NAVIZIX
All playbooksStartup & tech

Cybersecurity firm playbook.

An early-stage London cybersecurity firm — either a product company (SaaS detection / response / posture / identity) or a services firm (pen-testing, red-team, CISO-as-a-service, SOC). The win is reaching first mid-market / enterprise UK contracts while holding CREST / NCSC CHECK / Cyber Essentials Plus accreditations + ISO 27001 + SOC 2.

Start your 7-day free trialNo card needed today. Your 7-day free trial starts when you sign up. Card payments are not open yet, so nobody is charged and you keep full access until they open.or book a demo →
Overview

A London cybersecurity firm at pre-seed → Series A is one of two models — a services firm (pen-test / red-team / CISO-as-a-service, predictable utilisation cash) or a product company (volatile MRR, venture-scale upside). Hybrids work if services revenue funds product without diluting credentials. The biggest lever is accreditation discipline — without CREST + Cyber Essentials Plus + ISO 27001 you cannot bid for FS / public-sector / FTSE work. The second lever is talent — CHECK / OSCP-qualified engineers in London command £85k–£140k; under-paying creates immediate churn that breaks delivery. This playbook covers operationalising a London cyber firm from incorporation through first £500k–£1.6m revenue (services) or £40k+ MRR (product).

£1,200–£1,800 London 2026
Pen-test day-rate
£40–£140 / endpoint / yr
MDR ARR per endpoint
12–18 months from incorporation
CREST member-firm timeline
What you'll need

Equipment list with real 2026 UK prices.

Sized for a 2–4 chair shop. Buy mid-range on chairs and clippers; cheap kit fails inside 12 months and walks away with your barbers.

01

Team setup (5–14 staff)

Hardened workstation per FTE + YubiKeys
£2,400–£4,200 each + £80 / key
Co-working (Plexal-cybersecurity / Level39 / IDEALondon)
£420–£980 / desk / month
Secure lab (faraday bag, jump host, isolated VLAN)
£3,400–£14,000 one-off
Burner-phone + portable test kit (pen-test)
£900–£3,400
02

Product + delivery infra

Cloud + sandboxed lab (AWS dedicated + Hyper-V / Proxmox)
£600–£8,400 / month
EDR + SIEM stack (CrowdStrike / SentinelOne + Splunk / Sentinel)
£600–£8,400 / month
Threat-intel feeds (Recorded Future / Mandiant / open-source)
£420–£14,000 / month
Burp Suite Pro + Cobalt Strike + commercial pen-test stack
£3,400–£14,000 / yr
Reporting + ticketing (Dradis / PlexTrac / Jira)
£280–£1,400 / month
03

Compliance + GTM

ISO 27001 + Cyber Essentials Plus + SOC 2 Type II
£18,000–£48,000 / yr
CREST + NCSC CHECK accreditation
£4,800–£18,000 / yr + audit time
PI + cyber insurance (high cover)
£8,400–£32,000 / yr
CRM + ABM (HubSpot + Apollo / 6sense)
£420–£2,400 / month
Accounting (Xero) + payroll (Pento)
£40 + £8/employee / month
Where to set up

Location is half the business.

FS + regulated buyer density
Within 30 min of City / Canary Wharf

Banks + insurers + asset managers expect on-site pen-test scoping + incident-response runbooks.

Public-sector + NCSC access
Within 1 hr of Whitehall + GCHQ Heron House (Manchester) for occasional travel

Cabinet Office / NCSC procurement runs face-to-face stakeholder cadence.

Cyber-VC + accelerator density
EC2 / E1 / Canary Wharf (Level39)

UK cyber-active VCs (AlbionVC / Forward / Octopus / OUTI / NATO Innovation Fund) cluster here.

Office presence (CREST + accreditation)
Registered UK office + secured premises

CREST + Cyber Essentials Plus require evidenced physical security controls.

Area tier
Rent / month
Notes
City / Liverpool Street (EC2, EC3)
£540–£1,200 / desk
Closest to FS buyers; expensive.
Canary Wharf / Level39 (E14)
£480–£1,000 / desk
Cyber-specific incubator; FS adjacency.
Plexal-Stratford (E20)
£380–£820 / desk
Cyber-specific hub backed by DCMS / NCSC; lower cost.
Licences & registrations

Get the paperwork done before you sign a lease.

UK figures for 2026. Lead times assume you submit complete applications — councils will pause the clock if you miss documents.

Requirement
Who issues
Cost
Lead time
ReqCompanies House Ltd + EMI + IP assignment
Companies House + solicitor
£600–£3,400
1–2 weeks
ReqICO + DPO + DPIA + breach-notification process
ICO + DPO
£60 + £140–£420 / month
1–3 weeks
ReqCyber Essentials Plus + ISO 27001
IASME / cert body
£14,000–£32,000 / yr
6–12 months
OptSOC 2 Type II (US + enterprise sales)
AICPA-affiliated auditor
£14,000–£40,000 / yr
9–14 months
OptCREST member + NCSC CHECK
CREST / NCSC
£4,800–£18,000 / yr
12–18 months
ReqPI insurance + cyber + employer's liability
Insurer
£8,400–£32,000 / yr
2–4 weeks
OptVetting (SC / DV for public-sector work)
UKSV
£0 to firm + 6–12 wk lead per analyst
6–12 months
Build-out timeline

From decision to open in 12 weeks.

