--- title: UK cybersecurity media reputation tracker – July 2026 canonical_url: https://www.omniscan.ai/benchmarks/uk-cybersecurity-2026-07 type: dataset publisher: Omniscan sector: UK Cybersecurity period: July 2026 coverage_start: '2026-07-01' coverage_end: '2026-07-31' date_published: '2026-09-01' last_updated: '2026-09-01' organisations: 6 articles_analysed: 566 mentions: 42 data_download: https://www.omniscan.ai/benchmarks/uk-cybersecurity-2026-07/data.json summary: Sophos had the highest average monthly share of coverage (50.0%) among 6 companies in UK earned media from 1 July 2026 to 31 July 2026, ahead of NCC Group (26.2%) and Darktrace (19.0%). --- # UK cybersecurity media reputation tracker: July 2026 (1 July 2026–31 July 2026) > Sophos had the highest average monthly share of coverage (50.0%) among 6 companies in UK earned media from 1 July 2026 to 31 July 2026, ahead of NCC Group (26.2%) and Darktrace (19.0%). Bridewell had the most favourable net tone (+100). Omniscan analysed 566 articles containing 42 mentions of the companies tracked. Interactive version: https://www.omniscan.ai/benchmarks/uk-cybersecurity-2026-07 ## UK Cybersecurity ranking by share of coverage, July 2026 | Rank | Organisation | Average monthly share of coverage | Mentions | Positive | Neutral | Negative | Net tone | | --- | --- | --- | --- | --- | --- | --- | --- | | 1 | Sophos | 50.0% | 21 | 52% | 48% | 0% | +52 | | 2 | NCC Group | 26.2% | 11 | 55% | 45% | 0% | +55 | | 3 | Darktrace | 19.0% | 8 | 88% | 12% | 0% | +88 | | 4 | Bridewell | 4.8% | 2 | 100% | 0% | 0% | +100 | | | BAE Systems Digital Intelligence | 0.0% | 0 | 0% | 0% | 0% | 0 | | | Immersive Labs | 0.0% | 0 | 0% | 0% | 0% | 0 | ## Companies in detail ### Sophos **Sophos led as research broadened into platforms and identity** Sophos ranked 1st of 6 by average monthly share of coverage (50.0%) in the UK Cybersecurity benchmark for July 2026, with 21 mentions and a net tone of +52. July 2026: share rose 22.7 points to 50%, volume increased to 21 and rank returned to first; stories included the Fusion launch and research on identity compromise in ransomware. July 2026: Sophos launched Fusion to unify protection and security operations across multiple environments — scworld.com. Sophos launched its AI-native Fusion security offering and is taking it to market through its MSP and channel partner ecosystem. The company positions Fusion as enabling flexible managed security services and recurring revenue opportunities for partners. Sophos webinar material is cited to describe how autonomous AI agents could accelerate vulnerability discovery and exploit development. The article presents Sophos’s recommended defensive approach of high availability, segmentation, zero trust and supply-chain accountability. Sophos has appointed Naveed Malik as senior director of EMEA MSP channel sales to lead its MSP partner strategy. Malik said he will focus on expanding managed-services adoption and partner-led recurring revenue. Key messages: - Sophos launched its AI-native Fusion security offering and is taking it to market through its MSP and channel partner ecosystem. The company positions Fusion as enabling flexible managed security services and recurring revenue opportunities for partners. - Sophos has launched Sophos Fusion, an AI-native platform unifying security operations and protection across endpoint, network, identity, email and cloud environments. The company says the platform incorporates Taegis analytics and supports more than 500 third-party integrations. - Sophos webinar material is cited to describe how autonomous AI agents could accelerate vulnerability discovery and exploit development. The article presents Sophos’s recommended defensive approach of high availability, segmentation, zero trust and supply-chain accountability. - Sophos has appointed Naveed Malik as senior director of EMEA MSP channel sales to lead its MSP partner strategy. Malik said he will focus on expanding managed-services adoption and partner-led recurring revenue. - Sophos warns that the Vect-TeamPCP alliance combines stolen supply-chain credentials with