---
title: UK cybersecurity media reputation tracker – H1 2026
canonical_url: https://www.omniscan.ai/benchmarks/uk-cybersecurity-2026-h1
type: dataset
publisher: Omniscan
sector: UK Cybersecurity
period: H1 2026
coverage_start: '2026-01-01'
coverage_end: '2026-06-30'
date_published: '2026-09-01'
last_updated: '2026-09-01'
organisations: 6
articles_analysed: 2803
mentions: 173
data_download: https://www.omniscan.ai/benchmarks/uk-cybersecurity-2026-h1/data.json
summary: Sophos had the highest average monthly share of coverage (40.4%) among 6
  companies in UK earned media from 1 January 2026 to 30 June 2026, ahead of NCC Group
  (28.4%) and Darktrace (21.4%).
---

# UK cybersecurity media reputation tracker: H1 2026 (1 January 2026–30 June 2026)

> Sophos had the highest average monthly share of coverage (40.4%) among 6 companies in UK earned media from 1 January 2026 to 30 June 2026, ahead of NCC Group (28.4%) and Darktrace (21.4%). BAE Systems Digital Intelligence had the most favourable net tone (+100). Omniscan analysed 2,803 articles containing 173 mentions of the companies tracked.

Interactive version: https://www.omniscan.ai/benchmarks/uk-cybersecurity-2026-h1

## UK Cybersecurity ranking by share of coverage, H1 2026

| Rank | Organisation | Average monthly share of coverage | Mentions | Positive | Neutral | Negative | Net tone |
| --- | --- | --- | --- | --- | --- | --- | --- |
| 1 | Sophos | 40.4% | 65 | 54% | 40% | 6% | +48 |
| 2 | NCC Group | 28.4% | 54 | 43% | 57% | 0% | +43 |
| 3 | Darktrace | 21.4% | 36 | 47% | 42% | 11% | +36 |
| 4 | Bridewell | 5.1% | 9 | 56% | 44% | 0% | +56 |
| 5 | BAE Systems Digital Intelligence | 3.0% | 6 | 100% | 0% | 0% | +100 |
| 6 | Immersive Labs | 1.6% | 3 | 100% | 0% | 0% | +100 |

## Monthly share of coverage, UK Cybersecurity

| Organisation | January 2026 | February 2026 | March 2026 | April 2026 | May 2026 | June 2026 |
| --- | --- | --- | --- | --- | --- | --- |
| Sophos | 20.0% | 58.3% | 30.3% | 43.8% | 63.0% | 27.3% |
| NCC Group | 55.0% | 12.5% | 21.2% | 18.8% | 29.6% | 33.3% |
| Darktrace | 22.5% | 29.2% | 36.4% | 31.3% | 0.0% | 9.1% |
| Bridewell | 2.5% | 0.0% | 9.1% | 6.3% | 3.7% | 9.1% |
| BAE Systems Digital Intelligence | 0.0% | 0.0% | 0.0% | 0.0% | 0.0% | 18.2% |
| Immersive Labs | 0.0% | 0.0% | 3.0% | 0.0% | 3.7% | 3.0% |

## Companies in detail

### Sophos

**Sophos led as research broadened into platforms and identity**

Sophos ranked 1st of 6 by average monthly share of coverage (40.4%) in the UK Cybersecurity benchmark for H1 2026, with 65 mentions and a net tone of +48.

