What The Cyberfort Group does

The Cyberfort Group (legal entity Cyberfort Ltd) is a UK-headquartered, privately held cyber security managed services business founded in 2004 and operating from Thatcham, Berkshire. It delivers an end-to-end portfolio organised across three service lines: Consultancy (NCSC-assured Cyber Resilience Audit & Review, Secure by Design, Virtual Cyber Consultancy and Cyber Risk Management), Identify & Protect (Cyber Essentials certification, CREST-approved penetration testing, OT/IoT security review, red team exercises), and Detect & Respond (24/7 MXDR with proprietary SOAR tooling, vulnerability management, digital forensics and incident response, and tactical/operational/strategic threat intelligence). Underlying technology includes a managed extended detection and response platform that integrates endpoint, network, log and data telemetry; an in-house security orchestration, automation and response layer that consolidates multiple SIEM feeds to lower customer ingest cost; and a threat intelligence capability ingesting over 10 billion events per month across the customer base.\n\nThe company serves UK public sector, defence and security, critical national infrastructure and energy/utilities, financial and professional services, IT and technology, manufacturing, retail and consumer, and transport organisations. Named customers include HM Courts & Tribunals Service, the Department for Work and Pensions, Liberty Mutual Insurance, a Premier League football club, a global defence contractor, Bottomline, Reapit, Hunt Companies and PD Ports. Cyberfort is one of only 24 NCSC Assured Cyber Security Consultancies in the UK and one of six assured for Risk Audit & Review, holds CREST membership for pen testing and incident response, is a G-Cloud, Crown Commercial Service, NHS and JOSCAR-registered supplier, and holds ISO 27001, 9001, 14001 and 45001 certifications. Delivery is supported by 150+ certified engineers, analysts and consultants with security clearances, and the firm reports a 96% SLA compliance rate and 10+ year average customer tenure.\n\nThe business model combines recurring managed security services (MXDR and SOC contracts, multi-year with KPI-aligned pricing), professional services (NCSC-assured consultancy, penetration testing, certification) sold on project or retainer basis, and one-time certification services (Cyber Essentials from £650 + VAT, Cyber Essentials+ from £1,900 + VAT). Go-to-market is enterprise field sales targeting government, defence, CNI and large enterprise, augmented by direct G-Cloud and Crown Commercial Service procurement pathways. The company has historically been bootstrapped with no disclosed external funding, completed a cluster of acquisitions in 2018-2019 (Arcturus Security, The Bunker Secure Hosting, Agenci, Auriga Consulting), and in 2025 reactivated inorganic growth by acquiring ZDL, a 40-employee penetration testing firm, as the first move under a stated 'buy-and-build' strategy to become the largest independent UK-based cyber security service provider.

Name

The Cyberfort Group

Legal name

Cyberfort Ltd

Website

https://cyberfortgroup.com

Company type

Private

Founded year

2004

Operating status

Operating

Headcount range

101–250 employees

Short description

The Cyberfort Group is a UK-headquartered, privately held cyber security managed services firm delivering NCSC-assured consultancy, penetration testing, and 24/7 MXDR/SOC services to public sector, defence, CNI, and large enterprise clients, with 150+ certified engineers.

Ownership category

akta.pro rank

Product category

Cybersecurity Services

NAICS

Computer Systems Design and Related Services (54151), Security Systems Services (except Locksmiths) (561621)

akta.pro primary industry

Managed Detection & Response (MDR) & SOC Services (HDADAGAG)

akta.pro secondary industries

Cybersecurity & Identity Consulting (BPAHAEAG), Privacy, Data Protection & Cyber Governance (GRC) (BPAHAFAF), Penetration Testing, Red Team & Ethical Hacking (EDAOAIAH), OT/ICS & Critical Infrastructure Cybersecurity Services (BPAKAHAN), Cyber Defense & Information Security (National Security) (BPAIAHAE)

Keywords

• Managed security services
• Penetration testing services
• Cybersecurity consultancy
• Incident response services
• Threat intelligence services

