The Contract Rate Rose 17%. The Salary Fell 7%. Only One of Those Is a Pay Rise.

Two halves of the same profession moved in opposite directions this year. The obvious conclusion is that cyber practitioners should go contracting. The obvious conclusion is wrong, and the reason it is wrong took legal effect in April.

Depending only on how a UK cyber security professional is engaged, the market is now paying them meaningfully more than a year ago, or meaningfully less. Same skills, same threat picture, same hiring managers. Different contract.

IT Jobs Watch data for the six months to 5 September 2026 puts the median advertised contract rate for a cyber security analyst at £575 a day, up 17.35% on the equivalent period in 2025, when the median stood at £490. Rates in that sample ran from £344 at the tenth percentile to £775 at the ninetieth, drawn from 124 contract advertisements, of which 81 quoted a rate.

Over an almost identical window, the six months to 9 September 2026, the same source puts the median permanent salary for that role at £50,000, down 7.41% from £54,000 a year earlier, across 779 permanent advertisements.

ContractorUK's September 2026 snapshot points the same way, with a median advertised cyber day rate of £569 against £538 in August. That is a different measurement, though: one month across cyber roles generally, on 28 live listings. It agrees on direction and corroborates nothing.

Treat the precision with care more broadly. The permanent advertisement count in the IT Jobs Watch series jumped sharply year on year, which usually signals a change in how job titles are matched rather than a sudden expansion of the profession. What survives the caveats is the direction: contract is repricing upwards, permanent is repricing down.

What the divergence is actually telling you

The temptation is to read this as arbitrage. Leave the payroll, keep the skills, collect the premium.

That misunderstands what the premium is for. Employers are not paying £575 a day because a contractor is a better analyst than the person at the next desk on £50,000. They are paying it because they want capability without a permanent liability, and in 2026 they want that more than they did in 2025.

The Barclay Simpson 2026 cyber security salary guide gives the reason in the employers' own words. Some 40% of those using interim support cite specific projects as the driver, and 23% cite supporting business as usual. Meanwhile 83% said they were likely to recruit during 2026, but 76% planned base pay rises of only 1% to 4% for the people already there, with 17% planning 5% to 10%.

Budgets are moving, then, but into work that has a defined end. A day rate is a variable cost that leaves the profit and loss account when the project closes. A salary is a fixed cost that does not. The premium on the rate is the price of that flexibility; the discount on the salary is what the employer keeps for carrying you through the quiet quarters.

You are not being offered more money for the same thing. You are being offered more money to absorb a risk the permanent market absorbs on your behalf.

The change that most candidates have not priced

While the rate gap widened, the machinery underneath contracting changed.

Finance Act 2026, which received Royal Assent on 18 March 2026, inserts a new chapter into Part 2 of the Income Tax (Earnings and Pensions) Act 2003. For payments made on or after 6 April 2026, joint and several liability for PAYE applies where an umbrella company sits in a labour supply chain.

The detail matters, because it is widely reported incorrectly. Liability does not sit with whichever agency happens to be directly above the umbrella. It sits with the agency holding the contract with the end client, at the top of the chain. In a chain running client to first agency to second agency to umbrella, HMRC's guidance makes the first agency and the umbrella the liable parties; the second, nearest the worker, is not liable at all. Where no agency sits between client and umbrella, liability passes to the client. It is absolute, with no reasonable excuse or due diligence defence.

HM Treasury's policy paper sets out the scale of the problem. At least 700,000 workers were engaged through umbrella companies in 2022 to 2023, at least 275,000 of them, likely significantly more, by an umbrella that failed to comply with its tax obligations. Some £500 million was lost to disguised remuneration avoidance schemes that year, and the measure is expected to protect around £2.8 billion across the scorecard period to 2029 and 2030.

The policy target is non-compliant intermediaries. The effect on a candidate is more immediate. When an agency becomes liable, without defence, for tax it does not itself deduct, it stops treating its umbrella panel as an administrative convenience and starts treating it as a credit risk. Panels shrink, diligence lengthens, and marginal arrangements that quietly improved take-home pay disappear.

Set that against the status question. Barclay Simpson found 54% of cyber contractors working outside IR35 while 86% said they preferred that arrangement, a gap of 32 points between what practitioners want and what the market gives them. ContractorUK's September sample is harder still, with only 25% of listings stated as outside IR35.

So the headline rate rose in the same year the route to receiving it got narrower, better policed and more expensive to administer. Both are true. Only one appears in the advertisement.

