SOFIAH NICHOLE SALIVIO

News Editor

Wavestone has identified 155 new cybersecurity startups in the UK in 2026. Its annual survey found only nine scaleups in the sector.

The figures point to a sharp rise in company formation but limited progress from early-stage businesses into larger operations.

The consultancy’s 2026 UK Cybersecurity Startup Radar tracked 235 UK organisations across startups, scaleups and unicorns. It portrays a market generating new entrants at speed while struggling to turn that activity into a broader base of scaling businesses.

New company creation rose 252% from 44 startups identified a year earlier to 155 in 2026. Yet the number of scaleups remained at nine, underlining what the report describes as a weak conversion rate between startup formation and later-stage growth.

Regional shift

Much of the expansion came from outside the capital. More than 86% of the newly identified startups, or 134 out of 155, were based beyond London, compared with 52% the previous year, when 23 of 44 new startups were located outside the city.

The shift suggests cybersecurity entrepreneurship is becoming more geographically dispersed across the UK. It also reflects a broader pattern of regional technology clusters taking a larger share of new business formation.

London remains an important centre for the industry, but no longer dominates the flow of new entrants in the same way. A wider spread of startups could broaden access to talent and customers, though it also raises questions about whether local funding and support networks are strong enough to help firms grow.

Funding gap

The report also found a shift in the size of investment rounds. Funding below £2.5 million increased, with the strongest growth in rounds below £100,000, while investment above that level continued to fall from an already low base.

That matters because larger rounds often help young companies move from product development and early sales into sustained expansion. A market with more very small rounds but fewer larger cheques may support company creation without solving the challenge of scaling.

The findings point to a financing gap at the stage when startups need fresh capital to hire, expand sales and enter new markets. In sectors such as cybersecurity, where buyers can include governments and large companies with long procurement cycles, limited access to growth funding can slow the path from concept to meaningful revenue.

Sales pressure

Founders said generating prospects was their biggest challenge. About 38% cited it as the main hurdle ahead, making customer acquisition a more immediate concern than product development or technical execution.

The survey also found that 67% of organisations were already selling outside the UK. That suggests many cybersecurity startups are looking overseas early in their development, either to find larger markets or to offset constraints in domestic demand.

International sales can provide an important route to growth, but they can also stretch small teams still trying to establish themselves at home. Early cross-border expansion often requires extra spending on compliance, hiring and market knowledge, which may be harder if funding remains concentrated at the smallest end of the market.

AI adoption

Another notable shift was the growing use of artificial intelligence in cybersecurity products. The study found that 62% of the organisations now use AI in their offerings, up from 30% in 2025.

The increase shows how quickly AI has moved from a differentiator to a more common feature in the sector. For many startups, it is becoming part of product design rather than a separate line of research, especially in areas such as automation, detection and analysis.

Rising AI use also suggests competition among cybersecurity startups may be harder to sustain through technology claims alone. If most new entrants adopt similar tools, companies may need to stand out through execution, distribution and customer relationships rather than by simply adding AI to products.

Florian Pouchet, Partner and Head of Cybersecurity and Operational Resilience at Wavestone, said: “UK cybersecurity innovation is growing at record pace and increasingly outside of London. However, founders are struggling to identify prospects, and scaling remains rare, while growth capital continues to contract. If the UK wants to become a sovereign cybersecurity force, the domestic market needs to back the companies it is successfully producing.”

Overall, the study shows a cybersecurity sector with strong entrepreneurial momentum but a narrow path to maturity. With 235 organisations mapped across the market and only nine scaleups identified, the gap between startup creation and sustained growth remains one of the clearest findings in the data.

Thames Water announced that a hosepipe ban will be implemented this week across its areas, with Oxfordshire included.

Following the driest spring in years, three official heatwaves, record temperatures and sustained high demand.

But Oxfordshire residents have reacted with anger to the announcement, as the company remains on the brink of collapse, and residents claim the company fails to fix all leaks.

Hosepipe ban is set to come into place in Oxfordshire. (Image: Melanie Hobson via Getty Images)

Owen Armstrong said: “I very much hope that everyone disregards the ban, I shall gladly disregard the ban myself.

“When you pay for the water, disregard what the water companies say about using a hosepipe!

“When they can splash millions / billions out in bonuses etc then they can certainly go on a hosepipe ban!”

Alan Jones said: “The clue is in the title, the Thames isn’t drying up the reservoirs are full, oh well I’m using a hose.”

Martin CG said: “Just banned the bank from sending you money.”

Thames Water is introducing the Temporary Use Ban (TUB), also known as a hosepipe ban, for all customers it supplies with drinking water.

Pete Walsh questioned the introduction of the ban, he said “data from the Met Office indicates that the first half of 2026 was remarkably unsettled”.

“The UK experienced an exceptionally wet winter and spring, followed by an unusually wet and warm June, resulting in cumulative rainfall totals generally above the long-term average.”

Marc Bridle: “Tell Thames water to go away and go pay the bills what they can’t pay them stop polluting the rivers.”

A protest sign at Thames Water’s HQ in Reading (Image: @Athirty4)

The restrictions will come into effect at 12.01am on Thursday (July 23) and mean customers in the affected areas must not use hosepipes for non-essential activities.

