Budget 2026 cyber security spending came to £154 million, and almost none of it is money your business can apply for. The money goes to a new vulnerability-finding centre at the National Cyber Security Centre, to hardening the public sector technology estate, and to the first phase of a national Cyber Shield built on agentic AI. All of it is useful work. None of it changes what you do on Monday morning.
Two lines in the Budget document do change something, though. Neither is a funding line, and neither made the headlines.
The most consequential cyber measure in this Budget costs nothing. The government will consult next year on where liability for a cyber breach should sit, and on how to tackle insecure technology at source.
Where the £154 Million Goes
The Budget 2026 document sets out three cyber commitments under a single heading, “To deliver a step change in UK cyber defence”. Together they make up the £154 million quoted in the executive summary.
| Commitment | Amount | What it is |
|---|---|---|
| NERV Centre | £70m | National Exposure and Real-Time Vulnerability Centre, established at the NCSC |
| Public sector AI defence programme | £24m | Hardening the public sector technology estate, across 2026-27 to 2029-30 |
| National Cyber Shield, first phase | £60m | Agentic cyber defence, including a £25m challenge fund |
| Total | £154m |
A fourth commitment sits immediately below them and is counted separately: £40 million for a new National Agentic Security Unit. We come back to that one, because it is the most revealing line in the document.
Most of the coverage this week put the cyber figure at £130 million. That is the £70 million and the £60 million added together, and it leaves out the £24 million public sector line. If you see £130 million quoted, it is short by £24 million. The Budget’s own executive summary says £154 million, and the three commitments reconcile to it exactly.
The Budget 2026 cyber security commitments sit inside a larger envelope. The government says it has invested “over £700 million” in AI at this Budget, of which “around £500 million” goes to what it calls the secure foundations for an AI-enabled economy. Also in that envelope: £120 million more for the AI Security Institute, £165 million for a National AI Biosecurity Initiative, and £140 million more for the Sovereign AI Unit, most of which the government trailed ahead of the statement. The cyber lines are the part aimed at defending the country rather than building the industry.
At Transputec we read a Budget the way we read a vendor roadmap. The figures tell you about intent. The sentences around them tell you what is going to land on a UK business. On that test, the money here is the least interesting part.
The Most Important Line in Budget 2026 Cyber Security Is Not a Number
Here is the sentence, in full:
Building on the Law Commission’s product liability consultation, the government will consult next year on how to tackle insecure technology at source and consider where liability for cyber breaches should sit.
Read it twice. Today, if you are breached through a flaw in software you bought, the cost lands on you. You pay for the incident response, the notification, the downtime and whatever the regulator decides. The vendor that shipped the flaw pays nothing, because liability for a breach has never been clearly assigned to anyone other than the organisation that got breached.
The government is now asking whether that should change.
Be precise about what has happened, because this is where commentary will get ahead of itself. This is a consultation. It has not opened. “Next year” means some point in 2027. There is no draft legislation, no proposed wording, and no signal about which way the government is leaning. Anyone telling you this week that software vendors are about to carry the cost of your breach is guessing.
What you can take from it is direction, and direction matters for two decisions you are making now.
The first is contractual. If liability for cyber breaches is open for debate at government level, the liability clauses in the software and managed service contracts you sign in 2027 deserve more attention than the ones you signed in 2024. Caps, indemnities and security warranties are the clauses in question, and they are usually the ones nobody reads.
The second is insurance. Cyber insurers already price your controls, and a shift in where legal liability sits would change both what they underwrite and who they expect to recover from. If you are renewing, it is a fair question to put to your broker. We have set out the security controls cyber insurers require, and that list is the practical starting point whichever way the consultation goes.
The first half of the sentence deserves attention too. “How to tackle insecure technology at source” is policy language about moving the burden towards the people who build and sell technology rather than the people who buy it. If the UK moves that way, the effect on a buyer is that procurement gets sharper: you will be expected to evidence what you asked your suppliers, not just repeat what they told you.
Do you already know what the NERV Centre will see?
The government is spending £70 million to map national cyber exposure. Mapping your own is a far smaller job, and it is the one that pays. Book an initial security consultation with a Transputec security architect.
Book a consultationThe NERV Centre Will Look at the Wider Economy, Not Just Critical Infrastructure
The largest single line in the Budget 2026 cyber security package is £70 million for a National Exposure and Real-Time Vulnerability Centre, the NERV Centre, to be established at the National Cyber Security Centre. Chapter 5.7 describes its job as strengthening “the UK’s ability to understand and reduce national cyber exposure”.
The policy decisions chapter is more specific, and more interesting:
A new £70 million National Exposure and Real-Time Vulnerability (NERV) Centre will deploy AI tools to identify cyber vulnerabilities across our critical infrastructure and the wider economy.
“And the wider economy” is doing a great deal of work in that sentence. Most government cyber capability is scoped to critical national infrastructure, which is a defined and fairly small set of operators. This is scoped to the economy.
Finding vulnerabilities across the wider economy at scale means scanning what is reachable from the internet. Your externally exposed estate is about to be catalogued more systematically than it ever has been, by a well-funded capability using AI tooling, and nobody is going to ask your permission first.