The Arco Cyber acquisition added a sustained investment and cyber-governance strand in February and March. May combined WantToCry and identity research with agentic SOC reporting and independent coverage of difficulties around Sophos's proposed refinancing. June was narrower and heavily concentrated on Sophos's investigation of a human-directed, AI-assisted malware-testing framework for EDR evasion. Visibility peaked in May 2026 at 63%, compared with 20% in January 2026. January 2026: Sophos launched Workspace Protection for hybrid-work application, data and AI governance — Help Net Security. April 2026: share rose 13.5 points to 43.8% and rank returned to first despite volume falling to seven; stories included Sophos's QEMU defence-evasion research. February 2026: Sophos acquired Arco Cyber to extend cyber-assurance capabilities within CISO Advantage — Tech Monitor. March 2026: Sophos research found widespread distrust of cybersecurity providers and demand for verifiable evidence — ITPro. April 2026: Sophos reported attackers using concealed QEMU virtual machines for defence evasion and ransomware activity — SecurityWeek. May 2026: Sophos's proposed refinancing encountered reluctance from private-credit lenders — Bloomberg. Sophos CISO Ross McKerchar discusses his leadership career, the senior cybersecurity skills gap, AI risks and managing burnout in security teams. He also describes Sophos's defensive response to Chinese attackers targeting its firewalls.

Key messages:

- Visibility peaked in May 2026 at 63%, compared with 20% in January 2026.
- January 2026: Sophos launched Workspace Protection for hybrid-work application, data and AI governance — Help Net Security.
- Sophos has acquired UK-based cybersecurity assurance company Arco Cyber to support its planned Sophos CISO Advantage offering. Sophos says the service will combine assurance, risk and compliance capabilities, with rollout planned for the second half of 2026.
- Sophos CISO Ross McKerchar discusses his leadership career, the senior cybersecurity skills gap, AI risks and managing burnout in security teams. He also describes Sophos's defensive response to Chinese attackers targeting its firewalls.
- Sophos identified WantToCry ransomware, which exfiltrates and remotely encrypts files before overwriting victims' originals. The operators target exposed SMB services using weak credentials and demand relatively low ransoms.
- Private-credit lenders reportedly declined Sophos's proposed $2.5 billion refinancing despite higher yields. Thoma Bravo is said to be pursuing a loan amendment with existing lenders.

Leading themes:

- Threat Intelligence & Research: 46.2% of Sophos's coverage (theme index 1.47, net tone +43)
- Products & Technology: 21.5% of Sophos's coverage (theme index 3.32, net tone +71)
- M&A & Investment: 10.8% of Sophos's coverage (theme index 1.06, net tone +100)

Notable positive coverage:

- 20 January 2026, helpnetsecurity.com: [Sophos expands security stack to govern apps, data, and AI in hybrid work](https://www.helpnetsecurity.com/2026/01/20/sophos-expands-security-stack-to-govern-apps-data-and-ai-in-hybrid-work/). Sophos launched Workspace Protection, a hybrid-work security suite centred on its Protected Browser and integrated with Sophos Central. The offering is intended to govern applications, data and AI use while providing ZTNA, DNS protection and email monitoring capabilities.
- 10 February 2026, technologyreseller.uk: [Sophos Acquires Arco Cyber to Bring CISO-Level, Agentic AI-Powered Expertise to Every Organization](https://technologyreseller.uk/sophos-acquires-arco-cyber-to-bring-ciso-level-agentic-ai-powered-expertise-to-every-organization/). Sophos has acquired UK-based cybersecurity assurance company Arco Cyber. The acquisition supports Sophos CISO Advantage, combining agentic AI, governance capabilities and partner-delivered expertise.
- 10 February 2026, forbes.com: [Sophos Buys Arco Cyber To Close The CISO Gap](https://www.forbes.com/sites/tonybradley/2026/02/10/sophos-buys-arco-cyber-to-close-the-ciso-gap/). Sophos has acquired UK-based cybersecurity assurance company Arco Cyber to support its planned Sophos CISO Advantage offering. Sophos says the service will combine assurance, risk and compliance capabilities, with rollout planned for the second half of 2026.