This includes watering gardens, cleaning cars, filling paddling pools or topping up hot tubs.

Yesterday, a spokesperson for Thames Water told the Oxford Mail they are continuing to monitor river levels, reservoir levels, and groundwater levels as South East Water introduce a hosepipe ban.

This comes after South East Water announced that 2.4 million customers in Sussex, Surrey, Hampshire, and Berkshire will be affected by temporary restrictions from Saturday.

Both hosepipe bans come after 28 days this year have seen temperatures exceed 30C somewhere in the UK.

At the end of June Thames Water confirmed soil was drier than average, river flow in the River Thames and River Lee were below average, and reservoirs in London were 89 per cent full which is below average.

However, the water company confirmed Farmoor Reservoir was 99 per cent full, above average for this time of year.

Avalara has published research suggesting UK finance leaders are under pressure to deploy AI agents faster than governance processes can keep pace. The findings are based on a survey of 505 UK chief financial officers and senior finance leaders.

More than nine in 10 respondents said they faced moderate or significant career pressure to show a return on investment from AI agent spending, with half describing that pressure as significant. At the same time, 54% said their AI agent initiatives had delivered only limited measurable return so far, while 74% said deployment pressure was focused mainly on speed.

The figures point to a gap between executive expectations and the controls needed for AI use in finance, where decisions can affect reporting, tax, compliance and audit processes. The report focuses on agentic AI, a category of systems designed to take actions or make recommendations within business workflows.

Governance weaknesses appeared across several measures in the UK sample. Among respondents, 77% lacked dedicated in-house finance expertise able to understand how their AI agents work, leaving many teams reliant on suppliers and IT departments.

Almost half, 47%, said they were only somewhat confident they could explain an AI agent’s actions to an auditor or regulator. Another 21% said accountability for a significant AI agent error in finance would either be unclear or rest with no one, while 48% said AI incident response plans were either untested or still being developed.

Control gaps

The survey suggests the issue is not resistance to AI adoption but uncertainty over how to supervise it once embedded in finance operations. Respondents said the most useful steps for raising confidence in wider deployment centred on trust, data quality and traceability.

Measures cited included AI agents operating within existing systems of record, outputs grounded in verified tax, compliance and financial data, validation against known compliance requirements, supplier commitments on accuracy and accountability, and audit trails documenting each AI action.

The two most valued functions were audit-ready documentation for every AI-driven action and monitoring regulatory changes with updates applied in real time. Those preferences suggest finance teams want tools that can withstand scrutiny rather than systems that simply move faster.

Avalara commissioned the study across four markets, surveying more than 1,500 chief financial officers and senior finance leaders in the UK, US, India and Australia. All respondents had deployed, piloted or actively evaluated AI agents in financial processes over the previous year and worked at companies with revenue above USD $10 million.

The international findings closely tracked the UK numbers. Across all markets, 92% said they felt moderate or significant career pressure to demonstrate AI return on investment, while half said their AI agent programmes had produced only limited measurable return to date.

Only 7% said their organisation prioritised governance over speed, and 30% said internal controls had not been updated within the past year to reflect AI agents taking or recommending actions. Another 44% said they were only somewhat confident they could explain an AI agent’s actions to an auditor or regulator.

Executive pressure

The research places finance leaders in the middle of a broader shift in corporate AI strategy. Many businesses now want AI systems to move beyond drafting text or analysing data into areas where they can initiate or recommend operational decisions.

That creates particular tension in finance because errors can be visible, difficult to reverse and subject to regulatory scrutiny. Tax calculations, reporting decisions and compliance steps often require a documented chain of accountability, something many organisations still appear to be building.

Hugo Sarrazin, Chief Executive Officer at Avalara, said the risk comes when adoption outpaces oversight.

“Finance leaders are right to move quickly to capitalize on agentic AI opportunities, but speed without accountability creates new forms of risk, and speed without rethinking workflows limits ROI. The organizations that realize the greatest value from AI won’t simply deploy more agents. They’ll leverage agents with trusted data, governed workflows, and clear controls that enable automation with confidence,” said Sarrazin.

External industry figures cited in the report made a similar point about the need for broader expertise. The challenge, they argued, is not only technical implementation but understanding what AI agents can access, what they can change and when human approval is needed.

“Finance leaders are being asked to move quickly with AI, but governing agents requires a new combination of domain, AI, IT, and data governance expertise. As AI agents gain access to financial and compliance workflows, organizations need to know what those agents can see, what they can do, and when human approval is required. That kind of control has to be built into the architecture, not added after the fact,” said Frank Cirone, VP Commercial Strategy at Snowflake, a cloud data platform company.

Jim Lundy, Founder, CEO and Lead Analyst at Aragon Research, framed the issue as one of explainability as much as automation.

“AI agents are now moving into business processes that require trust, transparency, and governance by design. As enterprises scale agentic AI, the question becomes less about whether the technology can act and more about whether organizations can understand, control, and explain those actions. In finance, where workflows are auditable and outcomes carry real business consequences, governance and explainability will become essential requirements for adoption,” said Lundy.