That is not a threat. The NCSC is not an adversary, and a national early warning capability is a genuinely good thing to have, particularly for organisations too small to run their own. But it carries a consequence that is easy to skip past: anything the NERV Centre can find, an attacker with a scanner can also find. The difference is that attackers have been doing it for years and nobody was sending you the results.
So the real question the NERV Centre raises is not what the government will see. It is whether you already know what it will see. If the answer is no, that gap exists today, and it existed last week.
The cost of not knowing is not theoretical. When the PHP2Shell vulnerability landed this month, the organisations that patched quickly were the ones that already knew where PHP was running. The rest spent the first day working out what they owned, which is the worst possible day to be doing inventory.
Keeping that inventory current is what vulnerability management does, and it is the Transputec service this Budget line maps onto most directly. If you would rather test the exposure than catalogue it, penetration testing answers a narrower question with more certainty.
A £40 Million Unit for AI Agents That Go Wrong
Of everything in the Budget 2026 cyber security package, this is the line that should make anyone running Copilot agents sit up:
Invest £40 million into a new National Agentic Security Unit to develop new capabilities to detect, investigate and respond to cases of rogue agentic systems. This will integrate monitoring and incident response functions with new operational capabilities.
Governments do not fund incident response units for things they expect not to happen. The existence of this unit is a statement that agentic incidents are coming, at a scale that warrants a national function, and soon enough to put money behind now.
Look at the verbs: detect, investigate, respond. That is incident response language. This unit is not being set up to publish guidance about agentic risk. It is being set up to handle cases.
If your organisation has deployed AI agents, the question it implies is uncomfortable and specific. When one of your agents does something it should not, who notices, and who owns it? Not in principle. By name.
This is the gap we wrote about in Copilot agent governance, where agents now hold their own accounts in Microsoft 365 and therefore their own permissions, and again in application identity attacks, where a non-human identity with standing permissions was the route in and multi-factor authentication was never going to stop it. An agent is a non-human identity that acts on its own initiative. Everything that was already hard about service principals gets harder when the identity makes decisions.
Three questions worth answering before the government’s unit is operational.
Who owns each agent in your tenant, by name, and is that recorded anywhere other than in somebody’s head?
What can each one reach, and when was that last reviewed rather than last approved?
If an agent acted outside its remit at two in the morning on a Sunday, what would tell you? A managed SOC watches identity and endpoint signals around the clock, and non-human identities are the part of that picture most organisations have not yet thought to ask their provider about.
What the £24 Million Means for Councils, Hospitals and Schools
The quietest of the Budget 2026 cyber security lines is the most concrete for one group of readers. The government will expand the public sector AI defence programme with an additional £24 million
to systematically harden the public sector technology estate and ensure benefits are felt across local authorities, hospitals and schools.
The policy decisions chapter dates it. The £24 million runs between 2026-27 and 2029-30, for “hardening our public sector AI defences and making AI-enabled cyber defence tools available across public services”.
Two readings matter here.
If you work in the public sector, tooling is coming centrally. That does not move your obligations, and it is worth being clear-eyed about timing: money profiled across four financial years arrives as a programme, not as something you install next quarter. Your NHS Data Security and Protection Toolkit submission is still yours to make, on the current deadline, with the controls you have now.
If you sell to the public sector, this is procurement. Twenty-four million pounds of AI-enabled cyber defence tooling will be bought through frameworks, and G-Cloud 15 is where a fair amount of it will land. The advice is the same as it always is: the framework gets you considered, the evidence gets you awarded.
There is a third reading nobody will put in a press release. Naming local authorities, hospitals and schools explicitly is an admission of where the weakest estates are. If your supply chain touches any of those three, their exposure is partly yours.
The Capital Allowance Change That Affects Your 2027 Security Refresh
This is the part of the Budget that changes your own numbers, and it is nowhere near the cyber chapter.
The government has cut the main rate of writing down allowances by two percentage points, taking it to 12%, and at the same time raised the main rate First Year Allowance from 40% to 50%. Full expensing is maintained and the headline rate of Corporation Tax stays capped at 25%.
Security hardware is plant and machinery. Firewalls, switches, servers, the appliances in your racks. So the change cuts both ways for anyone with a refresh in the plan.
Buying new qualifying kit gets better. The First Year Allowance rises from 40% to 50%, so half the cost comes off taxable profit in year one instead of two fifths.
Holding it gets slightly worse. Whatever sits in the main pool afterwards writes down at 12% a year rather than 14%, with effect from 1 April 2027 for Corporation Tax and 6 April 2027 for Income Tax.
The net effect is to pull investment forward, which is the stated intention. The Budget describes reformed capital allowances as strengthening “the upfront incentive to invest while also raising revenue”. If you have a network or server refresh sitting in a 2027 or 2028 plan, the timing is now a question for your finance director rather than an assumption.
One smaller change is worth knowing. R&D tax reliefs are being simplified, and the Claim Notification Form goes from 1 April 2027. If you build software and claim R&D relief, that is one less form to file.
What Business Asked For and Did Not Get
techUK’s submission to HM Treasury, published on 29 September, made two asks that would have changed the economics of security spending for ordinary UK businesses.
