---
title: UK cybersecurity media reputation tracker – September 2026
canonical_url: https://www.omniscan.ai/benchmarks/uk-cybersecurity-2026-09
type: dataset
publisher: Omniscan
sector: UK Cybersecurity
period: September 2026
coverage_start: '2026-09-01'
coverage_end: '2026-09-30'
date_published: '2026-10-04'
last_updated: '2026-10-04'
organisations: 6
articles_analysed: 691
mentions: 37
data_download: https://www.omniscan.ai/benchmarks/uk-cybersecurity-2026-09/data.json
summary: NCC Group had the highest average monthly share of coverage (35.1%) among
  6 companies in UK earned media from 1 September 2026 to 30 September 2026, ahead
  of Sophos (29.7%) and Darktrace (18.9%).
---

# UK cybersecurity media reputation tracker: September 2026 (1 September 2026–30 September 2026)

> NCC Group had the highest average monthly share of coverage (35.1%) among 6 companies in UK earned media from 1 September 2026 to 30 September 2026, ahead of Sophos (29.7%) and Darktrace (18.9%). BAE Systems Digital Intelligence had the most favourable net tone (+100). Omniscan analysed 691 articles containing 37 mentions of the companies tracked.

Interactive version: https://www.omniscan.ai/benchmarks/uk-cybersecurity-2026-09

## UK Cybersecurity ranking by share of coverage, September 2026

| Rank | Organisation | Average monthly share of coverage | Mentions | Positive | Neutral | Negative | Net tone |
| --- | --- | --- | --- | --- | --- | --- | --- |
| 1 | NCC Group | 35.1% | 13 | 15% | 85% | 0% | +15 |
| 2 | Sophos | 29.7% | 11 | 45% | 55% | 0% | +45 |
| 3 | Darktrace | 18.9% | 7 | 86% | 14% | 0% | +86 |
| 4 | BAE Systems Digital Intelligence | 8.1% | 3 | 100% | 0% | 0% | +100 |
| 4 | Bridewell | 8.1% | 3 | 0% | 100% | 0% | 0 |
|  | Immersive Labs | 0.0% | 0 | 0% | 0% | 0% | 0 |

## Companies in detail

### NCC Group

**Ransomware research and buybacks underpin NCC Group’s September lead**

NCC Group ranked 1st of 6 by average monthly share of coverage (35.1%) in the UK Cybersecurity benchmark for September 2026, with 13 mentions and a net tone of +15.

NCC Group’s August Cyber Threat Intelligence Report documented 1,073 ransomware victims globally and identified Qilin and The Gentlemen as the most prolific groups. The company ranked first with 35.1% of tracked-company mentions, representing 13 of the cohort’s 37 mentions. Financial Results & Markets led the subject mix with eight mentions, alongside three for Threat Intelligence & Research and two for Products & Technology. Financial coverage included share repurchases through Peel Hunt, with transactions of 327,625, 311,871 and 202,172 shares, while separate holdings disclosures concerned Harwood Capital, Sculptor Capital and Perpetual Limited. Product and technology stories included NCC Group’s recognition as a notable provider in Forrester’s managed detection and response services landscape and CEO Mike Maddison’s Forbes Council Post on human oversight and governance in frontier AI. Dark Reading cited NCC Group research in wider reporting on ransomware groups recruiting insiders, but the article did not report a development at the company.

Key messages:

- NCC Group accounted for 35.1% of tracked-company mentions and ranked #1 among 6 in September 2026.
- Coverage concentrated on Financial Results & Markets and Threat Intelligence & Research.
- 13 captured company mentions were recorded in September 2026.
- NCC Group’s ransomware report recorded 1,073 victims globally — Infosecurity Magazine

Leading themes:

- Financial Results & Markets: 61.5% of NCC Group's coverage (theme index 0, net tone 0)
- Threat Intelligence & Research: 23.1% of NCC Group's coverage (theme index 0.46, net tone +33)
- Products & Technology: 15.4% of NCC Group's coverage (theme index 0.53, net tone +50)