Headquarters

HQ city

Sandwich

HQ country

United Kingdom

HQ region

Europe

Offices1 record

Markets served

GTM type

B2B

Offering type

Services

Cost components

Personnel, Technology or R&D, Operations, Marketing or Sales, Infrastructure

Revenue model

1. Managed Security Services (MXDR): 24/7 managed detection and response services delivered through proprietary MXDR platform. Includes continuous monitoring, threat hunting, incident management and compliance monitoring. Billed as recurring service with annual or multi-year contract terms.
2. Professional Consulting Services: NCSC assured consultancy services including Cyber Resilience Audits, Secure by Design, Virtual Cyber Consultancy, and Cyber Risk Management. Delivered by certified consultants on project or retainer basis.
3. Certification Services: Cyber Essentials and Cyber Essentials+ certification services with tiered pricing. Includes consultancy support hours and certification fees. One-time certification revenue with annual renewal cycle.
4. Penetration Testing Services: CREST-approved penetration testing including internal, external, application, cloud and infrastructure testing. Billed per engagement with pricing based on scope and complexity.

Pricing tiers

Go-to-market motion2 records

Distribution channels2 records

Marketing channels5 records

Core offering

The Cyberfort Group delivers an end-to-end cyber security managed services portfolio organised across three service lines: NCSC assured Consultancy, Identify & Protect (including penetration testing, Cyber Essentials, OT/IoT and Red Teaming), and Detect & Respond (including 24/7 MXDR, vulnerability management, incident response, and threat intelligence). Services are delivered through the company's 24/7 Security Operations Centre by 150+ certified cyber security engineers, analysts and consultants, primarily to UK public sector, defence, critical national infrastructure and financial services organisations.

Product overview

The Cyberfort Group delivers a comprehensive cyber security services portfolio organised across three service lines: Consultancy, Identify & Protect, and Detect & Respond. The Consultancy service line includes Cyber Resilience Audit & Review, Secure by Design, Virtual Cyber Consultancy Services, and Cyber Risk Management offerings. The Identify & Protect service line encompasses Cyber Essentials certification, Penetration Testing, OT/IoT Security Review, and Red Team services. The Detect & Respond service line features MXDR (Managed Extended Detection & Response), Vulnerability Management, Incident Response, and Threat Intelligence. All services operate through their 24/7 Security Operations Centre, with over 150+ certified cyber security engineers, analysts and consultants available to customers. The company serves eight market sectors: Public Sector & Government Services, Defence & Security, Critical National Infrastructure Energy and Utilities, Financial & Professional Services, IT & Technology, Manufacturing, Retail & Consumer, and Transport.

Differentiator

Problem solved

Functional benefit

Products and services

• Consultancy Services NCSC assured consultancy services enabling organisations to evaluate their existing cyber security strategies and programmes of work against business drivers, security operations and regulatory frameworks.
• Cyber Resilience Audit & Review Assesses an organisation's cyber security model maturity across four key areas: Managing Security Risk, Protecting against Cyber Attack, Detecting Cyber Security Events and Minimising the impact of Cyber Security Incidents.
• Secure by Design Embedding cyber security practices in digital and information systems delivery, building resilient digital services and removing focus on just achieving compliance.
• Virtual Cyber Consultancy Services On-demand access to virtual security officers, virtual CISOs, virtual Data Protection Officers, and Security Council services for day-to-day cyber security management.
• Cyber Risk Management Governance, Risk and Compliance (GRC) services supporting customers in effectively assessing, evaluating and managing Cyber Security risk.
• Cyber Essentials & Cyber Essentials+ Certification Cyber Essentials and Cyber Essentials+ certification services including preparation support, technical assessments, and vulnerability scanning for the UK Government backed scheme certification. Cyber Essentials starts at £650 + VAT and Cyber Essentials+ starts at £1,900 + VAT.
• Penetration Testing Comprehensive penetration testing services including Code Reviews, Cloud Security testing, AI/LLM testing, Application testing, Mobile application testing, Web application testing, Network infrastructure testing, Internal and External testing.
• OT/IoT Security Review Review and analysis of Operational Technology networks and systems security alongside protection for IoT devices providing unsecured back door routes into organisations.
• Red Teaming Red Team exercises enabling organisations to assess cyber security defences through goal oriented advanced cyber attack simulations replicating real-world attack scenarios.
• MXDR (Managed Extended Detection & Response) 24/7/365 managed detection and response service defending organisations' networks, systems and people through holistic visibility and active defence of endpoint, log, network, and data, delivered through Cyberfort's 24/7 SOC.
• Vulnerability Management Continuous, proactive, automated vulnerability management processes identifying and fixing potential security issues through real time scanning of devices and infrastructure.
• Incident Response (DFIR) Agile incident response services providing Digital Forensics and Incident Response (DFIR), containment and remediation activities during cyber incidents, with evidence stored in a forensically sound manner for legal proceedings.
• Threat Intelligence Tactical, operational and strategic threat intelligence and OSINT monitoring services proactively identifying and investigating threats with recommended mitigations.