The Kept Rate

Multiplying a day rate by 220 and setting it against a salary is the most common and most costly error in this decision. The number that matters is not the advertised rate. It is the Kept Rate, and it survives four columns.

Utilisation. Billable days, not calendar days. Assume a realistic gap between engagements, time off you now fund yourself, and the days lost to finding the next contract. A rate that looks decisive at 230 days looks ordinary at 180.

Deduction. The full stack between the client's invoice and your bank account: employer National Insurance and the apprenticeship levy inside an umbrella assignment rate, umbrella margin, pension you now fund alone, and the accountancy or insurance costs of a personal service company where one is viable. Ask for the illustration in writing before you accept, and ask who holds the client contract in your chain.

Duration. The length of the engagement and, more importantly, the notice inside it. A twelve-month contract with a one-week notice clause is a one-week contract described optimistically. Notice is the only part of a contract that tells you what your income actually is.

Deposit. What the engagement puts into your evidence base. Project work builds depth in a named system, a named framework, a named migration. It rarely builds the two things that promote people into security leadership: ownership of a control across multiple cycles, and a documented record of decisions made under real pressure. The difference between contracting that compounds your market value and contracting that quietly flattens it is whether you can point at outcomes you owned rather than tasks you delivered.

Run the four columns honestly and a £575 day rate resolves into a number you can set beside £50,000. Sometimes it wins comfortably. Sometimes it does not win at all. The comparison is arithmetic, not instinct, and almost nobody does it before handing in their notice.

Three questions to ask yourself before you move

How many days can I honestly bill next year, and on what evidence? If the answer comes from optimism rather than the last two years of the contract market in your specialism, you do not yet have a plan.

Under the April rules, who holds the contract with the end client in my chain, and can the agency tell me without checking? That is the party carrying joint and several liability, and an agency that answers immediately and precisely has done its work. One that cannot map its own chain is a supply chain risk you would be joining, not a partner.

Am I moving towards a rate or away from one? The Barclay Simpson survey behind the 2026 guide found 70% of cyber professionals placing remuneration in their top three reasons for moving, while only 21% felt very confident in the job market. Money is the stated reason for most moves in a market where few feel secure, which is exactly the condition in which people accept a headline number and discover the deductions afterwards.

The strategic takeaway

The divergence between contract and permanent pricing is not an inefficiency waiting to be exploited. It is the market pricing risk, correctly, and then offering to sell that risk to you at a discount to what it would cost the employer to keep.

Whether that is a good trade depends on your utilisation, your deductions, your notice terms and what the work does to your evidence base. All four are knowable in advance. The people who do well out of this market are not the ones who noticed the rate gap. They are the ones who priced it before they moved.

One second-order point is worth holding onto. Permanent salaries falling while contract rates rise does not mean permanent roles are worth less. It means employers are separating work that must be owned from work that must merely be done. If your role sits in the first category, your position is stronger than the median suggests, and it is strongest where you can show what would fail if you left.

Where GCS fits

Garzon Cyber Solutions is a young firm and we do not claim a placement history we have not earned. What we do have is a founder who spent his career inside cybersecurity and compliance, selling into security and technology buyers, and who runs the recruitment work personally.

Recruitment is contingency only. Nothing is payable by a hiring company until a candidate accepts and starts, and no CV goes anywhere without your explicit permission for that specific role.

If you are weighing a contract against a permanent move this quarter, register your interest through the Garzon Cyber Solutions Website. You will get a straight answer, including when the answer is that the move is not worth making.

Confidence note

The salary and day rate figures are advertised market data, not settled pay. IT Jobs Watch and ContractorUK both report asking rates from job advertisements, the IT Jobs Watch contract median rests on the 81 of 124 advertisements that quoted a rate, and the ContractorUK September median rests on 28 live listings. The two sources measure different things and should not be read as confirming one another. The Barclay Simpson figures are self-reported by surveyed employers and practitioners, and the 83% recruitment figure covers recruitment generally, with no employment type specified. The umbrella company workforce and tax loss figures are HM Treasury and HMRC estimates, described as such in the policy paper, with "at least" and "around" carried from the original wording; the £2.8 billion is a forecast across a scorecard period, not a realised saving. The joint and several liability rules are confirmed legislation in force under Finance Act 2026, not proposals. The four-column analysis in The Kept Rate is our own framework, not a finding from any of these sources.