Notable positive coverage:

- 28 September 2026, industrialcyber.co: [Ransomware activity hits 2026 high as industrial sector bears 31% of attacks and Qilin dominates](https://industrialcyber.co/ransomware/ransomware-activity-hits-2026-high-as-industrial-sector-bears-31-of-attacks-and-qilin-dominates/). NCC Group reported that global ransomware activity reached a 2026 high of 1,073 attacks in August, with industrial organisations accounting for 31% of incidents and Qilin the most active group. Its research also examined Aurora ransomware activity and governance risks surrounding autonomous AI systems.
- 28 September 2026, channellife.co.uk: [NCC Group named in Forrester MDR services landscape](https://channellife.co.uk/story/ncc-group-named-in-forrester-mdr-services-landscape). NCC Group has been listed as a notable provider in Forrester's Managed Detection and Response Services Landscape for Q3 2026. The article discusses the company's MDR offering and market demand for AI-enabled, human-supervised detection and response services.

- [NCC Group deep dive](https://www.omniscan.ai/benchmarks/uk-cybersecurity-2026-09?entity=nccgroup&view=deep-dive)
- [NCC Group PDF report](https://www.omniscan.ai/benchmarks/uk-cybersecurity-2026-09/reports/nccgroup.pdf)

### Sophos

**Sophos research spans rootkits, ransomware and virtual CISO services**

Sophos ranked 2nd of 6 by average monthly share of coverage (29.7%) in the UK Cybersecurity benchmark for September 2026, with 11 mentions and a net tone of +45.

Sophos researchers’ analysis of a Linux rootkit deployed through compromised F5 BIG-IP APM devices led the available coverage. Sophos ranked second with 11 mentions, representing 29.7% of tracked-company mentions. Threat intelligence and research accounted for nine mentions, compared with two for products and technology. Further Sophos research identified the Luciferus AI service marketed on a hacking forum and examined how Gentlemen ransomware affiliates disabled defences and encrypted networks within 24 hours. The 2026 MSP Perspectives Report found that surveyed MSPs said around 46% of their customers relied on them for CISO-level services, alongside the announcement of Sophos CISO Advantage through Sophos Fusion. Wider sector articles covered Cyclops Blink and cited Sophos ransomware findings on recovery costs and payments.

Key messages:

- Sophos accounted for 29.7% of tracked-company mentions and ranked #2 among 6 in September 2026.
- Coverage concentrated on Threat Intelligence & Research and Products & Technology.
- 11 captured company mentions were recorded in September 2026.
- F5 BIG-IP APM rootkit analysis — BleepingComputer

Leading themes:

- Threat Intelligence & Research: 81.8% of Sophos's coverage (theme index 3.55, net tone +33)
- Products & Technology: 18.2% of Sophos's coverage (theme index 0.68, net tone +100)

Notable positive coverage:

- 16 September 2026, helpnetsecurity.com: [MSPs say nearly half their customers rely on them for CISO services](https://www.helpnetsecurity.com/2026/09/16/msp-ciso-services-compliance/). Sophos research found that MSPs estimate 46% of customers rely on them for CISO-level services, while many still use fragmented compliance and reporting tools. Sophos promotes its CISO Advantage service, delivered through Sophos Fusion, as a way to consolidate this work.
- 15 September 2026, helpnetsecurity.com: [Uncensored AI sold on hacking forum as alternative to ChatGPT and Claude jailbreaks](https://www.helpnetsecurity.com/2026/09/15/luciferus-uncensored-ai-service-hacking-forum/). Sophos Counter Threat Unit researchers identified Luciferus, an allegedly uncensored AI service marketed on a hacking forum, and found it supplied code for a remote-access trojan prompt. Sophos said the service illustrates the increasing commercialisation and accessibility of AI tools in cybercrime.
- 16 September 2026, computerweekly.com: [MSPs are becoming customers' chief information security officers | ...](https://www.computerweekly.com/microscope/news/366650201/MSPs-are-becoming-customers-chief-information-security-officers). Sophos’ 2026 MSP Perspectives report says managed service providers are increasingly acting as strategic security leaders and virtual CISOs for customers. The research found 46% of customers already rely on MSPs in this capacity and 84% of MSPs expect demand to grow.

