What NCC Group does

NCC Group plc is a UK-headquartered, FTSE 250-listed (LSE: NCC) pure-play cyber security and resilience company founded in 1999 and headquartered in Manchester. Following the May 2026 divestment of its Escode software escrow business to TDR Capital for £262.8m net cash, the group is now exclusively focused on cyber security, employing approximately 1,800-2,000+ colleagues across the UK, mainland Europe, North America, and Asia Pacific and serving clients in more than 50 countries. Its customer base spans Fortune 500 enterprises, regulated financial institutions, governments, transport operators, manufacturers, and technology firms, with named accounts including TikTok (Project Clover data assurance), Vodafone (VBSE), Jaguar Land Rover (incident response), Transport for London, and London Councils. NCC Group holds an unusually dense portfolio of UK and international credentials, including NCSC Cyber Incident Response Level 1 & 2 provider status, NCSC CHECK 'green' continuously since 2001, CREST membership, FedRAMP 3PAO recognition, TISAX accreditation, CBEST/TIBER-EU approval, and ISO 27001:2022 across six geographies.

The company's service portfolio is organised into five divisions: Incident Response (retainers, DFIR, recovery, readiness), Technical Assurance (penetration testing, social engineering including deepfake vishing, application security, attack simulation, hardware/embedded security, cryptography, blockchain, cloud security), Managed Services (MXDR for Microsoft and Splunk, vulnerability scanning, Attack Surface Management, the proprietary Unified Cyber Platform), Consulting & Implementation (Identity & Access Management, OT security, strategy/risk/compliance, M&A technical due diligence), and Threat Intelligence (Online Exposure Monitoring via Searchlight Cyber DarkIQ, digital footprint review, monthly Threat Pulse reports). Core technology assets include the Unified Cyber Platform (UCP) for integrated vulnerability and threat management, the Unified Digital Identity Framework (now anchored by the Delinea partnership), a research function delivering 2,000+ person-days per year, 150+ CVEs since 2020, and 280+ open-source tools on GitHub, and a roster of 420+ offensive security experts. Recent integrations include OpenAI's GPT-5.5-Cyber variant (Daybreak Partner Program, June 2026), Dragos (IT/OT incident response retainer, November 2025), Qualys (ASM integration, December 2025), and Delinea (managed PAM, January 2026).

NCC Group operates an enterprise go-to-market with direct field sales supported by tier-one technology partnerships (Microsoft Gold, AWS Select, Google Partner) and a global partner/reseller ecosystem. Pricing is hybrid: fixed-fee projects for defined engagements, day rates for consulting, multi-year retainer packages with tiered SLAs for incident response, and subscription contracts for managed services (MXDR, ASM, UCP). In H1 2026 the group reported £151.3m revenue (+5.0% YoY), cyber security revenue of £118.4m (+5.9%), managed services revenue of £40m (+4.7%), and adjusted EBITDA of £23.5m (+27.7%). The Escode sale left the group in a net cash position of approximately £230m, supporting a £170m tender offer and £15m share buyback (£185m total capital return) alongside continued organic investment.

Name

NCC Group

Legal name

NCC Group plc

Website

https://nccgroup.com

Company type

Public

Founded year

1999

Operating status

Operating

Headcount range

1,001–5,000 employees

Short description

NCC Group plc is a UK-listed, FTSE 250 pure-play cyber security company serving Fortune 500 enterprises, governments, and regulated industries across 50+ countries with incident response, technical assurance, managed security, and threat intelligence services delivered by 1,800-2,000+ specialists.

Ownership category

akta.pro rank

Product category

Cybersecurity Services

NAICS

Security Systems Services (except Locksmiths) (561621)

akta.pro primary industry

Network Access Control (NAC) (HDADABAJ)

Keywords

• Cybersecurity services
• Incident response
• Penetration testing
• Managed security services
• Threat intelligence

Headquarters

HQ city

Manchester

HQ country

United Kingdom

HQ region

Europe

Offices9 records

Markets served

GTM type

B2B

Offering type

Services

Cost components

Personnel, Technology or R&D, Operations, Marketing or Sales, Infrastructure

Revenue model

1. Cyber Security Services: Comprehensive cybersecurity services including technical assurance, managed services, consulting, and incident response delivered to enterprise clients globally. Revenue is generated through project-based engagements, retainer contracts, and subscription-based managed services. The company reported £151.3m group revenue in H1 2026 with cyber security revenue of £118.4m.
2. Professional Services: Technical consulting engagements including penetration testing, security assessments, incident response, and strategic advisory services. Delivered by global team of over 420 offensive security experts.
3. Managed Services Revenue: Recurring managed security services including MXDR, vulnerability scanning, attack surface management, and threat intelligence. Managed services revenue reached £40m in H1 2026.

