Awarded 15 July 2026
Cyber Security On-call improvements 26
NHS England · London
SIEM tenders and contracts
UK public sector, covering 600+ buyer sites
76 contracts awarded in the 24 months to 12 October 2026
Get SIEM tenders every morningStart by seeing every SIEM contract we'd have matched you with last year. No card needed.
Updated 12 October 2026 · compiled by BidSkim Limited · How we count
SIEM contracts ,
76 contracts across the UK, of any size
Recently awarded
The latest SIEM contracts awarded
Awarded 18 June 2026
RoS - SG SVARS - Cortex XSIAM
Registers of Scotland · Scotland
Awarded 18 June 2026
Cyber Security Software
Bernicia Group · North East
Awarded 27 May 2026
Exabeam(LogRhythm) Support Services Enhanced Maintenance and Support Services Maintenance Support for Secure Engineering Environment Plant Interface
Sellafield Ltd · North West
Awarded 27 May 2026
PS/26/19 - Provision of Support and Maintenance for a S.I.E.M. Tool
Driver and Vehicle Licensing Agency · Wales
Who wins · 24 months to October 2026
Softcat won the most SIEM contracts
Computacenter won the most by value. Each dot is one contract, coloured by who bought it.
CouncilsHousing associationsNHS and healthSchools and collegesOther public bodies
| Rank | Contractor | Contracts won, by buyer | Contracts | Value won | Buyers | Share |
|---|---|---|---|---|---|---|
| 1 | Softcat South West · See every contract | 17 | £25.3m | 14 | ||
| 2joint | Somerford Associates Limited South East · SME · See every contract | 4 | £3m | 4 | ||
| 2joint | Boxxe North East · See every contract | 4 | £147k | 3 | ||
| 4joint | Computacenter London · See every contract | 3 | £31.7m | 3 | ||
| 4joint | Hippo Digital South West · See every contract | 3 | £4.2m | 2 | ||
| 4joint | Networkology North West · SME · See every contract | 3 | £2.5m | 3 | ||
| 4joint | Darktrace North East · See every contract | 3 | £2.2m | 3 | ||
| 4joint | EKCO CLOUD AND SECURITY LIMITED South East · See every contract | 3 | £213k | 2 | ||
| 9joint | XMA Limited West Midlands · See every contract | 2 | £1.2m | 2 | ||
| 9joint | Badger Software Limited SME · See every contract | 2 | £664k | 2 |
29 more SIEM contractors ranked. See the full ranking →
Win SIEM contracts? Share your ranking.
Who buys
55 buyers awarded SIEM contracts
Contracts with a published value in the last 24 months, from the type of buyer to the size of the contract.
15 buyers bought SIEM more than once in the last 24 months
Each dot is a buyer, by how many SIEM contracts it awarded in the last 24 months.
See who they are and when they usually buy →
Few and big, or many and small
Each dot is a buyer: how many SIEM contracts it awarded against what they were worth. The busiest and biggest are named.
CouncilsHousing associationsNHS and healthSchools and collegesOther public bodies
Top buyers by contracts awarded
| Rank | Buyer | Contracts | Value |
|---|---|---|---|
| 1 | Ministry of Defence | 4 | £12.7m |
| 2 | NHS England | 3 | £20.5m |
| 3 | Sellafield Ltd | 3 | £3m |
| 4 | UK Shared Business Services (UK SBS) | 3 | £590k |
| 5 | Department for Work and Pensions | 2 | £6.4m |
| 6 | NHS Blood and Transplant | 2 | £490k |
| 7 | West Suffolk NHS Foundation Trust | 2 | £350k |
| 8 | Highways England | 2 | £329k |
| 9 | Driver and Vehicle Licensing Agency | 2 | £308k |
| 10 | Isle of Wight Council | 2 | £238k |
Prices
Half of SIEM contracts are worth less than £130k
Every contract with a published value, on a log scale, coloured by who bought it.
CouncilsHousing associationsNHS and healthSchools and collegesOther public bodies
The 10 biggest contracts hold 86% of the money
Coloured by who bought it.
- Home OfficeComputacenter · 26 Mar 2026
- NHS EnglandSoftcat · 8 Jan 2025
- Ministry of DefenceSoftcat, Centerprise International, Ultima Business Solutions, Boxxe · 12 Mar 2025
- Department for Work and PensionsSoftcat · 23 Jan 2026
- NHS EnglandHippo Digital · 30 Apr 2026
- Ministry of DefenceSomerford Associates Limited · 29 Jun 2025
- Sellafield LtdCDW · 17 Dec 2024
- Ministry of DefenceCOMPUTER NETWORK DEFENCE LIMITED · 19 Mar 2026
- Department for Science, Innovation and Technology (DSIT)Networkology · 10 Nov 2025
- Leicestershire County CouncilXMA Limited · 26 Sep 2025
Where and when
The South East awards the most SIEM contracts
Contracts by region and by month awarded. Click a region to filter the page.
FewerMore contracts
See the regions as a table
| Region | Contracts | Value |
|---|---|---|
| South East | 12 | £1.2m |
| South West | 10 | £12.8m |
| North West | 8 | £10.4m |
| London | 7 | £32.4m |
| North East | 6 | £1.4m |
| Yorkshire and the Humber | 5 | £5.2m |
| West Midlands | 3 | £179k |
| East of England | 3 | £380k |
| East Midlands | 2 | £154k |
| Wales | 2 | £308k |
| Scotland | 1 | £473k |
| Northern Ireland | 0 | Not published |
Often bought with SIEM
Related services
Key findings
- 86%
of the money is in the 10 biggest SIEM contracts.
Of 71 contracts with a published value. - 29%
of SIEM contracts are won by SMEs.
As recorded by the buyer, on 65 award notices.
Questions
How many SIEM contracts does the UK public sector award?
76 in the 24 months to 12 October 2026, from 55 public buyers.
How much is a typical public sector SIEM contract worth?
The median is £130k, and 62% are worth less than £250k.
Who wins the most public sector SIEM contracts?
Softcat won the most (17). Computacenter won the most by value (£31.7m).
What is included
Software the buyer's own security team uses to collect logs, detect threats and automate response, such as SIEM, security analytics, XDR and SOAR. It is bought as licences, sometimes with implementation support.
- SIEM and security analytics (e.g. Splunk)
- Extended detection and response (XDR) platforms
- Security orchestration, automation and response (SOAR)
- Professional services to implement and run the platform
- AI and machine-learning tools that help security operations centre analysts with triage, detection and response
What is not included
- 24x7 monitoring delivered by a provider -> it.cyber.managed-soc-mdr
- Endpoint antivirus -> it.cyber.endpoint-protection
- Threat intelligence feeds -> it.cyber.threat-intelligence