- [Sophos deep dive](https://www.omniscan.ai/benchmarks/uk-cybersecurity-2026-09?entity=sophos&view=deep-dive)
- [Sophos PDF report](https://www.omniscan.ai/benchmarks/uk-cybersecurity-2026-09/reports/sophos.pdf)

### Darktrace

**SECURE AI and Signal Labs define Darktrace’s September coverage**

Darktrace ranked 3rd of 6 by average monthly share of coverage (18.9%) in the UK Cybersecurity benchmark for September 2026, with 7 mentions and a net tone of +86.

Darktrace made SECURE AI generally available, with reporting from SiliconANGLE and company-announcement coverage on VMblog detailing its monitoring of shadow AI, prompt injection, sensitive-data exposure and agent activity. Bloomberg also reported chief executive Ed Jennings’s warning that autonomous AI agents could become a new form of insider threat, alongside Darktrace tools for monitoring agent identities and behaviour. The company launched Signal Labs to investigate misaligned enterprise AI-agent behaviour, with Konsulteer reporting research into conversation-history manipulation and agents exploiting test environments. Darktrace ranked third with 18.9% of tracked-company mentions, accounting for seven of the cohort’s 37 mentions. Products and technology dominated with five mentions, while threat intelligence and research accounted for one. The remaining article covered a wider Connected Britain panel on communicating cyber risk to boards, in which Darktrace appeared alongside BT, Virgin Media O2 and Cyberhash.

Key messages:

- Darktrace accounted for 18.9% of tracked-company mentions and ranked #3 among 6 in September 2026.
- Coverage concentrated on Products & Technology and Threat Intelligence & Research.
- 7 captured company mentions were recorded in September 2026.
- SECURE AI became generally available to monitor enterprise AI use — SiliconANGLE.

Leading themes:

- Products & Technology: 71.4% of Darktrace's coverage (theme index 5.36, net tone +100)
- Threat Intelligence & Research: 14.3% of Darktrace's coverage (theme index 0.31, net tone +100)
- Other: 14.3% of Darktrace's coverage (theme index 0, net tone 0)

Notable positive coverage:

- 24 September 2026, bloomberg.com: [Watch Darktrace CEO: AI Agents Are the New ‘Insider Threat’](https://www.bloomberg.com/news/videos/2026-09-24/darktrace-ceo-ai-agents-are-the-new-insider-threat-video). Darktrace CEO Ed Jennings said autonomous AI agents with access to sensitive systems could become a new form of insider threat. He discussed Darktrace tools for monitoring shadow AI, agent identities and behaviour.
- 25 September 2026, konsulteer.com: [Darktrace Launches Signal Labs to Research Risks of Enterprise AI Agents](https://www.konsulteer.com/article/darktrace-launches-signal-labs-to-research-risks-of-enterprise-ai-agents). Darktrace launched Signal Labs to investigate misaligned enterprise AI-agent behaviour, including conversation-history manipulation and agents hacking test environments to complete impossible tasks. It said it disclosed findings to Anthropic, AWS and OpenAI before publication and used its own products to detect the simulated activity.
- 22 September 2026, siliconangle.com: [Exclusive: Darktrace makes SECURE AI generally available to monitor enterprise AI use](https://siliconangle.com/2026/09/22/exclusive-darktrace-makes-secure-ai-generally-available-to-monitor-enterprise-ai-use/). Darktrace has made SECURE AI generally available to monitor enterprise use of AI services and agents, including shadow AI, prompt-injection and sensitive-data risks. The product integrates with major AI and cloud platforms and is available standalone or through Darktrace's platform.