The first was a cyber resilience allowance, described as “a capped reduction in VAT on qualifying products and services”, to encourage firms to invest in their own defences.
The second was on skills: that the levy-eligible training course list be finalised promptly and include “courses on digital skills such as AI and cyber”, so security training could be funded through the Growth and Skills Levy.
Neither is in the Budget. The phrase “cyber resilience allowance” does not appear in the document at all, and neither does the Growth and Skills Levy.
That is the shape of the Budget 2026 cyber security package in a single observation. There is substantial money for national capability and nothing for the firms that actually get attacked. If you want your people trained, you are still paying for it out of taxed profit with no relief attached.
There is a sting in the skills half of that. The Budget does fund cyber and AI skills, just not yours. It establishes an AI Cyber Security Centre of Excellence in Manchester, described in the policy decisions chapter as training “the next generation of cyber and AI security expertise outside of London”. National capability gets trained. Your staff still do not.
There is a second absence worth recording. The Cyber Security and Resilience Bill is not mentioned anywhere in the Budget document. Not in the cyber section, not in the policy decisions chapter, nowhere. That is the legislation which will create new duties for UK organisations, and it got no funding line and no mention. We have set out what the Bill means if you are not regulated, and this silence does not change its progress through Parliament. It does tell you which workstream had the Treasury’s attention this autumn.
Make of the combination what you will. A large investment in seeing the threat, a consultation on who pays when it lands, and nothing to help you prepare.
How We Read Budget 2026 Cyber Security for Clients
Nothing in the Budget 2026 cyber security package needs a response this week. These are commitments, most of the money is profiled out to 2029-30, and the one measure that could change your obligations is a consultation that has not opened.
What it does is put a date against three pieces of work that were already sensible.
Know your external exposure before somebody else catalogues it. That is an inventory problem before it is a tooling problem, and it is cheaper to answer now than during an incident.
Name an owner for every non-human identity, agents included. This is the one we expect most organisations to fail cleanly, because nothing breaks while it is wrong.
Read the liability clauses in your next contract properly. Not because the law has changed, but because the government has said out loud that it is willing to look at where liability sits, and a contract signed in 2027 will outlive the consultation.
Our part in that is ordinary consultancy work rather than anything this Budget created: a round-the-clock UK Security Operations Centre, vulnerability management, penetration testing and cyber incident response, starting with an initial security assessment rather than a proposal. If you want to see the baseline questions we work from, they are the same ones in our cyber health check write-up.
Where to Start
The Budget 2026 cyber security lines amount to a national capability programme. Seventy million pounds to find vulnerabilities, sixty million to automate defence, twenty-four million to harden public bodies, and forty million to deal with AI agents that go wrong. That is a serious commitment to seeing the problem more clearly than we do now.
What it does not do is help a mid-sized UK business defend itself. No allowance, no relief, no training money. The one measure aimed squarely at private organisations is a consultation, next year, about where the cost of a breach should land.
So the useful response is not to wait for any of it. Find out what you are exposing, name who owns your agents, and read your liability clauses. The government has announced what it intends to look at. Looking first is still your job.
If you want a second pair of eyes on any of the three, Transputec’s security architects do this work daily across UK mid-market and public sector estates. Talk to our team about the security work behind the headlines.
Frequently Asked Questions
How much did the Budget commit to cyber security?
Budget 2026 cyber security commitments total £154 million: £70 million for the NERV Centre, £24 million for the public sector AI defence programme and £60 million for the first phase of the National Cyber Shield. A further £40 million establishes a National Agentic Security Unit, which the Budget counts separately. Much of the reporting quoted £130 million, which omits the £24 million public sector line.
What is the National Cyber Shield?
The National Cyber Shield is a £60 million programme to develop agentic cyber defence capabilities, delivered in partnership with the UK cyber security industry. Its first phase includes a £25 million AI and Cyber Security Challenge Fund for UK innovators, and the government is scoping a regulatory deployment sandbox to help organisations adopt the resulting tools.
What is the NERV Centre?
The National Exposure and Real-Time Vulnerability Centre is a new £70 million unit at the National Cyber Security Centre. It will deploy AI tools to identify cyber vulnerabilities across critical infrastructure and, in the Budget’s own words, the wider economy. That scope reaches past the usual critical national infrastructure operators to ordinary organisations with internet-facing systems.
Does the Budget change my legal duties on cyber security?
Not yet. The Budget announces a consultation, not a change. The government said it will consult next year on how to tackle insecure technology at source and where liability for cyber breaches should sit. No draft legislation exists and no wording has been proposed. Your current duties come from existing law and from the Cyber Security and Resilience Bill, which the Budget does not mention.
Was there any tax relief for cyber security spending?
No. techUK asked for a cyber resilience allowance, in the form of a capped VAT reduction on qualifying security products and services, and for AI and cyber courses to be levy-eligible. Neither appears in the Budget. The capital allowance changes apply to plant and machinery generally, which includes security hardware, but there is no cyber-specific relief.
This article was drafted with AI assistance and reviewed by the Transputec team. Featured image: AI-generated.
