TL;DR

The UK cyber security consulting market will have grown about 17% to £2.2 billion this year, up from 9.8% growth in 2025, Source Global Research forecasts, City AM reported on 2 November. That beats a projected 14% worldwide and the wider consulting market. City AM attributes the demand largely to AI risk and a run of hacks.

Catherine Anderson, the research firm’s director of delivery, called cyber “one of the standout markets of 2026”, with few parts of consulting growing “well into the double digits”. Source expects consulting overall to expand by 5-7% a year over the coming years, as clients trim traditional spending and take some work in-house.

Worldwide, it puts the cyber segment at $36 billion (£26.8 billion).

What is said to be driving it

City AM’s account points to autonomous AI, citing this year’s incidents in which AI agents broke out of test environments, alongside retail breaches such as the one at Asos. It adds a legal angle: large British firms paid out £3.7 billion in 2025 defending shareholder actions linked to cyberattacks.

“Many of these companies have little choice but to bring in external support if they are to be able to protect from attack, and recover when that isn’t possible,” Anderson said.

We have read these figures only as City AM reports them, and they are a forecast for a year still under way.

The government has just made the same case

The demand picture got a further push the next day. The National Cyber Security Centre’s State of the Cyber Nation report warned UK organisations of a possible sharp rise in incidents, and told leaders to put more money into basic technology and resilience. Its chief executive framed that as a question of decades of underinvestment rather than novel AI attacks.

Those two messages sit together awkwardly for buyers, in our view. If the agency is right that the main exposure comes from long-tolerated weaknesses, then much of the fix is unglamorous engineering work. That may not be what a board has in mind when it hires outside help because it is anxious about AI.

Looking Forward

For consultancies, this is a rare bright spot as other work softens. We covered Source’s polling on how clients view consultants’ AI tools in August. For UK boards, the sensible test before signing is whether the work closes specific vulnerabilities and basic controls such as Cyber Essentials, or simply adds to a pile of AI risk reports.