Buy Ninety Days Of Security Leadership First.

The Government put £2.4m behind Cyber Essentials on 3 November 2026. Under the First Step Fund, an eligible micro, small or medium sized UK business that has not certified in the last four years takes 75% off a new certificate, bringing it to between £80 and £125 plus VAT. The money runs to March 2027 or until it is gone, whichever comes first, and the Government says approximately 6,000 new businesses could benefit. For a founder who has been quoting certification as a line item in a bid, the arithmetic has changed. What has not changed is the harder number underneath it. The certificate costs between £80 and £125. The person who can answer for it twelve months later does not.

Situation

Two announcements landed on the same day and they belong together. The first is the funding: the Department for Digital, Culture, Media and Sport published the Cyber Essentials funding package on 3 November 2026. It has two parts. The First Step Fund carries £2.4m and gives eligible micro, small and medium sized businesses 75% off a new Cyber Essentials certificate, first come first served, where they have not held one in the last four years. IASME is the Government's delivery partner for the Cyber Essentials scheme. A separate grant worth up to £7m to March 2029 fully funds certification for selected suppliers of organisations that sign the Cyber Resilience Pledge, with support from an NCSC assured Cyber Advisor. The Government says approximately 8,000 businesses could benefit from that second route.

The second is volume. The NCSC Annual Review 2026, published the same day, records 47,661 Cyber Essentials certifications for September 2025 to August 2026, which it states is up 19.6%, and 15,646 Cyber Essentials Plus, up 21.5%. Certification bodies grew 10.4% to 444. The same page carries a ten year calendar table on a different counting basis, so we quote the NCSC figure on its own terms.

Read together, those two facts say something specific about this market. Certification is becoming cheaper and more common at once, which is the signature of a requirement moving from differentiator to baseline. A supplier who holds the certificate in 2027 will not stand out. One who does not will be explaining why.

Set against that, the Cyber Security Breaches Survey 2025/2026, published by DSIT and the Home Office on 30 April 2026, puts self reported adherence at 5% of UK businesses overall, up from 3% the previous year, with 12% of small businesses and 35% of large ones. Around one in five businesses, 18%, did not know whether they adhered to Cyber Essentials, Cyber Essentials Plus or ISO 27001, despite the respondent being the person their organisation identified as most responsible for cyber security. These are reported positions, not a count of certificates. The same survey finds 41% of small businesses carried out a cyber security risk assessment in the previous year, down from 48%, and 44% had a business continuity plan covering cyber security, down from 53%. Practice is thinning while the certificate count rises.

Insight

The funding removes the price of the certificate, not the price of the thing it is supposed to stand for.

Cyber Essentials is a twelve month self assessment, assessed against five technical control areas, and the question set requires the answers to be approved by a board level representative, a business owner or the equivalent. The assessment is a point in time statement. The commercial value is not the PDF. It is that someone can stand behind what the PDF says on any day of those twelve months: the day an enterprise buyer sends a 200 line security questionnaire, the day an underwriter asks what changed since the last renewal, the day a diligence team asks who approved the exception.

The Breaches Survey is unusually direct about who that person is. In small businesses the most common respondent on cyber security was a general office manager, at 26%, then another senior manager at 18% and the chief executive at 14%. In micro businesses it was the chief executive at 22%, another senior manager at 18% and the owner at 16%, with only 3% answering through someone in an IT role. DSIT is careful to say these are the job titles of survey respondents rather than a definitive map of accountability, and we repeat that caution. The pattern is still hard to misread. At this size, security is usually owned by somebody whose actual job is something else.

That arrangement passes a certification. It does not survive a procurement cycle. An office manager can complete a self assessment questionnaire, but cannot defend a compensating control to a prospective customer's security architect, and should not be asked to. The gap between those two tasks is where deals slow down, and a funded certificate does not close it.

So the question this quarter is not whether to take the discount. It is what to buy with the money it freed up.

What a funded certificate buys, and what it does not. Ninety days of fractional security leadership, contracted against five outputs, produces the evidence set, the answer set and the specification for the person who owns it next.

Options

There are four, and most companies of 20 to 200 people end up in one by default rather than by decision.

Certify and carry on. Take the First Step Fund, complete the self assessment, add the badge to the website and the bid library. Cost is £80 to £125 plus VAT and internal time. This buys entry past the filters that ask only for the certificate, and nothing past the filters that ask follow up questions, which is most enterprise filters and all investor ones.

Hire a security leader. ITJobsWatch records a UK median advertised salary of £100,000 for Chief Information Security Officer roles in the six months to 10 November 2026, down 15.11% on the year. That median rests on five quoted salaries drawn from eleven permanent advertisements, so treat it as indicative of order rather than precision. Add employer costs, recruitment, and the two or three quarters, on our estimate, before the hire produces anything a buyer can read. Where no security programme exists yet, the first year of that hire goes largely on tool selection and policy drafting, which is an expensive way to produce documents.