ransomware deployment, creating a more industrialised threat model. Its researchers advise organisations to inventory open-source software and verify updates. Leading themes: - Threat Intelligence & Research: 71.4% of Sophos's coverage (theme index 1.88, net tone +33) - Products & Technology: 23.8% of Sophos's coverage (theme index 1.67, net tone +100) - Talent & Skills: 4.8% of Sophos's coverage (theme index 1, net tone +100) Notable positive coverage: - 16 July 2026, computerweekly.com: [Sophos looks to partners to take Fusion to market | Microscope](https://www.computerweekly.com/microscope/news/366645918/Sophos-looks-to-partners-to-take-Fusion-to-market). Sophos launched its AI-native Fusion security offering and is taking it to market through its MSP and channel partner ecosystem. The company positions Fusion as enabling flexible managed security services and recurring revenue opportunities for partners. - 16 July 2026, scworld.com: [Sophos launches AI-native cybersecurity defense platform](https://www.scworld.com/brief/sophos-launches-ai-native-cybersecurity-defense-platform). Sophos has launched Sophos Fusion, an AI-native platform unifying security operations and protection across endpoint, network, identity, email and cloud environments. The company says the platform incorporates Taegis analytics and supports more than 500 third-party integrations. - 21 July 2026, itpro.com: [Cybersecurity in the age of Mythos: navigating the AI vulnerability flood](https://www.itpro.com/technology/artificial-intelligence/cybersecurity-in-the-age-of-mythos-navigating-the-ai-vulnerability-flood). Sophos webinar material is cited to describe how autonomous AI agents could accelerate vulnerability discovery and exploit development. The article presents Sophos’s recommended defensive approach of high availability, segmentation, zero trust and supply-chain accountability. - [Sophos deep dive](https://www.omniscan.ai/benchmarks/uk-cybersecurity-2026-07?entity=sophos&view=deep-dive) - [Sophos PDF report](https://www.omniscan.ai/benchmarks/uk-cybersecurity-2026-07/reports/sophos.pdf) ### NCC Group **NCC Group rebounds as cyber focus broadens its media profile** NCC Group ranked 2nd of 6 by average monthly share of coverage (26.2%) in the UK Cybersecurity benchmark for July 2026, with 11 mentions and a net tone of +55. July broadened the profile through the Siemens critical-infrastructure agreement, the Cyber Resilience Pledge and a proposed £185 million shareholder return. July 2026: share fell 7.1 percentage points to 26.2% and rank moved to second; Machinery Market covered the critical-infrastructure cyber-resilience agreement with Siemens. NCC Group and Siemens signed an MoU to collaborate on cyber resilience for UK critical infrastructure and industrial operational technology. The partnership combines Siemens' industrial expertise with NCC Group's cybersecurity services. NCC Group announced a £185m shareholder return through a tender offer and share buyback following the sale of Escode. The company reported growth in cyber revenue and cyber EBITDA in its latest half-year results. NCC Group became a founding signatory of the UK government's Cyber Resilience Pledge, committing to board-level cyber governance, NCSC Early Warning registration and supply-chain security measures. Key messages: - NCC Group and Siemens signed an MoU to collaborate on cyber resilience for UK critical infrastructure and industrial operational technology. The partnership combines Siemens' industrial expertise with NCC Group's cybersecurity services. - NCC Group announced a £185m shareholder return through a tender offer and share buyback following the sale of Escode. The company reported growth in cyber revenue and cyber EBITDA in its latest half-year results. - NCC Group became a founding signatory of the UK government's Cyber Resilience Pledge, committing to board-level cyber governance, NCSC Early Warning registration and supply-chain security measures. - NCC Group joined The Cyber Scheme Accredited Company Programme, which links employer recognition to UK cyber-professional standards. The accreditation