Qurexa Logo
Qurexa

Trust. Care. Deliver.

Back to Blog & Insights
Technology

£80 instead of hundreds: the 75% discount that opened today, for about 6,000 businesses

Qurexa Editorial Team3 November 20268 min read 0 0
£80 instead of hundreds: the 75% discount that opened today, for about 6,000 businesses

What happened

On 3 November 2026 the government opened a fund that cuts the cost of getting certified against the UK's basic cyber security standard by three quarters. The standard is called Cyber Essentials. It is the government's recommended minimum level of cyber security for organisations of any size, built around five technical controls aimed at the most common attacks that arrive over the internet. The new scheme is the Cyber Essentials First Step Fund. It offers a 75% discount on first-time certification to eligible UK micro, small and medium-sized businesses. With the discount, certification costs between £80 and £125 plus VAT. The fund is worth £2.4 million and is expected to reach around 6,000 businesses. To be eligible, a business must not have been certified in the last four years. Places are first come, first served, and the fund runs from 3 November 2026 until March 2027 - or until the money runs out, whichever comes first. Applications go through firststep.iasme.co.uk. A second, larger scheme was announced at the same time. The Cyber Essentials for Suppliers Grant covers first-time certification completely, plus tailored support from a qualified Cyber Advisor, for eligible UK small and medium-sized suppliers to organisations that have signed the government's Cyber Resilience Pledge. That grant is worth up to £7 million, runs until March 2029, and is expected to reach around 8,000 businesses. Firms are nominated by the pledge signatory they supply, who then contacts them directly. More than 230 organisations have signed the Cyber Resilience Pledge, which commits them to treating cyber security as a board-level responsibility, signing up to the National Cyber Security Centre's Early Warning service, and taking a risk-based approach to asking for Cyber Essentials across their supply chains. The announcement was made in a speech at the National Cyber Security Centre's Annual Review by the Cyber Security Minister, Baroness Lloyd of Effra, who said small businesses 'should not be left vulnerable in the age of rising cyber threats' and that the government would 'back our SMEs and help them be protected and secure'. Fourteen organisations also joined the second cohort of Software Security Ambassadors, including Fortinet, Thales, Capgemini, Zscaler, Investec and QinetiQ. Their role is to promote secure software development across their own supply chains.

Why this matters

Most of the UK's businesses are small ones, and most of them do not have anybody whose job is cyber security. That is not carelessness. If you run a four-person plumbing firm, a village shop or a care agency, there is no spare person to hand this to. It sits on the owner's list underneath everything that pays the bills, and it stays there. The trouble is that attackers do not sort their targets by size. Automated attacks sweep across whatever they can reach, and a small firm with an unpatched laptop and a shared password is easier to get into than a bank. Small businesses also sit inside bigger supply chains, which makes them a route to somewhere larger. The government's indicative estimate puts the average cost of a significant cyber attack on a UK business or organisation at £195,000. It is worth noting that the government itself flags this figure as relying largely on US data, so treat it as an order of magnitude rather than a precise British number. Even so, for a business turning over a few hundred thousand pounds a year, an incident at any fraction of that scale is existential. The second scheme is arguably the more interesting one. By letting large organisations nominate their own small suppliers for free certification, it tackles the awkward reality that big firms increasingly demand Cyber Essentials from suppliers who cannot easily afford it. Instead of the requirement simply being passed down the chain as a cost, the pledge signatory can pass down the funding too.

