SMEs offered 75% discount on cyber security certification

Government launches £2.4m fund to help small businesses fight cyber threats

The government has launched a £2.4m fund offering eligible SMEs a 75% discount on Cyber Essentials certification, alongside expanded supply-chain and software security initiatives. The fund launches amidst warning that UK operational technology has already been targeted.

Thousands of small and medium-sized businesses across the UK will be able to access discounted cybersecurity certification under a new government initiative aimed at protecting organisations from online threats.

The government is offering a 75% discount on its Cyber Essentials certification programme, allowing eligible businesses to obtain certification for as little as £80 and no more than £125, plus VAT.

The initiative, backed by £2.4m in government funding, is intended to help smaller businesses strengthen their digital defences and reduce the financial impact of cyberattacks.

The announcement will be made by Cyber Security Minister Baroness Liz Lloyd in a speech at the National Cyber Security Centre's (NCSC) Annual Review later today.

The new Cyber Essentials First Step Fund will offer eligible micro, small and medium-sized businesses a 75% discount on the cost of obtaining a new certification. The discount will be available to businesses that have not held Cyber Essentials certification within the past four years.

Applications will be handled on a first-come, first-served basis, with the scheme running until March 2027 or until the allocated funding is exhausted. The government estimates that approximately 6,000 businesses could benefit from the initiative.

Recent estimates suggest that a major cyberattack against a UK organisation or business could cost an average of £195,000. Such incidents can drain resources, disrupt operations and divert money away from investment, expansion and job creation.

"We are not going to sit back and let malicious actors take advantage - we will back our SMEs and make them match-fit," Baroness Lloyd said.

She added that the government was making it easier and cheaper for businesses to access expert support, identify vulnerabilities in their systems and achieve Cyber Essentials certification.

Specific warning about AI-driven attacks

Speaking on Radio 4’s Today programme this morning in advance of his speech later today NCSC Chief Executive Richard Horne was direct in his assessment of how we have arrived at this point.

“The technology base that we rely on as a society has not been invested on to the extent it needs to be,” he said. “Many organisations have kind of sweated their assets. They've extended use of systems beyond their end of life. They've not kept them upgraded. They've not kept them in secure compartments, disconnected from the internet, and that leaves a whole load of vulnerabilities that now AI in the hands of our adversaries can enable them to find with ease and exploit.”

Cyber Resilience Pledge

Alongside the discounted certification scheme, the government is expanding its Cyber Resilience Pledge, which has attracted more than 230 organisations from across industry. Companies participating in the pledge will be able to refer groups of smaller businesses within their supply chains for completely free Cyber Essentials certification.

Selected businesses will also receive assistance from cybersecurity advisers, particularly where they have limited in-house expertise to manage digital security risks.

The government hopes the initiative will encourage larger organisations to strengthen the security of their suppliers, helping protect supply chains that support major sectors including banking, food, and essential services.

Software security initiative

The latest announcement also includes an expansion of the government's efforts to improve the security of software used across the UK economy.

Richard Horne hinted this morning that some vulnerabilities in UK operational technology had already been targeted. He finished with a plea to business to take this seriously and consider revising the idea of cybersecurity as a cost centre.

“It's your business. It's your charity. It's your life,“ he said. “You need to make the choice and choose wisely.”

Horne acknowledged this would involve spending money, but that the cost could be far worse if companies hit the snooze button again.

“It might require thinking less of technology as a cost to be minimised and think of it more as something that powers your business and needs to be refreshed and kept as up to date and capable as you can. “

Fourteen organisations have joined the second cohort of the UK's Software Security Ambassadors programme. The new members include Fortinet, Thales, Capgemini, SANS, Zscaler, and Acubed IT Solutions.

They will work alongside the government to promote secure software development and encourage businesses to adopt the Software Security Code of Practice.

Update 14:00: You can see both launch speeches in full here.

Computing says:

Penny Horwood wrote this article last Autumn, and it examined the ethics and practical impact on our collective cybersecurity of the common practice of offshoring cybersecurity – usually to the cheapest bidder based overseas.

We witnessed the impact and cost of this practice in real time last year after a run of cyberattacks that not only cost retailers millions but came dangerously close to damaging the local economy of the West Midlands after JLR halted operations.

That scenario was averted with an emergency loan courtesy of the taxpayer but there was minimal public discussion of the way that private enterprise boosts profits via outsourcing technology operations yet turns to the public in the event of a serious cashflow problem created by a malicious exploitation of those decisions.

To the best of our knowledge, nobody has been held accountable for those decisions. It would be comforting to think that lessons have been learned from last year's events but Richard Horne’s words today suggest that there is still considerable work to do.