Pricing tiers

Go-to-market motion3 records

Distribution channels4 records

Marketing channels7 records

Core offering

NCC Group is a global cyber security company that delivers cyber resilience services to enterprises and governments. Its core offerings include incident response and readiness, technical assurance (penetration testing, application security, hardware/embedded and cryptography security), managed security services (MXDR, vulnerability management, attack surface management, Unified Cyber Platform), consulting and implementation (OT security, identity & access management, strategy/risk/compliance), and threat intelligence.

Product overview

NCC Group operates as a pure-play cybersecurity and resilience company organized into five core divisions: (1) Incident Response — covering incident readiness, cyber incident response management, incident recovery, and cyber incident response retainers; (2) Technical Assurance — encompassing penetration testing, social engineering prevention, application security, attack simulation, hardware and embedded systems security, cryptography and encryption, blockchain security, and cloud security; (3) Managed Services — including Managed Extended Detection and Response (MXDR) for Microsoft and Splunk, Network Detection and Response for OT, Vulnerability Scanning and Management, Bug Bounty and Vulnerability Disclosure, Attack Surface Management, and the Unified Cyber Platform; (4) Consulting and Implementation — covering identity and access management, operational technology, training and awareness, strategy, risk and compliance, project and program management, and M&A due diligence; and (5) Threat Intelligence — delivering online exposure monitoring and digital footprint review. The portfolio spans sectors including financial services, legal and professional services, retail and consumer markets, public sector and government, transport (aerospace, automotive, rail, maritime), technology, media and telecommunications, energy and utilities, manufacturing, and health. The company also provides sector-specific threat intelligence reports and publishes the annual Global Cyber Policy Radar.

Differentiator

Problem solved

Functional benefit

Products and services

• Incident Response
• Cyber Incident Response Retainer
• Technical Assurance / Penetration Testing
• Social Engineering Prevention
• Managed Extended Detection & Response (MXDR)
• Attack Surface Management (ASM)
• Unified Cyber Platform (UCP)
• Operational Technology (OT) Security
• Strategy, Risk & Compliance Consulting
• Online Exposure Monitoring (OXM)
• Threat Intelligence
• Digital Identity
• Vulnerability Scanning & Management

Quantifiable outcome

• H1 2026: Group revenue £151.3m (+5%), cyber security revenue £118.4m (+5.9%), adjusted EBITDA £23.5m (+27.7%)
• +2 more outcomes

Named customers8 records

Segments8 records

Ideal customer profiles7 records

Technology focussed Yes

API detail

Has API

No

API docs

API detail

Core technology

AI maturity

App detail

Integration8 records

AI capability8 records

Feature6 records

Partnerships

Nine partnerships are on record, tiered core and minor.

• OpenAIcoreTechnology or Integration · 25 June 2026NCC Group joined OpenAI's Daybreak Cyber Partner Program, gaining access to GPT-5.5 variant configured for cyber resilience research. NCC Group is among limited organizations invited to test and apply OpenAI's cyber-focused AI tools for defensive purposes, starting with internal research using security testing data. Technical teams will assess the model and provide feedback to shape AI applications in identifying vulnerabilities and supporting remediation work.
• DelineacoreTechnology or Integration · 23 January 2026Partnership to deliver managed privileged access management (PAM) services, integrating Delinea's platform into NCC Group's Unified Digital Identity Framework. The collaboration addresses growing demand for credential security and identity controls as organizations adopt AI and operate hybrid IT environments. Services include secure credential vaulting, privileged session management, and just-in-time access aligned with Zero Trust Architecture.
• DragoscoreStrategic or Co-development Partner · 5 November 2025Enhanced partnership with Dragos to offer combined breach support services covering both corporate IT and industrial OT environments. Integrates NCC Group's Digital Forensic and Incident Response capabilities with Dragos' OT expertise and intelligence. New retainer service provides end-to-end incident response across IT and OT estates, addressing the growing ransomware threat targeting industrial sectors.
• Horizon3.aiminorChannel Partner/ Reseller/ DistributorNCC Group participates as a partner in Horizon3.ai's global partner ecosystem. Horizon3.ai hosted its second annual Global Partner Conference in Orlando with over 100 partners in attendance. NCC Group is listed among partners including Optiv, Thrive, CDW, and Sentinel Technologies.
• AvertrominorStrategic or Co-development PartnerPartnership with Avertro to transform cyber risk into strategic business intelligence. Collaboration enables organizations to better quantify and communicate cyber risk to business leadership.
• TikTok (Project Clover)coreStrategic or Co-development PartnerNCC Group serves as TikTok's trusted technology provider for Project Clover, a high-profile programme aiming to give European and UK users assurance that their data is being kept safe. TikTok selected NCC Group based on reputation and European footprint.
• MicrosoftcoreChannel Partner/ Reseller/ DistributorMicrosoft Partner Network member holding Gold Partner status, enabling integrated service delivery and co-marketing with Microsoft's security platform.
• Amazon Web ServicescoreChannel Partner/ Reseller/ DistributorAmazon Partner Network Select Partner and Alexa Voice Services Approved Test Lab, providing security assessments and integration services for AWS environments.
• GooglecoreChannel Partner/ Reseller/ DistributorGoogle Partner Program member and Android Advanced Assurance Approved Test Lab, Google API App Security Assessment Partner providing security testing for Google Cloud and Android environments.