What the evidence actually says

Cyber Essentials is a floor, not a ceiling. It is worth being clear about that, because certification can create a false sense of completeness. The five controls it covers are the basics: firewalls, secure settings, controlling who has access to what, protection against malware, and keeping software updated. Getting those right stops a large share of ordinary, opportunistic attacks. It does not stop a determined, targeted attacker, and it is not a substitute for backups, staff training or an incident plan. The basic level is also self-assessed. The organisation answers the questions about its own systems and the answers are reviewed. Cyber Essentials Plus adds independent technical testing and costs more. Both are useful; they are not the same thing. On the money, the arithmetic is worth doing honestly. £2.4 million across roughly 6,000 businesses works out at around £400 each, which fits with a 75% discount on typical certification fees. The £80 to £125 range reflects the fact that the standard price varies by business size. One genuine extra: certified organisations with a turnover under £20 million get up to £25,000 of cyber liability insurance included. That is a real benefit, though £25,000 would not go far against a serious incident. The constraint to take seriously is scarcity, and here it is real rather than manufactured. There are far more than 6,000 eligible small businesses in the UK. The fund is first come, first served, closes in March 2027, and may close earlier if the money goes. If this is relevant to you, the honest advice is that waiting is a risk. The wider spending announced in the Budget the previous week is larger but further from most businesses: £70 million for a National Exposure and Real-Time Vulnerability Centre inside the NCSC, £60 million for a national Cyber Shield using agentic AI including a £25 million challenge fund, a new NCSC AI Cyber Security Centre of Excellence in Manchester, £40 million for a National Agentic Security Unit, and £24 million for public-sector defences. Those shape the national picture rather than the queue at your door.

Practical advice

**Check your eligibility first, then apply quickly.** The test is whether you have been certified in the last four years. If you have not, and you are a UK micro, small or medium business, apply through firststep.iasme.co.uk. Places are limited and allocated in order. **If you supply a large organisation, ask them.** More than 230 organisations have signed the Cyber Resilience Pledge, and they can nominate their small suppliers for fully funded certification plus advisor support. One email to your main client's procurement contact is worth sending. **Do the five controls whether or not you certify.** Turn on automatic updates. Use multi-factor authentication on email and anything financial. Give staff only the access they need. Keep a firewall on. Run antivirus. These cost nothing and matter more than the certificate. **Sign up to NCSC Early Warning.** It is free for UK organisations and tells you when the NCSC sees signs of a problem on your network. **Write down what you would do in an incident.** Who you ring, where your backups are, how you would tell customers. Two sides of paper is enough, and the time to write it is now rather than during. **Test a backup restore.** A backup you have never restored from is a hope, not a backup. **Do not treat the certificate as finished.** Cyber Essentials is renewed annually, and the threat does not stand still.

What to know

From 3 November 2026, eligible UK small and medium businesses can get 75% off first-time Cyber Essentials certification, bringing it down to £80 to £125 plus VAT. The £2.4 million Cyber Essentials First Step Fund covers around 6,000 businesses, is first come, first served, and runs until March 2027 or until the funding is used up. Applications are at firststep.iasme.co.uk, and you are eligible if you have not been certified in the last four years. Separately, up to £7 million is available until March 2029 for fully funded certification plus Cyber Advisor support for small suppliers nominated by any of the 230-plus organisations that have signed the Cyber Resilience Pledge. If you supply a large organisation, ask whether they can nominate you. Certification at this level is self-assessed and covers five basic controls. It stops a lot of ordinary attacks. It is not comprehensive, and it is not a replacement for backups, multi-factor authentication and knowing what you would do if something went wrong. Certified firms under £20 million turnover do get up to £25,000 of cyber liability insurance included. The scarcity here is genuine. There are many more eligible businesses than funded places. Sources: GOV.UK, 'New Government-backed cyber security protections could save UK businesses thousands', 3 November 2026, https://www.gov.uk/government/news/new-government-backed-cyber-security-protections-could-save-uk-businesses-thousands; National Cyber Security Centre, 'Cyber Essentials', https://www.ncsc.gov.uk/cyberessentials/overview; IASME, Cyber Essentials First Step Fund, https://firststep.iasme.co.uk This article is for general information about a government funding scheme and is not professional security, legal or financial advice. Check eligibility and terms on the official scheme pages before applying.

#cyber security#small business#Cyber Essentials#NCSC#grants#online safety

Related articles