Vulnerability assessment contracts
UK public sector · 51 contracts awarded in the 12 months to 6 October 2026
Covering 600+ buyer portals · 5 years of records · Updated 6 October 2026 · How we count
- Contracts awarded
- 51
- Last 12 months
- Median contract
- £69k
- Recorded value
- Recorded value
- £11.3m
- 49 of 50 main-service contracts have a published value
- Buyers
- 42
- Suppliers
- 17
1 vulnerability assessment tenders open now
Get them by email25 vulnerability assessment contracts ending in the next 12 months
See which ones
BidSkim assigns contracts to services from the notice text. How services are assigned
What stands out
- The five suppliers that won the most vulnerability assessment contracts took 63% of them (32 of 51).
- The median contract, £69k, is 37% below the median across it & software contracts (£110k).
- Intellectual Property Office awarded 8% of the vulnerability assessment contracts (4 of 51).
Who buys vulnerability assessment
By contracts awarded, the 12 months to 6 October 2026.
- 1Intellectual Property Office4 contracts£84k
- 2H M REVENUE & CUSTOMS2 contracts£797k
- 3Companies House2 contracts£393k
- 4Financial Conduct Authority2 contracts£341k
- 5Office for National Statistics2 contracts£337k
- 6Police Digital Service2 contracts£59k
- 7NHS England2 contracts£41k
- 8NPL Management Limited1 contract£2.2m
- 9NHS Blood and Transplant1 contract£950k
- 10Driver and Vehicle Licensing Agency1 contract£947k
Top vulnerability assessment contractors by contracts won
The 12 months to 6 October 2026.
- 1Softcat13 contracts£3.6m
- 2Phoenix Software8 contracts£1.3m
- 3Computacenter4 contracts£670k
- 4Insight4 contracts£469k
- 5Specialist Computer Centres (SCC)3 contracts£635k
- 6Boxxe3 contracts£519k
- 7Bechtle2 contracts£132k
- 8Bytes Software Services2 contracts£54k
- 9Black Duck Software Limited1 contract£2.2m
- 10Academia1 contract£496k
Latest and largest awards
Each links to the official notice.
Latest
Companies House to Computacenter · Awarded 18 September 2026
Police and Crime Commissioner for Durham to Phoenix Software · Awarded 11 September 2026
Perth & Kinross Council to supplier not published · Awarded 9 September 2026
Northumberland County Council to Computacenter · Awarded 2 September 2026
UK Health Security Agency to Softcat · Awarded 28 August 2026
Sheffield Hallam University to Gamma · Awarded 28 August 2026
City of Doncaster Council to INTEGRATED TECH LTD · Awarded 19 August 2026
Driver and Vehicle Licensing Agency to Phoenix Software · Awarded 13 August 2026
Largest
NPL Management Limited to Black Duck Software Limited · Awarded 9 June 2026
Managed Vulnerability and Threat-Led Intelligence Service (official notice, opens in a new tab)
£950k
NHS Blood and Transplant to Softcat · Awarded 22 January 2026
Government Commercial Agency to Softcat · Awarded 9 March 2026
Department for Business and Trade to Specialist Computer Centres (SCC) · Awarded 17 June 2026
Contracts awarded by quarter
Where the contracts were awarded
England 40 · Wales 8 · Scotland 3
What is included
Software that regularly scans the estate for known vulnerabilities and misconfigurations and tracks their fixes. It includes configuration benchmarking and hardening assessment tools.
- Vulnerability scanners (e.g. Rapid7 Nexpose)
- Enterprise or national vulnerability management licences
- Configuration benchmarks and hardening assessment (CIS SecureSuite)
What is not included
- People-led penetration testing and IT health checks -> it.cyber.penetration-testing
- Public cloud posture scanning -> it.cyber.cloud-security-posture
- Deploying patches on a specific application -> another family: application support and maintenance