The UK government’s flagship cyber certification scheme hit a record high of 61,430 certificates awarded over the past year, but relatively few businesses overall have signed up.
The newly published figures show a 20% increase in Cyber Essentials (CE) certifications during the period July 2025 to June 2026 versus a year ago.
Of that number, 46,245 were at the basic CE level, which is self-assessed, and 15,185 at CE+, which requires a third-party audit. Nearly three-quarters of the CE figure is related to recertifications rather than new organizations signing up.
The figures are also still a drop in the ocean when compared to the number of SMEs in the UK. Government estimates put the figure at around 5.7 million, or over 99% of the private sector.
Read more on Cyber Essentials: UK Cyber Essentials Certification Numbers Falling Short.
The news comes as new figures from ESET published today revealed that half (49%) of the UK’s SMEs suffered a cybersecurity incident over the past year.
Based on 500 responses, the vendor’s 2026 SMB Cyber Risk Report found that the average respondent took over four weeks to identify and recover from a breach.
It also revealed that most incidents were caused by phishing, unpatched vulnerabilities, weak passwords, and a lack of monitoring – all things that best practice hygiene of the sort advocated by Cyber Essentials should address.
John Pepper, CEO and founder of Managed 247, said there’s still too big a gap between the level of cyber risk facing smaller businesses and the steps many are taking to manage that risk.
“For many SMEs, cyber security competes with the immediate pressures of running and growing a business. But smaller organizations are not operating outside the threat landscape,” he said.
“SMEs should start with the fundamentals: secure configurations, strong access controls, software updates and protection against malware. Good cyber hygiene should be treated as part of running a business, rather than something to address after an incident.”
Will Government Initiatives Change Things?
According to the government, none of the organizations seeking a Cyber Essentials certificate over the past year did so because they were asked to by a customer. However, it wants that to change.
Its voluntary Cyber Resilience Pledge mandates that organizations which sign up must demand CE throughout their supply chains. And the Cyber Security and Resilience Bill currently creates a legal duty for organizations to manage cyber risk in their supply chain, which could persuade more to do the same.
In December 2025, the National Cyber Security Centre (NCSC) published a Cyber Essentials Supply Chain Playbook urging organizations to require certification as a baseline across their supplier base.
“For SMEs, cybersecurity can affect whether they can win and retain business,” said Pepper. “As supply-chain expectations rise, being able to demonstrate that the basics are in place could become an increasingly important part of being a trusted supplier.”
The government claimed that organizations with Cyber Essentials are 92% less likely to make a claim on their cyber insurance.