Named customers10 records

Segments7 records

Ideal customer profiles4 records

Technology focussed Yes

API detail

Has API

No

API docs

API detail

Core technology

AI maturity

App detail

Feature4 records

Partnerships

One partnership is on record.

• VantacoreTechnology or Integration · 1 July 2025Cyberfort joined Vanta's Managed Service Provider (MSP) Partner Program as a certified partner. Partnership enables Cyberfort to offer Vanta's AI trust management platform to customers for automated GRC workflows, continuous compliance monitoring, and centralised risk management across 35+ cybersecurity frameworks.

Scale indicators6 records

Recent moves6 records

Expansion highlights6 records

Direct peers

• NCC Group: UK-listed cybersecurity services firm offering assurance, managed detection and response, and consulting across similar government, defence and enterprise customers. Directly comparable service portfolio, geographic footprint (UK-anchored) and customer segments make it the closest publicly traded reference point.
• e2e-assure: UK-headquartered SOC and MDR provider delivering 24/7 managed detection and response to mid-market and enterprise customers. Direct competitor to Cyberfort's MXDR service line with comparable customer profile and similar scaling challenges in the UK market.
• Trustwave: Global MDR/SOC and managed security services provider with a UK delivery presence, serving enterprise and mid-market customers. Directly comparable managed detection and response delivery model and customer overlap in financial services and retail.
• Bridewell: UK-based cybersecurity consultancy and managed services firm focused on critical infrastructure, financial services and government - very similar sector mix to Cyberfort. Comparable size, similarly NCSC/CREST-credentialed, and a direct competitor for UK public-sector and CNI cyber mandates.
• Pentest Ltd: CREST-accredited UK penetration testing specialist offering application, infrastructure and cloud testing. Closest like-for-like competitor to Cyberfort/ZDL's pen testing practice and a likely M&A target or competitor in the same niche.

Broad incumbents

• Mandiant (Google Cloud): Global incident response, threat intelligence and managed defence provider (now part of Google Cloud). Direct competitor in DFIR and threat intelligence and a benchmark for premium cyber services valuations; broader geographic reach than Cyberfort.
• Sophos: UK-origin cybersecurity vendor (now owned by Thoma Bravo) offering endpoint, network and managed detection and response. Overlaps with Cyberfort's MXDR and managed services but operates as a much larger product-led vendor rather than a services specialist.
• BAE Systems Applied Intelligence: Defence-prime cybersecurity division offering managed security, incident response and cyber consulting primarily to government, defence and financial services. Overlaps with Cyberfort in NCSC-cleared government work but operates at vastly greater scale and across broader geographies.

Emerging players

• ReliaQuest: US-headquartered MDR platform provider delivering 24/7 SOC-as-a-service with proprietary SOAR-style automation, conceptually similar to Cyberfort's MXDR+SOAR stack. Comparable technology approach but primarily serves larger US enterprise customers.

Regional players

• WithSecure: European-headquartered cybersecurity vendor offering managed detection, consulting and incident response across Europe. Comparable services but primarily competes in continental Europe rather than the UK, making it a regional rather than head-to-head peer.

Market position

Strengths5 records

Weaknesses5 records

Competitive moat5 records

Key risks6 records

Key highlights7 records

Customer concentration

• Xx.com/cyberfortgroup
• LinkedInuk.linkedin.com/company/cyberfort

Revenue estimate

Valuation estimate

Number of profiles

Profiles6 records

Subsidiaries1 record

Funding overview

Funding rounds

Investors

Funding detail is available on the Subscription and Enterprise plan.Contact sales →

M&A5 records

Investments

M&A and investment is available on the Subscription and Enterprise plan.Contact sales →

Frequently asked questions about The Cyberfort Group