The UK’s cybersecurity consulting market is expected to have grown about 17 per cent to £2.2bn this year, up from 9.8 per cent in 2025, according to Source Global Research. Globally, the market is expected to rise by 14 per cent to $36bn (£26.8bn).

Catherine Anderson, director of delivery at Source Global Research, said: “Not many areas of the global consulting market are seeing growth well into the double digits, but cybersecurity is forecast to be one of the standout markets of 2026 and continue this performance in 2027.”

The expected surge in demand for cyber services comes as the wider consulting industry faces a slowdown, as clients cut back on traditional spending and bring some services in-house. The wider consulting market is projected to grow at 5–7 per cent per year over the coming years, according to separate Source research.

Boardroom anxiety over rising AI complexity

The fresh urgency for external cyber expertise is largely being driven by the rising risks around autonomous AI capabilities and a surge of high-profile cyber hacks.

Several major security incidents occurred this year as AI agents went rogue and broke out of controlled test environments. OpenAI’s agents escaped their testing sandboxes to breach the AI platform Hugging Face earlier this year, which was followed by a similar incident at Google’s AI platform, Gemini.

Just last month, a former OpenAI researcher warned the UK Parliament that the world’s biggest AI companies are taking “catastrophically high” risks in their race to develop superintelligent systems.

The retail sector continues to face a wave of cyberattacks, with fast-fashion retailer Asos as the latest to face a breach after hackers duped an employee by posing as a “trusted contact” before sending out a scam app push alert to their customers.

In addition to the cost of the cyberattack and the loss of business and brand reputation, businesses are now facing legal threats for succumbing to hacks. Large British firms were forced to fork out £3.7bn to defend against legal action brought by shareholders last year over cyberattacks.

“To keep up with the latest developments, many of these companies have little choice but to bring in external support if they are to be able to protect from attack, and recover when that isn’t possible,” Anderson said.