Scale indicators13 records

Recent moves7 records

Expansion highlights6 records

Direct peers

• Mandiant (Google Cloud): Mandiant is the closest direct competitor to NCC Group in incident response, threat intelligence, and managed defense. Both firms originated as elite IR consultancies, hold similar regulatory certifications, and serve Fortune 500 enterprises and governments. Acquired by Google Cloud in 2022, now competing with NCC for major incident response retainers.
• BAE Systems Digital Intelligence (Applied Intelligence): BAE Systems' Digital Intelligence division is a UK-headquartered peer competing directly with NCC in government cyber services, financial sector security (CBEST), and national infrastructure protection. Both firms serve UK sovereign clients and hold similar security clearances, with overlapping technical assurance and managed security offerings.
• SecureWorks: SecureWorks is a global managed security services provider with comparable MXDR, vulnerability management, and incident response capabilities to NCC's managed services division. Both firms serve mid-market and enterprise clients with subscription-based security operations, and SecureWorks' Dell ownership mirrors NCC's enterprise-focused GTM motion.
• Optiv Security: Optiv is a US-headquartered security solutions integrator and services provider with comparable offerings in advisory, integration, and managed security services. Like NCC, Optiv delivers enterprise-focused security services across multiple verticals and competes for similar Fortune 500 consulting engagements.
• ReliaQuest: ReliaQuest is a managed detection and response specialist competing directly with NCC's MXDR and managed security offerings. Both firms focus on enterprise SOC operations with technology-amplified service delivery models, and ReliaQuest's GreyMatter platform parallels NCC's Unified Cyber Platform strategy.
• WithSecure (formerly F-Secure): WithSecure is a European-headquartered cybersecurity firm providing managed detection and response, incident response, and security consulting services. As a fellow European mid-market pure-play cyber services company, WithSecure is a comparable public peer for NCC's business model and growth profile.

Broad incumbents

• CrowdStrike (Falcon Complete / Services): CrowdStrike's Falcon Complete MDR offering and professional services compete with NCC's MXDR and incident response. As a vastly larger platform vendor ($4B+ revenue) with bundled endpoint-to-cloud capabilities, CrowdStrike represents both a partner (within NCC's identity ecosystem) and a competitive threat in managed security deals.
• Palo Alto Networks (Unit 42): Unit 42 is Palo Alto Networks' threat intelligence and incident response unit, providing direct competition to NCC's incident response and consulting services. As part of one of the largest cybersecurity platforms, Unit 42 has distribution and R&D scale advantages over NCC's standalone services model.
• IBM Security Services: IBM Security's services arm delivers managed security, incident response, and strategic consulting at global scale, overlapping significantly with NCC's enterprise offerings. As part of IBM's broader consulting business, it competes for large enterprise security transformation mandates where NCC also plays.
• Booz Allen Hamilton Cyber: Booz Allen Hamilton's commercial and federal cyber business provides managed security, incident response, and strategic consulting — competing with NCC in government and critical infrastructure segments. As a much larger public consulting firm, Booz Allen represents enterprise-scale competition for major government cyber contracts.

Market position

Strengths5 records

Weaknesses5 records

Competitive moat6 records

Key risks7 records

Key highlights7 records

Customer concentration

• LinkedInlinkedin.com/company/ncc-group
• Xx.com/nccgroupplc
• Facebookfacebook.com/NCCGroupplc

Compliance18 records

Revenue estimate

Valuation estimate

Number of profiles

Profiles9 records

Subsidiaries1 record

Funding overview

Funding rounds

Investors

Funding detail is available on the Subscription and Enterprise plan.Contact sales →

M&A19 records

Investments

M&A and investment is available on the Subscription and Enterprise plan.Contact sales →

Frequently asked questions about NCC Group