Home › Types of cyber work
Types of cyber work
We put every cyber contract into one or more types of work. Choose a type to read its awards, free.
Each contract’s type of work is set by our written rules, and we check samples by hand. If one looks wrong, email [email protected].
Each type at a glance
| Type of work | Awarded, 12 months | Current contracts | Published, 12 months |
|---|---|---|---|
| SOC, detection and response → | 201 | 283 | 220 |
| Network security → | 205 | 321 | 221 |
| Endpoint protection → | 25 | 43 | 26 |
| Penetration testing → | 116 | 129 | 122 |
| Governance, risk and audit → | 126 | 141 | 135 |
| Training and awareness → | 71 | 87 | 74 |
| Digital forensics → | 46 | 55 | 47 |
| Identity and access → | 64 | 87 | 72 |
| Backup, recovery and resilience → | 40 | 51 | 43 |
| OT, ICS and IoT security → | 4 | fewer than 10 | 6 |
| Cyber insurance → | 21 | 15 | 23 |
| Cyber staffing and interim roles → | 5 | fewer than 10 | 5 |
Awards are free to read. Current contracts are for subscribers. A contract with more than one type of work counts under each.
How you can win it
| How you can win it | Awarded, 12 months | Current contracts | Published, 12 months |
|---|---|---|---|
|
Bid alone
The cyber work is its own contract, so a cyber firm can bid for it as the main supplier.
|
310 | 402 | 336 |
|
Bid with a partner
The cyber work is part of a bigger contract, or the firm that won it does not sell cyber. To win this work, you join as a delivery partner to the main supplier.
|
37 | fewer than 10 | 47 |
|
Framework
The buyer bought through a framework. You need a place on the framework to win work from it.
|
508 | 747 | 531 |
|
Licence renewal
The buyer renewed a licence or a subscription. These usually go back to the same supplier or its reseller.
|
61 | 70 | 64 |
A contract has one of these, so this column adds up to every cyber contract we published in the last 12 months that is free to read. The table above counts a contract under each of its types, so that one does not.
What each type means
Types of cyber work
- Penetration testing
- A security test of a set scope, such as a pen test, IT health check or red team.
Example: Penetration testing/IT Health Checks 2026, Driver And Vehicle Standards Agency, £533K.
- SOC, detection and response
- An ongoing service that watches an organisation's systems and responds to attacks.
Example: Provision of Managed Security Operations Centre (SOC), EAST WEST RAILWAY COMPANY LIMITED, £208K.
- Identity and access
- Control over who can get into which systems, such as MFA and privileged access.
Example: Privileged Identity and Access Management, MERSEY CARE NHS FOUNDATION TRUST, £190K.
- Network security
- Firewalls, web and email filtering, VPN and secure access, and their management.
Example: Contract for Firewall Solution, Herefordshire Council, £95.2K.
- Governance, risk and audit
- Certification, audit, risk assessment or advice on how security is run, such as ISO 27001, Cyber Essentials or CAF.
Example: Cyber Assessment Framework (CAF) Assurance for Local Authorities (Interim), Ministry of Housing, Communities and Local Government (MCHLG), £113K.
- Training and awareness
- Training that changes what staff know or do, such as phishing simulation.
Example: Provision of Cyber Security Awareness Training, Blackburn with Darwen, £61.2K.
- OT, ICS and IoT security
- Security for industrial control systems and connected devices.
Example: AGHS Remote Access and Cybersecurity Upgrade, UK Atomic Energy Authority, £623K.
- Backup, recovery and resilience
- Getting data back after an attack, when the notice states a security purpose.
Example: Cyber Data Resilience, Surrey and Borders Partnership NHS Foundation Trust, £147K.
- Cyber insurance
- Insurance against cyber attacks, or a broker to buy it.
Example: Cyber Insurance Policy, Wirral Council, £86.1K.
- Digital forensics
- Examining phones, computers and other devices for evidence.
Example: Digital Forensic System, The Police, Fire and Crime Commissioner for Cumbria, £77.6K.
- Endpoint protection
- Software that protects the computer, server or phone itself, such as antivirus.
Example: Sophos Antivirus Renewal for SYP & HP, South Yorkshire Mayoral Combined Authority, £97.6K.
- Cyber staffing and interim roles
- Hiring a person to do security work, such as a SOC analyst or an interim security lead.
Example: Cyber Security Operations Lead, Scottish Courts and Tribunals Service, £300K.
- Cyber work, type not named
- The notice buys cyber work but does not say which kind.
Example: Cyber Security Services 2025-28, The Wheatley Housing Group Limited, £426K.
- Other cyber work
- Research, guidance or evaluation work that needs cyber technical skill but is not a security service. Usually won by a research organisation; shown as a partnering opportunity.
Example: Drafting Guidance for Cybersecurity Testing, Department for Business & Trade, £23.3K.
How the contract was bought
- Multi-service and framework contracts
- A framework or call-off contract that many buyers can use.
Example: Digital Forensics Framework, Financial Conduct Authority, £125K.
- Cyber inside a bigger contract
- A named cyber part inside a wider IT contract.
Example: IT Managed Services Provider, Royal Armouries Museum, £1.3M.
- Licence and subscription renewals
- A renewal of a security product licence or subscription.
Example: CBMDC 736 - Tenable, City of Bradford Metropolitan District Council, £176K.
- Bought on its own, as a separate contract
- The cyber work is a separate contract.
Example: Invitation to Tender - Red Team-Ethical-Hacking-services, West Suffolk Council, £56.3K.
Two groups do not fit any type: Cyber work, type not named and Other cyber work. They hold 166 of the 3,031 contracts, and we show them so you can see what our types do not cover.
What we leave out
- Remove the cyber words from the notice. If the contract is still the same, it is not cyber.
- Cyber must be what the buyer pays for. A contract only about the subject of cyber, such as a survey or an event, does not count.
- Backup and disaster recovery count only when the notice states a security purpose, such as recovery after a cyber attack.
How we decide what counts as cyber · Every notice we left out
Read every award
Every award, newest first. You can sort it by date or value.