highlights the company's technical-assurance workforce and standards work. Leading themes: - Financial Results & Markets: 36.4% of NCC Group's coverage (theme index 0, net tone +25) - Contracts & Partnerships: 18.2% of NCC Group's coverage (theme index 0, net tone +100) - Threat Intelligence & Research: 18.2% of NCC Group's coverage (theme index 0.27, net tone 0) Notable positive coverage: - 22 July 2026, machinery-market.co.uk: [Siemens and NCC Group strengthen UK critical infrastructure cyber security](https://www.machinery-market.co.uk/news/43068/Siemens-and-NCC-Group-strengthen-UK-critical-infrastructure-cyber-security). NCC Group and Siemens signed an MoU to collaborate on cyber resilience for UK critical infrastructure and industrial operational technology. The partnership combines Siemens' industrial expertise with NCC Group's cybersecurity services. - 7 July 2026, businesscloud.co.uk: [NCC shareholder boost after £185m announcement](https://businesscloud.co.uk/news/ncc-shareholder-boost-after-185m-announcement/). NCC Group announced a £185m shareholder return through a tender offer and share buyback following the sale of Escode. The company reported growth in cyber revenue and cyber EBITDA in its latest half-year results. - 18 July 2026, securitybrief.co.uk: [NCC Group & Siemens team up on UK OT cyber security](https://securitybrief.co.uk/story/ncc-group-siemens-team-up-on-uk-ot-cyber-security). NCC Group and Siemens signed an agreement to collaborate on operational-technology cyber resilience for UK critical infrastructure. The partnership will support asset owners, operators and supply chains across industrial sectors. - [NCC Group deep dive](https://www.omniscan.ai/benchmarks/uk-cybersecurity-2026-07?entity=nccgroup&view=deep-dive) - [NCC Group PDF report](https://www.omniscan.ai/benchmarks/uk-cybersecurity-2026-07/reports/nccgroup.pdf) ### Darktrace **Darktrace’s visibility shifted from leadership change to threat research** Darktrace ranked 3rd of 6 by average monthly share of coverage (19.0%) in the UK Cybersecurity benchmark for July 2026, with 8 mentions and a net tone of +88. July’s return to third place coincided with independent reporting on a compromised AI gateway used for cryptomining and Darktrace’s comments on restrictions for advanced cybersecurity models. July’s measured total also included contextual appearances in Reuters Breakingviews, a newspaper round-up and an industrial-security vendor list; these were not Darktrace-focused developments. July 2026: Darktrace detailed the compromise of an AI gateway with Amazon Bedrock access for cryptomining, reported by SiliconANGLE. Darktrace investigated a cryptomining incident involving an exposed AWS EC2 server operating as an AI gateway connected to Amazon Bedrock. It warns that compromised AI gateways could expose credentials, data and downstream cloud systems. Darktrace investigated a compromise of an internet-exposed LiteLLM AI gateway on AWS that led to XMRig cryptomining and suspicious IAM activity. The analysis highlights AI gateways as high-value cloud and identity-security targets. Key messages: - Darktrace investigated a cryptomining incident involving an exposed AWS EC2 server operating as an AI gateway connected to Amazon Bedrock. It warns that compromised AI gateways could expose credentials, data and downstream cloud systems. - Darktrace's analysis of a compromised LiteLLM AI gateway describes SSH brute-force activity, cryptomining and potential IAM exposure. The article argues that AI gateways require hardening and behavioural monitoring as privileged infrastructure. - Darktrace detailed a cloud intrusion in which an internet-exposed LiteLLM AI gateway with Amazon Bedrock access was used for cryptomining. Its monitoring and managed threat-detection services identified the activity and escalated it to the customer. - AI Gateways Offer Attackers the Keys to the Kingdom (darkreading.com, 9 July). Leading themes: - Threat Intelligence & Research: 75.0% of Darktrace's coverage (theme index 1.5, net tone +100) - Products & Technology: 25.0% of Darktrace's coverage (theme index 1.42, net tone +50) Notable positive coverage: - 9 July 2026, darkreading.com: [AI Gateways Offer Attackers the Keys to the Kingdom](https://www.darkreading.com/cyber-risk/ai-gateways-keys-kingdom). Darktrace investigated a cryptomining incident involving an exposed AWS EC2 server operating as an AI gateway connected to Amazon Bedrock. It warns that compromised AI gateways could expose credentials, data and downstream cloud systems. - 10 July 2026, cybersecuritynews.com: [Hackers are Turning AI Gateways as Attack Surfaces to Compromise Enterprise Networks](https://cybersecuritynews.com/hackers-turning-ai-gateways-as-attack/). Darktrace investigated a compromise of an internet-exposed LiteLLM AI gateway on AWS that led to XMRig cryptomining and suspicious IAM activity. The analysis highlights AI gateways as high-value cloud and identity-security targets. - 10 July 2026, cybersecurity-insiders.com: [AI Gateway Security: Cryptominers Expose the IAM Risk CISOs Are Missing](https://www.cybersecurity-insiders.com/ai-gateway-security-cryptomining-iam-risk/). Darktrace's analysis of a compromised LiteLLM AI gateway describes SSH brute-force activity, cryptomining and potential IAM exposure. The article argues that AI gateways require hardening and behavioural monitoring as privileged infrastructure. - [Darktrace deep dive](https://www.omniscan.ai/benchmarks/uk-cybersecurity-2026-07?entity=darktrace&view=deep-dive) - [Darktrace PDF report](https://www.omniscan.ai/benchmarks/uk-cybersecurity-2026-07/reports/darktrace.pdf) ### Bridewell **Other shaped Bridewell's media profile during July 2026** Bridewell ranked 4th of 6 by average monthly share of coverage (4.8%) in the UK Cybersecurity benchmark for July 2026, with 2 mentions and a net tone of +100. In July 2026, Bridewell recorded 2 mentions, 4.8% of cohort coverage and rank #4, with net sentiment of +100. Bridewell launched BCON Collective, a dedicated threat research and cyber-threat-intelligence practice led by Gavin Knapp. The practice combines Bridewell's intelligence services, research and analysts for CNI, public-sector and commercial clients. A guide profiles managed security service providers active in the UK against a backdrop of expanding cyber regulation, major attacks and skills shortages. It includes NCC Group and Bridewell among its selected providers. Other accounted for 1 mention. This small sample is directional: it describes the articles found in July but is not large enough to establish a durable reputation pattern. Key messages: - Bridewell recorded 2 mentions in July, so the findings are directional. - Bridewell launched BCON Collective, a dedicated threat research and cyber-threat-intelligence practice led by Gavin Knapp. The practice combines Bridewell's intelligence services, research and analysts for CNI, public-sector and commercial clients. - A guide profiles managed security service providers active in the UK against a backdrop of expanding cyber regulation, major attacks and skills shortages. It includes NCC Group and Bridewell among its selected providers. Leading themes: - Products & Technology: 50.0% of Bridewell's coverage (theme index 2.86, net tone +100) - Other: 50.0% of Bridewell's coverage (theme index 20, net tone +100) Notable positive coverage: - 22 July 2026, itsecurityguru.org: [Bridewell Launches Dedicated Threat Intelligence Practice BCON Collective](https://www.itsecurityguru.org/2026/07/22/bridewell-launches-dedicated-threat-intelligence-practice-bcon-collective/). Bridewell launched BCON Collective, a dedicated threat research and cyber-threat-intelligence practice led by Gavin Knapp. The practice combines Bridewell's intelligence services, research and analysts for CNI, public-sector and commercial clients. - [Bridewell deep dive](https://www.omniscan.ai/benchmarks/uk-cybersecurity-2026-07?entity=bridewell&view=deep-dive) - [Bridewell PDF report](https://www.omniscan.ai/benchmarks/uk-cybersecurity-2026-07/reports/bridewell.pdf) ### BAE Systems Digital Intelligence **BAE Systems Digital Intelligence had no qualifying coverage in July 2026** BAE Systems Digital Intelligence ranked 0th of 6 by