latest year-on-year employment growth came from that side of the market.
Services and managed-security employment was effectively stable at around 42,400. That does not make the services market unimportant. It remains larger by both employment and revenue, but the marginal growth is increasingly coming from companies that build repeatable products rather than only selling specialist labour.
Smaller teams do not necessarily mean less capability
The study found that the average size of a cybersecurity team fell from 31 to 27 staff, and from 204 to 180 among large enterprises. That could reflect efficiency, organisational restructuring or a shift toward tooling and automation rather than straightforward job destruction.
The rise in GVA per employee to around £131,200 supports the idea that firms are generating more economic value per worker. It is too early, however, to attribute that change specifically to AI or automation without company-level evidence.
The skills bottleneck is becoming more specialised
As the sector matures, demand is likely to concentrate around hard-to-replace capabilities: cloud security architecture, identity, application security, security engineering, incident response, threat research, product development and governance in regulated sectors.
General awareness training remains important across the wider economy, but the commercial cyber sector increasingly competes for engineers and specialists who can build or operate security systems at scale.
Where BBR will take the jobs research next
BBR's next layer should connect the national workforce total to geography and employer type. London and the South East remain major centres, but Scotland, the North West, the South West and other regional clusters matter because universities, defence, financial services and large employers create different talent markets.
The regional cybersecurity piece links those clusters back to the national market, while the leading-company guide provides the employer layer.
| Measure | Latest estimate | What it suggests |
|---|---|---|
| Sector employment | 69,600 FTEs | Large specialist workforce |
| Annual employment growth | 3% | Growth has slowed |
| Product-company employment | 27,164 FTEs | Most recent hiring growth |
| Service/MSSP employment | ~42,400 FTEs | Large but broadly stable |
| GVA per employee | £131,200 | Measured productivity increased |