BidSkim
Free report
Service market

Security operations centre contracts

UK public sector · 101 contracts awarded in the 12 months to 6 October 2026

Covering 600+ buyer portals · 5 years of records · Updated 6 October 2026 · How we count

Contracts awarded
101
Last 12 months
Median contract
£207k
Recorded value
Recorded value
£41.1m
94 of 98 main-service contracts have a published value
Buyers
94
Suppliers
52

BidSkim assigns contracts to services from the notice text. How services are assigned

What stands out

  • The five suppliers that won the most security operations centre contracts took 31% of them (31 of 101).
  • The median contract, £207k, is 89% above the median across it & software contracts (£110k).
  • London had the most contracts: 23, or 23% of the total.

Who buys security operations centre

By contracts awarded, the 12 months to 6 October 2026.

  1. 1South Western Railway Limited2 contracts
  2. 2GreenSquareAccord2 contracts
  3. 3Alliance Homes2 contracts
  4. 4East West Rail2 contracts
  5. 5Salford City College Group2 contracts
  6. 6Department for Environment, Food and Rural Affairs2 contracts
  7. 7Hartlepool College of Further Education2 contracts
  8. 8UK Health Security Agency1 contract
  9. 9Cardiff University1 contract
  10. 10Ministry of Housing, Communities and Local Government1 contract

Top security operations centre contractors by contracts won

The 12 months to 6 October 2026.

  1. 1Phoenix Software12 contracts
  2. 2Softcat7 contracts
  3. 3Jisc5 contracts
  4. 4Aspire Technology Solutions4 contracts
  5. 5NCC Group3 contracts
  6. 6DIGITALXRAID LTD3 contracts
  7. 7Socura Limited3 contracts
  8. 8Waterstons Ltd3 contracts
  9. 9MTI Technology3 contracts
  10. 10Quorum Cyber3 contracts

Latest and largest awards

Each links to the official notice.

Latest

Largest

Contracts awarded by quarter

19Q4 2025*27Q1 202636Q2 202619Q3 20260Q4 2026*
* part quarter

Where the contracts were awarded

England 88 · Scotland 11 · Wales 2

London23South East11North East9Scotland8West Midlands7North West6Yorkshire and The Humber5South West5East Midlands3East of England2Wales2UK-wide or not stated20

What is included

An outsourced security operations centre that monitors the buyer's IT around the clock and detects and responds to threats. It can also include managing security tools such as firewalls and endpoint agents.

  • SOC as a service and 24x7 security monitoring
  • Managed detection and response (MDR), including endpoint licences
  • Managed SIEM
  • Managed security service bundles (firewalls, endpoint, patching)

What is not included

  • SIEM and XDR licences run in-house -> it.cyber.siem-security-operations-platforms
  • Firewall hardware and support without monitoring -> it.cyber.firewalls-network-security
  • Interim security operations staff -> it.cyber.security-consultancy-assurance
  • Outsourced IT covering desk, devices and infrastructure -> another family: managed IT services

Often bought by the same buyers