01

Months 1–3 · Incorporate + Cyber Essentials Plus

1–12
  • Topco + EMI + IP assignment + Vanta live
  • Cyber Essentials Plus achieved
  • Hardened workstation + secure-lab build
  • ICO + DPIA + breach-notification process
02

Months 4–9 · ISO 27001 + first delivery

13–36
  • ISO 27001 stage 1 audit + first pen-tests delivered
  • First 6–10 paid mid-market clients (£20k–£80k each)
  • Begin CREST member-firm application
  • Reach 65%+ analyst utilisation or first £8k–£20k MRR
03

Months 10–18 · CREST + first FS / public

37–72
  • ISO 27001 + SOC 2 Type I (if US sales)
  • CREST member-firm achieved
  • First FS / public-sector contract (£40k–£140k)
  • Hit £500k–£900k revenue or £40k+ MRR; open Series A
04

Months 19–30 · Scale + NCSC CHECK

73–120
  • NCSC CHECK + SC-cleared analyst bench
  • Grow to £900k–£2m revenue or £120k+ MRR
  • Annual ISO + CREST surveillance
  • Series A close + EU / GCC expansion optional
Budget

Realistic startup and monthly cost ranges.

One-off · Startup

Setting up the shop

Legal + topco + EMI + IP
£6,800 → £22,000
Cyber Essentials Plus + ISO 27001 (yr 1)
£14,000 → £32,000
Secure lab + hardened-workstation kit (10 FTE)
£24,000 → £48,000
EDR / SIEM / Burp / Cobalt Strike / threat intel (yr 1)
£14,000 → £60,000
Office deposit + first 6 months desks
£12,600 → £32,000
PI + cyber insurance + CREST application
£12,000 → £40,000
Typical total
£83,400 – £234,000
Recurring · Monthly

Keeping the lights on

Co-working (10 desks)
£4,200 → £10,400
EDR + SIEM + cloud + threat-intel
£2,400 → £14,000
Compliance + fractional DPO + audit prep
£2,000 → £6,800
Salaries (10 FTE blended £82k)
£54,000 → £82,000
GTM + ABM + content + events
£2,400 → £10,400
Insurance + accreditation maintenance
£1,400 → £4,800
Typical total
£66,400 – £128,400
Numbers that compound

How a cybersecurity firm actually looks on a chart.

Illustrative planning ranges, not measured customer data. Toggle the views to see ramp, mix and weekly load.

12-month revenue ramp
Low vs high scenario (£ monthly)
High Low

Illustrative example for planning, not measured customer data.

First 90 days

Dates that actually matter after opening.

01Day 0

Topco incorporated; secure-lab build started

02Day 30

Cyber Essentials Plus + Vanta live; ICO registered

03Day 120

First pen-tests delivered; £20k+ booked

04Day 240

ISO 27001 stage 1; 65%+ utilisation or £10k MRR

05Day 360

ISO 27001 + CREST application submitted; first FS contract

06Day 540

CREST member; £700k+ revenue or £80k+ MRR; Series A data room ready

What's inside

DNA, route, automations, integrations, benchmarks, advisors — tuned for a cybersecurity firm.

01Move
DNA dimensions

ARR per protected endpoint / user / SOC seat (product) or utilisation + day-rate (services), CREST + NCSC CHECK + Cyber Essentials Plus + ISO 27001 + SOC 2 accreditation status, runway months and renewal / repeat-engagement rate.

02Move
Suggested route

Pick a wedge (managed-detection / posture / identity / pen-test / CISO-as-a-service), prioritise CREST + Cyber Essentials Plus + ISO 27001 from day one, sell into UK regulated sectors (FS / health / public sector) via NCSC + UK Cyber Security Council channels.

03Move
Automations

Daily incident + alert digest, weekly account-health + renewal pipeline, monthly accreditation-evidence pack refresh, weekly investor / partner update, NCSC + CISA + UK threat-feed monitor, ICO breach-notification timer.

04Move
Integrations

EDR (CrowdStrike / SentinelOne / Defender), SIEM (Splunk / Sentinel / Elastic), IdP (Okta / Entra ID / WorkOS), ticketing (Jira / ServiceNow), Vanta / Drata, HubSpot CRM, Trustpilot + G2.

05Move
Benchmarks

ARR per endpoint, MTTR + MTTD (product), utilisation + day-rate + repeat-rate (services) vs UK Seed–Series A cyber firms in same wedge, refreshed monthly.

06Move
Advisors

Encore advisors who have built CREST-accredited consultancies or shipped UK-regulated cyber products + closed FS / public-sector contracts, plus NAVIZIX AI for runway + accreditation-cycle projection.

Stack

Modules used in this playbook.

01DNA Engine02Route Map03Launch Twin04Automation05Verified06Encore
Related playbooks

Owners of a cybersecurity firm often run — or cross-sell with — these adjacent operations.

Playbook
SaaS startup
Open
Playbook
AI startup
Open
Playbook
Fintech startup
Open
Playbook
Healthtech startup
Open
Start with this playbook

7-day free trial. No card needed today.

Start your free trial and the cybersecurity firm playbook loads on day one.

Start your 7-day free trialNo card needed today. Your 7-day free trial starts when you sign up. Card payments are not open yet, so nobody is charged and you keep full access until they open.
← All playbooksTalk to the founders →