Buy fractional security leadership. A named, experienced security leader on a defined term and scope, typically one to three days a month, accountable for a specific set of outputs rather than for being available. It is the option most often bought badly, as an open ended retainer rather than a programme with an end.

Give it to the IT provider. The Breaches Survey finds external consultants or IT providers are the most common source of cyber security advice, cited by 39% of small businesses and 51% of medium ones, against 27% of businesses overall. This works for the controls. It works poorly for the evidence, because an IT provider is a party to the arrangement being assured and cannot credibly attest to its own configuration.

Trade-offs

Judge these on four things: cost, how quickly they produce something a buyer can read, how well that survives questioning, and how cleanly you can stop.

Certify and carry on is cheapest and fastest and fails the third test immediately. It is the right single move only if your buyers stop at the badge. Look at the last three security reviews your sales team was sent and count how many questions sat outside the five Cyber Essentials control areas.

The full time hire is strongest on the third and fourth tests and weakest on the first two. It is the correct answer eventually and rarely the correct answer first, because you are asking a candidate to join a company with no programme, no budget line and no peer, and the people who accept that brief are not usually the people you wanted.

Fractional leadership is strong on cost and speed and depends entirely on contracting for the other two. Bought as an outcome, with named deliverables and a stop date, it produces an evidence set and a successor specification in a quarter. Bought as an open monthly retainer, it becomes a standing cost nobody can justify or cancel, and the knowledge leaves with the invoice.

The IT provider route is cheap and quick and fails on independence. Keep it for delivery, not for attestation.

One trade-off cuts across all four. The First Step Fund excludes any business that certified in the last four years, and it is first come, first served against £2.4m. A company that spends two quarters deciding may find the decision made for it.

Recommendation

Buy ninety days of fractional security leadership before you buy anything else, and spend the funded certificate inside that window rather than ahead of it.

Ninety days is long enough to produce evidence and short enough that nobody pretends the arrangement is permanent. Contract it against five outputs and nothing else:

1. A control baseline and a gap list. Where the five Cyber Essentials control areas stand today, what is missing, and what each gap costs to close. Not a maturity score.
2. The evidence set. An asset inventory, an access review, a patching record, a backup test result and an incident response plan, in a form a customer's security reviewer can read without a meeting. The Breaches Survey finds 32% of businesses overall meet its incident management step, and formal policies among small businesses down to 52% from 59%, so at this size this is build rather than retrieve.
3. The answer set. Your last three enterprise security questionnaires, answered and kept, so the fourth one takes days rather than a quarter.
4. The certification decision. Cyber Essentials under the First Step Fund, and whether your pipeline justifies Cyber Essentials Plus or ISO 27001 next, with the named buyers who are asking.
5. The successor specification. A written definition of the role that owns this afterwards, at what seniority, at what cost, and on what date. That specification is the deliverable that decides whether you hire.

Then stop, and decide with evidence in hand whether to extend, to hire or to run it internally.

Why

Because it puts the cheap, reversible decision before the expensive, irreversible one, and because the market has just told you what the cheap part is worth.

When the NCSC reports certification volumes up 19.6% on its own annual basis and the Government funds thousands more certificates, the certificate stops being a signal and becomes a threshold. Thresholds are worth clearing quickly and at the lowest price available, which is what the First Step Fund makes possible. They are not worth building a strategy around. What differentiates a supplier once everybody holds the badge is the speed and quality of the answer behind it, which is a function of whether someone owns the programme.

It also matches how the money behaves. A founder can approve ninety days of specialist time against a named pipeline risk. The same founder cannot easily approve a fully loaded headcount, which on that median and a conventional employer loading runs to something approaching £120,000, against a hypothesis. Sequencing the decision this way converts a budget argument into a procurement one, and procurement arguments get signed.

And it protects the hire. The most expensive mistake in this market is recruiting a security leader into a vacuum, which in our view is behind a good share of first security hires that end early. A specification written after ninety days of real work describes a job that exists. One written before describes a wish.

Risks

The arrangement that never ends. Fractional leadership without a stop date becomes a subscription. Write the end into the first contract, with a named deliverable marking it.

Documents nobody runs. A policy set produced by an adviser and never operated is worse than none, because it creates a written standard the company visibly fails. Every output above should name an internal owner before the engagement closes.

Assuming the discount covers more than it does. The First Step Fund covers Cyber Essentials certification. The GOV.UK page does not extend it to Cyber Essentials Plus, which adds independent technical verification and, on our experience of the market, costs materially more. If your buyers are asking for Plus, budget for Plus.

The four year exclusion. A business that certified within the last four years is not eligible. Check before you plan around the price.

The certificate without the controls. Cyber Essentials is a self assessment. A company can pass it and still fail the first technical question from a customer. The Breaches Survey finds 24% of businesses overall had the technical controls in all five Cyber Essentials areas, well above the 5% reporting adherence to the scheme. Controls and certificates are measuring different things, and a company can be on the wrong side of that gap in either direction.

