# UK government publishes first analysis of the UK software market

On 6 November 2026 the UK government published a report on the UK software market. It was written by Plexal for the government's cyber security team and will help shape policy on software security, including how to get more companies to follow the voluntary Software Security Code of Practice.

- Page: https://www.cognivise.co.uk/news/uk-government-publishes-first-analysis-of-the-uk-software-market
- Topic: Building software
- Published: 2026-11-11
- Updated: 2026-11-11
- Author: Cognivise
- Source: GOV.UK (DCMS and DSIT), UK software market analysis (https://www.gov.uk/government/publications/uk-software-market-analysis)
- Source: GOV.UK (DCMS and DSIT), Software Security Ambassadors Scheme (https://www.gov.uk/government/publications/software-security-ambassadors-scheme)

## Key takeaways

- The report counts 62,339 UK software companies; 97% are small or medium-sized.
- It was commissioned to help drive uptake of the voluntary Software Security Code of Practice.
- The government says 59% of organisations had a software supply chain attack in the past year.

## What the report found

- **Size.** It identified 62,339 software companies in the UK. 97% are small or medium-sized, and 70% are micro-businesses with one to nine employees.
- **Location.** London and the South East host 48% of them.
- **Growth.** Using the software development sector as a proxy, the report estimates 7% yearly growth and a market value of about £47 billion by 2030.
- **Who is in the market.** Resellers are 42% of companies and product companies 34%. Only 2% are infrastructure developers.
- **Trends.** Vendors see AI as the most significant trend: a productivity boost that can also add security risks. Cloud and SaaS are becoming the main way software is delivered, and some buyers are thinking more about data sovereignty and European cloud providers.
- **Method.** The research used 55 online interviews and 74 survey responses.

## Why security is the focus

The Software Security Code of Practice is a voluntary set of principles to reduce software supply chain attacks. The government's Software Security Ambassadors scheme supports it. The second group of ambassadors launched on 29 October 2026. The government says 59% of organisations experienced a software supply chain attack in the past year.

The cyber security team behind the report moved from the Department for Science, Innovation and Technology to the new Department for Digital, Culture, Media and Sport in July 2026.

## What this means for businesses buying software

The code is voluntary, but it shows what the government expects from software suppliers. If you are choosing a developer, ask which security practices they follow and whether they have read the code. If you already run custom software, ask the same of whoever maintains it.