Is NCC Group profitable in 2025?

NCC Group reported a Group operating loss of £(6.1)m for FY2025 (year ended 30 September 2025), though net income was £17.1m; its core Cyber Security segment revenue fell 4.0% to 4.9% to £227.4m over the same period.

Could AI replace NCC Group's cybersecurity services?

NCC itself acknowledges in a May 2026 blog post that AI is already automating commoditized vulnerability scanning and first-pass pen testing, but its regulated third-party validator roles, like TikTok's Project Clover, require human liable sign-off AI cannot replace.

Who is NCC Group's biggest competitor?

Deloitte was ranked number one in global security services revenue in Gartner's 2026 report (June 2026), while NCC's Cyber segment revenue declined 4.0-4.9% in FY2025, showing NCC losing relative ground to Big Four rivals.

NCC Group plc is an independent public company listed on the London Stock Exchange under ticker NCC, with no parent company; it launched a £185m shareholder return (tender offer plus buyback) in July 2026 after selling Escode.

Did NCC Group sell its Escode business?

Yes. NCC agreed to sell Escode, its software escrow and verification division, to TDR Capital for £275.0m enterprise value on 21 January 2026, completing the sale on 29 May 2026 with about £253m net cash proceeds.

Is NCC Group's cyber business growing again?

NCC's Cyber Security segment returned to constant-currency growth for a second consecutive quarter in Q1 FY26, after full-year FY2025 (to 30 September 2025) revenue had declined 4.0% to 4.9% to £227.4m.

Cybersecurity companies · United Kingdom

NCC Group

nccgroup.com ↗

UK firm that tests and certifies companies' cybersecurity, from penetration testing to code review.

Losing its protection

Assessed 21 July 2026 · Evidence as of 21 July 2026

The structural protection is eroding.

On the recordSince 21 July 2026 · Checkable from December 2026 · Every call on the record Checkpoint: FY26 full-year results showing post-Escode Cyber segment growth and AI-practice traction

The call

NCC Group is shrinking toward a smaller, regulator-anchored cyber business while AI tools and bigger rivals absorb the commodity testing work it used to sell.

NCC Group runs cybersecurity testing and compliance work for regulated companies, mainly banks and financial firms. The job is hard to replace because regulators trust NCC's certifications and independent checks, but the Big Four accounting firms (Deloitte, EY, KPMG, PwC) and tech giants have the same certifications and deeper pockets, while AI software now does routine security scanning and code review faster and cheaper than humans. The one thing that could change the picture is whether NCC grows its high-value advisory work (like helping with new AI security rules and independent validation) fast enough to make up for the shrinking testing business.

Why

AI pressure: AI-driven automated pentest and code-scanning tools from vendors like Snyk, GitHub Copilot Autofix, and AI-native scanners. AI now handles first-pass vulnerability scanning and code review, the commodity work NCC's Cyber segment revenue decline shows it losing. Could AI do the core job? Only partly.

Bigger players: Deloitte, EY, KPMG, PwC, Accenture, IBM, Kroll. These firms hold the same CREST accreditation and regulator trust NCC relies on, but with far bigger balance sheets and AI budgets. Could a giant copy it? Yes, easily.

What protects it. CREST accreditation, DORA advisory status, and the Project Clover validator role give NCC regulator-approved standing that's slow to replicate.

What would change this call

FY26 full-year results (~Dec 2026) show Cyber segment revenue growth of mid-single digits or better. would show the regulated/AI-security niche is offsetting commodity testing losses.
Headcount stabilizes or rises from ~1,800-2,900 range reported across late 2025/2026 filings. would show hiring resumed rather than continued shrinkage.
Operating income returns to profit after FY25's £6.1m loss. would show cost-cutting and any AI-practice gains are restoring margins.

Key numbers

Cyber segment revenue fell 4.9% to £227.4m (2025-09-30)
Operating loss of £6.1m in FY25 (2025-09-30)
Headcount down to ~1,800 after Escode sale (2026-05-29)

Named risks

AI automation eroding commoditized vulnerability scanning and first-pass pen testing revenue. Severity: high
Losing relative market share to Big Four consultancies and hyperscaler-bundled security offerings. Severity: high
Continued headcount reduction and restructuring following Escode divestiture completed May 2026. Severity: medium
£185m capital return signals cash harvesting rather than reinvestment in growth. Severity: medium

Rivals, as read in July 2026

Rival	Direction	Evidence
Deloitte	losing to	Deloitte ranked No.1 in global security services revenue per Gartner, June 2026, vs NCC Cyber revenue down 4-4.9% in FY2025
EY, KPMG, PwC, Accenture, IBM, Kroll	losing to	Hold same CREST accreditation and out-grow NCC's shrinking Cyber segment as of FY2025
AI/LLM automation tools	contesting	NCC's own May 2026 blog admits AI-augmented scanning is eroding commodity vulnerability testing
Darktrace, Sophos, BAE Systems Digital Intelligence, BT Security	contesting	Compete directly in fragmented UK cyber security market alongside NCC as of 2025

Questions people ask

Is NCC Group profitable in 2025?: NCC Group reported a Group operating loss of £(6.1)m for FY2025 (year ended 30 September 2025), though net income was £17.1m; its core Cyber Security segment revenue fell 4.0% to 4.9% to £227.4m over the same period.
Could AI replace NCC Group's cybersecurity services?: NCC itself acknowledges in a May 2026 blog post that AI is already automating commoditized vulnerability scanning and first-pass pen testing, but its regulated third-party validator roles, like TikTok's Project Clover, require human liable sign-off AI cannot replace.
Who is NCC Group's biggest competitor?: Deloitte was ranked number one in global security services revenue in Gartner's 2026 report (June 2026), while NCC's Cyber segment revenue declined 4.0-4.9% in FY2025, showing NCC losing relative ground to Big Four rivals.
Who owns NCC Group?: NCC Group plc is an independent public company listed on the London Stock Exchange under ticker NCC, with no parent company; it launched a £185m shareholder return (tender offer plus buyback) in July 2026 after selling Escode.
Did NCC Group sell its Escode business?: Yes. NCC agreed to sell Escode, its software escrow and verification division, to TDR Capital for £275.0m enterprise value on 21 January 2026, completing the sale on 29 May 2026 with about £253m net cash proceeds.
Is NCC Group's cyber business growing again?: NCC's Cyber Security segment returned to constant-currency growth for a second consecutive quarter in Q1 FY26, after full-year FY2025 (to 30 September 2025) revenue had declined 4.0% to 4.9% to £227.4m.

Timeline

2026-07-07NCC announces £185m shareholder return: £170m tender offer at 145p plus £15m buyback
2026-06-22NCC selected for OpenAI's invite-only Daybreak Cyber Partner Program
2026-06-19NCC becomes founding signatory of the CREST AI Charter
2026-05-29Escode sale to TDR Capital completes; ~£253m net proceeds; ~1,800 remain in Cyber
2026-02-26NCC publishes Annual Cyber Security Research Report 2025
2026-01-21NCC agrees Escode sale to TDR Capital for £275.0m enterprise value
2025-12-11NCC reports Q4 FY25 results, returns to growth, guides FY26 marginal growth
2025-09-30FY2025 close: Cyber revenue £227.4m (down 4.0-4.9%), operating loss £6.1m, net income £17.1m
2025-03-28Fox-IT Crypto B.V. sale completes
2024-04-30Fox-IT DetACT sold to DataExpert BV for €9.0m

Revision history

21 July 2026

First assessed. Losing its protection. The text above is fixed as of this date and is not edited afterwards.

In the same band

Seqrite Meiya Pico NSFOCUS