London is the centre of the UK cyber security services market. The City’s banks and insurers, the capital’s law firms, government departments and thousands of fast-growing technology businesses all buy penetration testing, managed detection and response, incident response and security consulting here. The result is a crowded field, ranging from global security groups with thousands of staff to specialist testing firms with a few dozen consultants.
This list of cyber security companies in London focuses on service providers: consultancies, managed security service providers (MSSPs) and penetration testing firms, rather than companies that mainly sell their own software. We checked each firm against its own website. Every company below shows a London office address on its site, offers cyber security services as its core business, and publishes accreditations or work we could check. Where a firm displays CREST membership, NCSC CHECK status or other NCSC-assured schemes on its own site, we have noted it. Firms are ordered by our own judgement of strength and fit, and none paid to be included. For other suppliers in the capital, see our London services hub.
Accreditations are a useful filter. CREST accredits penetration testing, incident response and threat intelligence providers. CHECK is the NCSC scheme that allows firms to test government and public sector systems. CBEST and STAR-FS are threat-led testing frameworks used by UK financial regulators. A firm holding these has passed independent assessment of its methods and staff.
Penetration testing, threat detection, advisory, training
Best Cyber Security Company Options In London
1. NCC Group — CREST And CHECK Accredited Global Security Consultancy
NCC Group is one of the largest cyber security consultancies in the world, with more than 2,000 colleagues and over 25 years of work for companies and governments. Its global headquarters is in Manchester, and its London office is on the 3rd floor at 15 Sackville Street, Mayfair (W1S 3DJ).
Its services are grouped into consulting and implementation (identity and access management, OT security, training, strategy, risk and compliance), technical assurance (penetration testing plus application, cloud, network, hardware, cryptography and blockchain security) and managed extended detection and response for Microsoft and Splunk environments. Accreditations shown on its site include CREST membership with red teaming, threat intelligence and incident management, NCSC CHECK, CBEST, The Cyber Scheme and Cyber Essentials Plus. Clients named on its site include Vodafone, Transport for London and TikTok.
NCC Group suits large enterprises, regulated financial firms and public bodies that need breadth, accredited testing and round-the-clock incident response from one provider.
2. Reversec — NCSC CHECK And CREST STAR Testing Specialist
Reversec is a technical security consultancy operating in the UK, Sweden, Finland, Denmark, the United States and Singapore. Its London team is based at Runway East, 150 Borough High Street (SE1 1LB). The firm is known for deep technical testing, and its own line, “optimizes the business, not the report”, captures its focus on practical outcomes.
Its security assurance testing covers generative AI, cloud, applications, mobile, networks, mainframes and products, alongside attack path mapping, red teaming, purple teaming and advisory consulting. Reversec states that its expertise is validated by NCSC CHECK, CREST STAR, PCI QSA and ISO/IEC 27001 certifications, and it also displays CREST membership and The Cyber Scheme. Clients shown on its site include Engine by Starling, Google and ENISA.
Reversec fits banks, technology firms and product companies that need highly technical testing, threat-led red team exercises or specialist work on mainframes and AI systems.
Orange Cyberdefense is the security services arm of the Orange group. In the UK it has a London office at 80 Cannon Street in the City (EC4N 6HL), plus offices in Maidstone and Manchester. It reports more than 3,000 employees, over 250 researchers and analysts, and more than 25 years of experience.
Its UK offer covers managed services and managed detection and response, run from 24/7/365 UK-based security operations, along with professional services and advisory (CISO as a service, NIS2 and PCI DSS advisory), threat-led penetration testing, red teaming and training, including SensePost hacking courses. It says its detection platforms ingest around 50 billion logs and events daily.
Orange Cyberdefense suits larger organisations that want a single managed security partner with significant scale, UK-based monitoring and an international threat intelligence operation.