Next Move

Garzon Cyber Solutions is built to run this as one sequence rather than three purchases.

First, the security foundations, delivered with specialist technology partners: detection and response, endpoint, and the control work that must exist before any certificate means anything. Second, the compliance and certification layer, mapped to what insurers, enterprise buyers and assessors actually ask for, so one evidence set serves the questionnaire, the renewal and the audit instead of three separate efforts. Third, specialist recruitment for the person who owns it afterwards, on contingency, with nothing payable until the candidate accepts and starts.

Delivered in that order they stop being three cost lines and become one commercial capability with an owner, which is the only version that survives the second year.

If you want the ninety day version first, the successor specification it produces is what we would recruit against.

Confidence note

Confirmed. Primary, GOV.UK and NCSC. That the Department for Digital, Culture, Media and Sport published the Cyber Essentials funding package on 3 November 2026, that the First Step Fund is backed by £2.4m, gives 75% off a new Cyber Essentials certificate at between £80 and £125 plus VAT, is open to eligible micro, small and medium sized UK businesses that have not certified in the last four years, is awarded first come, first served, and runs to March 2027 or until funds are exhausted. That a separate supplier grant worth up to £7m runs to March 2029 for selected suppliers of Cyber Resilience Pledge signatories, supported by an NCSC assured Cyber Advisor, and that the Government says approximately 6,000 and 8,000 businesses respectively could benefit. That Baroness Lloyd of Effra CBE is the Cyber Security Minister quoted. That the NCSC Annual Review 2026, published 3 November 2026, records 47,661 Cyber Essentials certifications for September 2025 to August 2026, up 19.6%, 15,646 Plus, up 21.5%, and 444 certification bodies, up 10.4%. That the Cyber Security Breaches Survey 2025/2026, published by DSIT and the Home Office on 30 April 2026 with fieldwork from August to December 2025, reports each figure quoted above, including 5% of businesses reporting adherence to Cyber Essentials against 3% the previous year, 12% of small businesses and 35% of large ones, 24% of businesses having the technical controls in all five areas, 41% of small businesses conducting a risk assessment against 48%, 44% having a business continuity plan covering cyber security against 53%, 52% of small businesses having formal policies against 59%, 32% of businesses meeting the incident management step, 39% of small businesses and 51% of medium ones citing external consultants or IT providers as the most common source of advice, the respondent job title distribution by business size, and that 18% of businesses did not know whether they adhered to Cyber Essentials, Cyber Essentials Plus or ISO 27001. That ITJobsWatch showed a UK median advertised CISO salary of £100,000 for the six months to 10 November 2026, down 15.11% on the year, from five quoted salaries across eleven permanent advertisements. That the Cyber Essentials question set requires approval by a board level representative, a business owner or the equivalent, that certification runs for twelve months, and that the scheme covers five technical control areas.

Assessed. That certification is moving from differentiator to baseline is our reading of rising volumes alongside new public funding, not a measured change in buyer behaviour. That the ITJobsWatch median is indicative only, since advertised salary is not fully loaded cost and the sample is small. That the respondent job titles in the Breaches Survey indicate where security ownership sits is our inference, and DSIT states directly that these are survey respondent titles rather than a definitive account of each organisation's leadership. That ninety days is the right length for an initial engagement is our judgement based on the deliverable set described, not a benchmarked figure. That a fully loaded security leadership headcount sits above £120,000 is our illustration from the advertised median plus a conventional employer loading, not a published figure. That a new security leader takes two or three quarters to produce evidence a buyer can read, and that the first year of such a hire into a company with no programme goes largely on tool selection and policy drafting, are our estimates. That Cyber Essentials Plus costs materially more, and that the independent verification step drives that, is our account of the market and not a published price. The 19.6% growth is the NCSC's own statement on its September to August basis; the ten year calendar table on the same page uses a different counting basis and we have not reconciled the two. That an IT provider cannot credibly attest to its own configuration is our assessment of assurance practice rather than a rule in any scheme. That first security hires fail most often because the role was defined before the programme existed is our view, and we have not seen tenure data that isolates the cause. The relationship between the two certification counting bases, the NCSC annual figure and the Breaches Survey adherence rate, is not like for like and we have not reconciled them.

Not known. How quickly the £2.4m will be claimed, since no drawdown figures have been published. Whether the First Step Fund will be extended or repeated after March 2027. How many Cyber Resilience Pledge signatories exist and how many suppliers each will put forward. What proportion of funded certificates will be renewed at full price in year two. Whether enterprise buyers will raise their asks once Cyber Essentials is near universal among suppliers, and if so to what. What a fractional security leader costs in the UK SME market as a published median, since the rate data we have found is vendor marketing rather than survey evidence.