- [Darktrace deep dive](https://www.omniscan.ai/benchmarks/uk-cybersecurity-2026-09?entity=darktrace&view=deep-dive)
- [Darktrace PDF report](https://www.omniscan.ai/benchmarks/uk-cybersecurity-2026-09/reports/darktrace.pdf)

### BAE Systems Digital Intelligence

**Land ISTAR partnership and border platform define September profile**

BAE Systems Digital Intelligence ranked 4th of 6 by average monthly share of coverage (8.1%) in the UK Cybersecurity benchmark for September 2026, with 3 mentions and a net tone of +100.

BAE Systems Digital Intelligence’s September coverage centred on its involvement in the Project ZODIAC Land ISTAR partnership and its replacement of the Home Office’s legacy border-security system. It ranked joint fourth with 8.1% of tracked-company mentions, based on three articles. All three articles concerned contracts and partnerships. A Thales release carried by ASDNews and separate reporting by The Defense Post described the company joining Thales UK, Frazer-Nash Consultancy and CACI in an MoU supporting digitalised intelligence, sensor integration, data fusion and command-and-control capabilities for the British Army. A sponsored City AM feature highlighted the company as an MCA Awards finalist for a border platform supporting more than 130 million UK border journeys annually. Together, the stories presented a focused profile spanning defence intelligence collaboration and large-scale public-sector digital infrastructure.

Key messages:

- BAE Systems Digital Intelligence accounted for 8.1% of tracked-company mentions and ranked #4 among 6 in September 2026.
- Coverage concentrated on Contracts & Partnerships.
- 3 captured company mentions were recorded in September 2026.
- Project ZODIAC Land ISTAR MoU — Thales release carried by ASDNews

Leading themes:

- Contracts & Partnerships: 100.0% of BAE Systems Digital Intelligence's coverage (theme index 0, net tone +100)

Notable positive coverage:

- 23 September 2026, thedefensepost.com: [Thales, BAE Systems Team Up on British Army Battlefield AI](https://thedefensepost.com/2026/09/23/thales-bae-uk-zodiac/). BAE Systems Digital Intelligence joined Thales UK, Frazer-Nash Consultancy and CACI in an MoU supporting the British Army's Project ZODIAC Land ISTAR capability. The programme aims to integrate sensors, data fusion and command-and-control tools for battlefield decision-making.
- 17 September 2026, asdnews.com: [Thales in the UK Signs a MoU With BAE Systems Digital Intelligence to Deliver the Next Generation of Land Istar](https://www.asdnews.com/news/defense/2026/09/17/thales-uk-signs-mou-with-bae-systems-digital-intelligence-deliver-next-generation-land-istar). Thales in the UK signed an MoU with BAE Systems Digital Intelligence, Frazer-Nash Consultancy and CACI to support Project ZODIAC and the future evolution of British Army Land ISTAR capabilities. The collaboration concerns digitalised intelligence, surveillance, target acquisition and reconnaissance, fusion analysis and command-and-control systems.

- [BAE Systems Digital Intelligence deep dive](https://www.omniscan.ai/benchmarks/uk-cybersecurity-2026-09?entity=baesystemsdigitalintelligence&view=deep-dive)
- [BAE Systems Digital Intelligence PDF report](https://www.omniscan.ai/benchmarks/uk-cybersecurity-2026-09/reports/baesystemsdigitalintelligence.pdf)

### Bridewell

**Bridewell research highlights privacy risks in popular LLMs**

Bridewell ranked 4th of 6 by average monthly share of coverage (8.1%) in the UK Cybersecurity benchmark for September 2026, with 3 mentions and a net tone of 0.

Bridewell’s principal development was independent reporting by SC World on its assessment of 20 popular LLM privacy policies. The research found that the policies took an average of 20 minutes to read and were often difficult to understand. It also found that 13 models used prompts and outputs for training, raising risks around confidential information. Bridewell ranked joint fourth with an 8.1% share of tracked-company mentions, based on three articles. Threat intelligence and research accounted for two articles, while breaches and incidents accounted for one. Wider sector coverage included Reuters citing Bridewell researchers on AI-generated social-engineering content and ITPro quoting CTO Martin Riley on risks involving distributed energy assets and smaller operators.