4. JUMPSEC — CREST And CHECK Accredited London Security Firm Since 2012
JUMPSEC is a London cyber security company founded in 2012 and based at Westpoint, Warple Way, Acton (W3 0RG). It works exclusively in cyber security, with clients ranging from technology start-ups to FTSE 100 companies, and covers both attack and defence.
Its offensive work includes red teaming, purple teaming, adversary simulation, EDR efficacy testing and phishing and vishing simulations. On the defensive side it offers attack surface management, dark web monitoring and managed extended detection and response, and it runs 24/7 incident response with retainers and readiness exercises. JUMPSEC shows CREST accreditation for SOC, intelligence-led penetration testing, incident response, penetration testing and vulnerability assessment, offers CHECK penetration testing, and holds Cyber Essentials Plus, ISO 9001 and ISO 27001.
JUMPSEC is a strong fit for mid-market and enterprise organisations that want an accredited London firm able to test, monitor and respond under one relationship.
CovertSwarm is an offensive security company at International House, 36-38 Cornhill, in the City of London (EC3V 3NG). Its main product is a Constant Cyber Attack subscription, which replaces the annual penetration test with continuous testing on monthly cycles by a dedicated team of ethical hackers.
Services also include regulatory and compliance testing, penetration testing, red teaming, breach and attack simulation, physical and social engineering attacks, phishing and ransomware simulations, and an attack surface management portal. The firm states CREST accreditation for Simulated Targeted Attack and Response (STAR), STAR-FS and CBEST, the frameworks used for regulated UK financial firms. It offers discounted rates to public institutions, charities and B Corps.
CovertSwarm suits fast-moving SaaS, fintech and healthcare businesses whose attack surface changes too often for a once-a-year test to be meaningful.
6. Bridewell — NCSC Assured Security Partner For Critical Infrastructure
Bridewell is a cyber security services company with a London office at 5 Merchant Square, Paddington (W2 1AY). It describes itself as a trusted security partner for operators of essential services and says more than 200 critical infrastructure organisations have trusted it.
Its five service areas are cyber security consulting, managed security (including managed detection and response), data privacy, penetration testing and 24/7 incident response, with a particular strength in Microsoft security. Its consultancy covers on-premise, cloud and operational technology environments, and its site lists NCSC Assured Services.
Bridewell suits energy, utilities, transport and other critical infrastructure operators, as well as organisations that want consultancy and managed detection from one accredited provider.
7. Integrity360 — Pan-European MSSP With Seven Security Operations Centres
Integrity360 has helped organisations with cyber security since 2005. Its head office is in Dublin, and its London City office is at 11 Ironmonger Lane (EC2V 8EY). It runs seven security operations centres, in Dublin, Sofia, Stockholm, Rome, Madrid, Johannesburg and Cape Town, providing 24×7 monitoring.
Its services cover managed cyber services including managed detection and response, incident response, governance, risk and compliance, cyber security testing, consultancy, PCI DSS payments compliance and operational technology security. Its site shows CREST, SOC 2 and Microsoft Security Partner marks. A risk and compliance officer at Payzone Ireland is quoted saying its MDR service gives “real-time visibility and confidence”.
Integrity360 suits organisations with operations across the UK and Europe that want one managed security provider with multi-country SOC coverage and payments compliance expertise.
8. Quorum Cyber — Microsoft-First Managed Detection And Response
Quorum Cyber is headquartered in Edinburgh and has a London office at Paddington Works, 8 Hermitage Street (W2 1BE). It delivers “Microsoft-first, threat-led cyber security services” and has announced a combination with Ontinue to build a larger Microsoft-focused managed XDR operation.
Its Clarity managed services cover detection and response, OT security, data and AI security, continuous threat exposure management and phishing protection. Incident response options include preparedness work, retainers and emergency MDR, and professional services cover Microsoft Security Copilot, Defender XDR and Defender for IoT deployments, cloud security, offensive security and identity advisory. Sectors served include energy, financial services, healthcare, higher education, housing, legal and the public sector.
