Home › How we decide
How we decide what counts as cyber.
Every contract is judged against one written rule set. The rules have version numbers, and we record every change to them.
We give each reason in plain words, not as a score or a code.
What the filter does
- 302,788
- notices read since 2022
- 5,522
- mentioned cyber, so we checked them
- 3,031
- we kept
- 2,465
- we rejected
The notices merge into contracts, because one contract is often published more than once.
2,821 of the 3,031 we kept are free to read. The other 210 have no award yet - seeing those early is what subscribers pay for.
We check every notice against written rules. 26 were too close to call, so we publish them for you to judge. Read every notice we ruled out.
Where the records come from
Every record comes from three public websites. Find a Tender covers the whole United Kingdom. Public Contracts Scotland covers Scottish notices below the threshold. Contracts Finder covers procurements started under the old rules, before 24 February 2025, and call-offs from frameworks set up under them. Almost all new cyber notices there are awards.
The most recent notice was published 14 Oct 2026.
2,510 of 2,538 awarded cyber contracts name the winning supplier. The other 28 do not.
Most contracts do not have a region recorded yet, so you cannot filter by nation for now.
What is free and what is paid
UK public sector cyber awards are free to read: who won, who bought it and the price. Subscribers also see what is coming: open tenders, planned work and when contracts end. See what subscribers get.
Open tenders and planned work. These are for subscribers only. A subscriber sees each one on the day it is published. A tender becomes free to read after its deadline. A tender with no deadline stays subscriber-only until an award is published.
Contract end dates. End dates are for subscribers only. A free reader sees how many contracts end in each period and in each type of work, but not which contracts. When a contract has ended, anyone can see its end date. Awards, values and supplier names are always free.
What each number on this site counts
Every total on this site is defined here, in one place, so the same word always counts the same thing.
| What we call it | What it counts |
|---|---|
| Awards you can read | Contracts we judged cyber where the buyer has published an award. Free to read, whoever you are. A contract filed twice is counted once. |
| Open tenders | Contracts we judged cyber that are out to tender and still before their deadline. A tender becomes free to read after its deadline. |
| Planned work | Contracts we judged cyber that a buyer has said it intends to buy, with no tender published yet. |
| Contracts with a known end date | Contracts we judged cyber that are running today, name a supplier, and have an end date the buyer published. The dates are for subscribers. |
| End dates, where cyber is inside a bigger contract | Counted separately and never added to the figure above it, because the named supplier of a bigger contract is often not a cyber firm. |
| Cyber contracts awarded in the last 12 months | Every contract we judged cyber where the buyer published an award in the last 365 days. A contract filed twice is counted once. It does not matter whether the buyer published a price. |
| Worth, where the buyer published a value | The total of published award values for cyber contracts awarded in the last 12 months. It leaves out frameworks shared by several winners, and contracts where cyber is part of a bigger contract. Where a value was published including VAT, we remove the VAT (divide by 1.2). Insurance is the exception: premiums are not charged VAT, so we use the figure as published. Values in euros are converted at €1 = £0.86305. |
| How many of those have a value | How many of the contracts above have a published value we can add up. The rest either have no price in the notice, or have one that covers more than the cyber work. |
| Suppliers on record | Firms named as a winner on at least one cyber award. Two spellings of one firm count once. |
| Buyers on record | Public bodies that have bought at least one cyber contract. Two spellings of one buyer count once. |
| UK notices read | Every notice we have downloaded since 2022, including every re-publication of one contract. |
How you can win it
Every contract has one of four labels. Each label says how your firm could win the work, not how the buyer ran the purchase.
| Bid alone | The cyber work is its own contract, so a cyber firm can bid for it as the main supplier. |
| Bid with a partner | The cyber work is part of a bigger contract, or the firm that won it does not sell cyber. To win this work, you join as a delivery partner to the main supplier. |
| Framework | The buyer bought through a framework. You need a place on the framework to win work from it. |
| Licence renewal | The buyer renewed a licence or a subscription. These usually go back to the same supplier or its reseller. |
What the Product label means
Some cyber contracts buy a thing. Others buy people to do work. We mark the first kind Product, so a firm that sells testing or monitoring can skip the licence renewals, and a reseller can find them.
A contract is a product when what the buyer gets is mainly a software licence, a subscription, a hardware appliance, the support, maintenance or renewal of a named product, or a reseller supplying a named product.
It is not a product when what the buyer gets is mainly people doing work: testing, monitoring, consultancy, audit, training or incident response. A managed service is not a product even when it includes one, because the buyer is paying for somebody to run it.
Where a notice buys both, we call it a product only when the product is the main item and the service is just installing or supporting it. A cyber insurance policy is never a product: it is cover, and the firm that wins it is an insurer or a broker.
The label is separate from the type of work and from how the contract was bought. A firewall licence is still network security, and it can still be a framework call-off or a renewal. If one looks wrong, email [email protected].
Why we keep contracts where cyber is a small part
Some contracts here are managed IT or audit contracts, and security is only one part of them. A cyber specialist usually cannot bid for these as the main supplier. So we label them cyber inside a bigger contract everywhere, and we list them last on category pages, on Renewals and on the supplier list. Renewals counts them separately: 1219 renewing, and 130 more where cyber is inside a bigger contract.
We keep them for three reasons. First, the current supplier runs the buyer’s IT, so that is the firm to work with if you want to sell to that buyer. Second, the end date is when the buyer can buy security separately, and these contracts usually publish an end date. Third, if your client is an IT services company with a security team, the contract is relevant to them.
228 of 2,821 contracts are like this. Where one has a value, the value is for the whole contract, not the cyber part. So we show it with “covers more than the cyber work” beside it, and we leave it out of every total. We do not post them on LinkedIn, because you usually cannot bid for them.
Digital forensics for the police is included
Police forces buy digital forensics. It is close to cyber security but not the same, because it investigates a crime and does not protect a system. The 2,821 count includes it.
One contract, one row
A single procurement is often published several times: a planning notice, a tender, an award, then corrections. We show it once, with every notice listed underneath.
An end date is not always fixed
447 of the 2617 end dates we hold come from a signed contract. 2044 are the buyer’s own estimate. For the other 125, the buyer published no date at all - only a length in words, such as “an initial 36-month term” - so we added that length to the signing date. For 1, the buyer wrote the date in the notice text instead of in a date field, and we read it from there. We label every kind everywhere a date appears.
What we cannot see
If a buyer never published an award notice, we cannot show the contract. This is the largest gap we know of.
Each contract is judged once
We judge each contract under the rules in force on that day. When the rules change, we do not judge older contracts again.