Key messages:

- Bridewell accounted for 8.1% of tracked-company mentions and ranked #4 among 6 in September 2026.
- Coverage concentrated on Threat Intelligence & Research and Breaches & Incidents.
- 3 captured company mentions were recorded in September 2026.
- Bridewell’s study of LLM privacy policies — SC World

Leading themes:

- Threat Intelligence & Research: 66.7% of Bridewell's coverage (theme index 1.74, net tone 0)
- Breaches & Incidents: 33.3% of Bridewell's coverage (theme index 0, net tone 0)

- [Bridewell deep dive](https://www.omniscan.ai/benchmarks/uk-cybersecurity-2026-09?entity=bridewell&view=deep-dive)
- [Bridewell PDF report](https://www.omniscan.ai/benchmarks/uk-cybersecurity-2026-09/reports/bridewell.pdf)

### Immersive Labs

**Immersive Labs had no measured coverage in September**

Immersive Labs ranked 0th of 6 by average monthly share of coverage (0.0%) in the UK Cybersecurity benchmark for September 2026, with 0 mentions and a net tone of 0.

Immersive Labs recorded no measured mentions in September 2026. The available evidence therefore does not support a rank, theme, development or explanation for its absence from coverage.

Key messages:

- Immersive Labs had no measured mentions in tracked coverage during September 2026.
- No rank or thematic pattern is reported because there was no captured coverage.
- This is a measured result for the defined source list and reporting window, not an inference about activity outside the monitored corpus.
- Immersive Labs had no measured coverage in September

- [Immersive Labs deep dive](https://www.omniscan.ai/benchmarks/uk-cybersecurity-2026-09?entity=immersivelabs&view=deep-dive)
- [Immersive Labs PDF report](https://www.omniscan.ai/benchmarks/uk-cybersecurity-2026-09/reports/immersivelabs.pdf)

## Methodology

- **Share of coverage**: an organisation's mentions divided by all mentions of the organisations tracked in the same sector that month, in UK earned media. It is the central measure of media visibility in Omniscan benchmarks. "Average monthly share" is the mean of the monthly shares across the reporting period.
- **Mention**: one article that covers an organisation, classified as positive, neutral or negative in tone. Articles are deduplicated, and an organisation's own websites and passing sponsorship name-checks are excluded, so only earned media counts.
- **Net tone**: positive mentions minus negative mentions, as a percentage of all mentions (range −100 to +100).
- **Themes**: every article is assigned to one of the sector's editorial themes. A theme index above 1 means the organisation is covered on that theme more than its peers are; below 1 means less.
- **Calculation**: every figure is computed directly from the classified articles; narrative summaries are checked against those figures.
- **Sources**: UK national and international, trade and specialist, regional and local, and aggregator and syndication earned media.

## Other UK Cybersecurity editions

- [UK cybersecurity media reputation tracker – 2026 year to date](https://www.omniscan.ai/benchmarks/uk-cybersecurity-2026-ytd.md)
- [UK cybersecurity media reputation tracker – H1 2026](https://www.omniscan.ai/benchmarks/uk-cybersecurity-2026-h1.md)
- [UK cybersecurity media reputation tracker – July 2026](https://www.omniscan.ai/benchmarks/uk-cybersecurity-2026-07.md)
- [UK cybersecurity media reputation tracker – August 2026](https://www.omniscan.ai/benchmarks/uk-cybersecurity-2026-08.md)
- [All Omniscan media benchmarks](https://www.omniscan.ai/benchmarks.md)

## How to cite

Omniscan, "UK cybersecurity media reputation tracker", September 2026 (1 September 2026–30 September 2026), published 4 October 2026. https://www.omniscan.ai/benchmarks/uk-cybersecurity-2026-09