average monthly share of coverage (0.0%) in the UK Cybersecurity benchmark for July 2026, with 0 mentions and a net tone of 0. No qualifying earned-media mentions of BAE Systems Digital Intelligence were recorded in July 2026 within the tracked source set. The edition therefore assigns 0% cohort share and no rank. No classified mentions were available for sentiment or theme analysis, so the report makes no claim about the company's reputation. The 0% figure records an evidence gap rather than a reputation score. Key messages: - No qualifying mentions were recorded for BAE Systems Digital Intelligence, so this edition reports no rank, leading theme or sentiment assessment. - The 0% share records an evidence gap in the tracked source set; it is not a reputation score. - [BAE Systems Digital Intelligence deep dive](https://www.omniscan.ai/benchmarks/uk-cybersecurity-2026-07?entity=baesystemsdigitalintelligence&view=deep-dive) - [BAE Systems Digital Intelligence PDF report](https://www.omniscan.ai/benchmarks/uk-cybersecurity-2026-07/reports/baesystemsdigitalintelligence.pdf) ### Immersive Labs **Immersive Labs had no qualifying coverage in July 2026** Immersive Labs ranked 0th of 6 by average monthly share of coverage (0.0%) in the UK Cybersecurity benchmark for July 2026, with 0 mentions and a net tone of 0. No qualifying earned-media mentions of Immersive Labs were recorded in July 2026 within the tracked source set. The edition therefore assigns 0% cohort share and no rank. No classified mentions were available for sentiment or theme analysis, so the report makes no claim about the company's reputation. The 0% figure records an evidence gap rather than a reputation score. Key messages: - No qualifying mentions were recorded for Immersive Labs, so this edition reports no rank, leading theme or sentiment assessment. - The 0% share records an evidence gap in the tracked source set; it is not a reputation score. - [Immersive Labs deep dive](https://www.omniscan.ai/benchmarks/uk-cybersecurity-2026-07?entity=immersivelabs&view=deep-dive) - [Immersive Labs PDF report](https://www.omniscan.ai/benchmarks/uk-cybersecurity-2026-07/reports/immersivelabs.pdf) ## Methodology - **Share of coverage**: an organisation's mentions divided by all mentions of the organisations tracked in the same sector that month, in UK earned media. It is the central measure of media visibility in Omniscan benchmarks. "Average monthly share" is the mean of the monthly shares across the reporting period. - **Mention**: one article that covers an organisation, classified as positive, neutral or negative in tone. Articles are deduplicated, and an organisation's own websites and passing sponsorship name-checks are excluded, so only earned media counts. - **Net tone**: positive mentions minus negative mentions, as a percentage of all mentions (range −100 to +100). - **Themes**: every article is assigned to one of the sector's editorial themes. A theme index above 1 means the organisation is covered on that theme more than its peers are; below 1 means less. - **Calculation**: every figure is computed directly from the classified articles; narrative summaries are checked against those figures. - **Sources**: UK national and international, trade and specialist, regional and local, and aggregator and syndication earned media. ## Other UK Cybersecurity editions - [UK cybersecurity media reputation tracker – 2026 year to date](https://www.omniscan.ai/benchmarks/uk-cybersecurity-2026-ytd.md) - [UK cybersecurity media reputation tracker – H1 2026](https://www.omniscan.ai/benchmarks/uk-cybersecurity-2026-h1.md) - [UK cybersecurity media reputation tracker – August 2026](https://www.omniscan.ai/benchmarks/uk-cybersecurity-2026-08.md) - [UK cybersecurity media reputation tracker – September 2026](https://www.omniscan.ai/benchmarks/uk-cybersecurity-2026-09.md) - [All Omniscan media benchmarks](https://www.omniscan.ai/benchmarks.md) ## How to cite Omniscan, "UK cybersecurity media reputation tracker", July 2026 (1 July 2026–31 July 2026), published 1 September 2026. https://www.omniscan.ai/benchmarks/uk-cybersecurity-2026-07