Quorum Cyber is a natural fit for organisations that have standardised on Microsoft 365 and Azure and want a provider that gets the most from tools they already pay for.
9. S-RM — Cyber Incident Response And Offensive Security Consultancy
S-RM is a risk and intelligence consultancy with a dedicated cyber practice. Its London office is on the 6th floor of The Rowe, 61 Whitechapel High Street (E1 7PE). The cyber practice focuses on incident response and offensive security, which makes it a common call when a breach or ransomware attack is already under way.
Alongside cyber, S-RM offers intelligence and investigations work, which gives it an advantage in incidents that involve extortion, insider threats or legal follow-up. Its site displays ISO 9001, ISO 14001 and ISO 27001 certifications.
S-RM suits organisations that want an experienced incident response partner on retainer, especially those whose risks span cyber, investigations and corporate intelligence.
10. Claranet — MSSP With Three UK SOCs And In-House Pentest Team
Claranet is a managed services company with a full cyber security practice. Its London office is at 17 Slingsby Place, Covent Garden (WC2E 9AB), and it also has UK offices in Leeds, Gloucester and Warrington. It describes its cyber offer as a full MSSP capability, combining testing, monitoring and advice under one provider.
Its threat detection and response service is run from three UK security operations centres, which Claranet says monitor around 58 TB of data a month. Its in-house security testing team delivers about 10,000 days of penetration testing a year, and the practice also covers strategy and advisory work and security training. Its cyber security page displays CREST, Cyber Essentials Plus, ISO 27001, ISO 27017, ISO 22301 and NCSC marks.
Claranet suits mid-market and enterprise organisations that want penetration testing and 24/7 detection from one accredited UK provider, particularly those that already use Claranet or similar partners for cloud hosting and managed infrastructure.
How To Choose A Cyber Security Company In London
Which Accreditations Matter?
For penetration testing, CREST membership is the baseline signal of a vetted provider. If you are a public body or test government-connected systems, you will need a CHECK provider. Regulated financial firms may need CBEST or STAR-FS capability. For incident response, look for CREST incident response accreditation or the NCSC Cyber Incident Response scheme. Always check the accreditation on the scheme’s own register.
Do You Need Testing, Monitoring Or Both?
Penetration testing tells you where you are weak at a point in time. Managed detection and response watches your systems continuously and acts when something happens. Many organisations buy both, but not always from the same firm. Some buyers prefer an independent tester who is not also responsible for the controls being tested.
How Fast Can They Respond To An Incident?
Ask every shortlisted provider for its incident response terms in writing: hours of cover, time to first response, whether responders can come on site in London, and what a retainer costs compared with emergency call-out rates. Agreeing a retainer before an incident is almost always cheaper and faster than looking for help during one.
Will They Work With Your Existing Tools?
If you already pay for Microsoft Defender, Sentinel or Splunk, a provider that specialises in those platforms can often deliver better detection for less money than one that brings its own stack. Ask which platforms they support natively and who owns the data and detection rules if you leave.
What Will The Report Look Like?
Ask for a redacted sample report before you buy. A good report ranks findings by real business risk, explains how to fix each issue, and includes a summary your board can understand. A retest of fixed issues should be included or clearly priced.
London buyers have access to some of the strongest cyber security firms in Europe. NCC Group, Orange Cyberdefense and Integrity360 offer scale and round-the-clock monitoring. Reversec, JUMPSEC and CovertSwarm bring accredited offensive testing for organisations that need to know how an attacker would get in. Bridewell and Quorum Cyber are strong choices for critical infrastructure and Microsoft-centred environments, S-RM is a proven incident response partner, and Claranet combines a large testing team with UK-based security operations.
Check accreditations on the scheme registers, ask for sample reports and incident response terms, and agree scope in writing before work begins. For more vetted suppliers in the capital, visit the London services hub.