Notable negative coverage:

- 28 May 2026, bloomberg.com: [Private Credit Snubs $2.5 Billion Deal by Thoma Bravo's Sophos](https://www.bloomberg.com/news/articles/2026-05-28/private-credit-snubs-2-5-billion-deal-by-thoma-bravo-s-sophos). Sophos's proposed $2.5 billion refinancing is reportedly encountering reluctance from private-credit lenders amid AI-related concerns about software borrowers.
- 28 May 2026, chicagobusiness.com: [Private credit snubs $2.5B deal by Thoma Bravo’s Sophos](https://www.chicagobusiness.com/technology/ccb-private-credit-thoma-bravo-sophos-20260528/). Sophos's Thoma Bravo-backed $2.5 billion refinancing is reportedly facing lender hesitation amid AI-related concerns about software debt.
- 28 May 2026, briefs.co: [Private Credit Snubs $2.5B Sophos Refinancing Deal](https://www.briefs.co/news/private-credit-walked-away-sophos-deal/). Private-credit lenders reportedly declined Sophos's proposed $2.5 billion refinancing despite higher yields. Thoma Bravo is said to be pursuing a loan amendment with existing lenders.

- [Sophos deep dive](https://www.omniscan.ai/benchmarks/uk-cybersecurity-2026-h1?entity=sophos&view=deep-dive)
- [Sophos PDF report](https://www.omniscan.ai/benchmarks/uk-cybersecurity-2026-h1/reports/sophos.pdf)

### NCC Group

**NCC Group rebounds as cyber focus broadens its media profile**

NCC Group ranked 2nd of 6 by average monthly share of coverage (28.4%) in the UK Cybersecurity benchmark for H1 2026, with 54 mentions and a net tone of +43.

January established an early lead, with a 55% share and first place, before February’s 12.5% share put the company third. It stayed third through April, while its share recovered to 21.2% in March and was 18.8% in April. January’s independent coverage centred on the agreed £275 million Escode sale and the Delinea managed-services partnership. Through February and March, ransomware intelligence became more prominent alongside the company’s marginal revenue-growth outlook and continuing share buyback. May combined first-half cyber growth with research on Lazarus Group malware, operational-technology exposure and emerging ransomware operators. June shifted the emphasis towards the strategic review, the decision to remain listed and improved cyber revenue, margins and managed-services performance. Visibility peaked in January 2026 at 55%, compared with 12.5% in February 2026. January 2026: Reuters reported NCC Group’s agreement to sell Escode to TDR Capital for £275 million. February 2026: share fell 42.5 percentage points to 12.5% and rank moved from first to third; Computer Weekly reported NCC Group’s findings on Qilin’s ransomware activity. May 2026: SC World reported Fox-IT’s identification of Lazarus Group’s RemotePE malware targeting financial and cryptocurrency organisations. NCC Group partnered with Delinea to provide managed, cloud-native privileged-access-management services. The agreement supports NCC Group's strategy to become a pure-play global cyber resilience company following the Escode sale.

Key messages:

- Visibility peaked in January 2026 at 55%, compared with 12.5% in February 2026.
- January 2026: Reuters reported NCC Group’s agreement to sell Escode to TDR Capital for £275 million.
- NCC Group partnered with Delinea to provide managed, cloud-native privileged-access-management services. The agreement supports NCC Group's strategy to become a pure-play global cyber resilience company following the Escode sale.
- NCC Group concluded its strategic review by deciding to remain listed and focus on its cyber business following the completed Escode sale. It reported higher revenue and adjusted EBITDA for the first half, with strong UK performance.
- NCC Group ruled out selling its cyber business following its strategic review and will continue as a pure-play cybersecurity and resilience company. Its interim results showed growth in security revenue, UK activity and managed services.
- NCC Group's January 2026 cyber barometer found Qilin responsible for 108 attacks, or 17% of observed ransomware incidents. NCC warned that the monthly decline in total attacks should not be mistaken for lower risk.

Leading themes:

- Threat Intelligence & Research: 27.8% of NCC Group's coverage (theme index 0.67, net tone +13)
- Financial Results & Markets: 25.9% of NCC Group's coverage (theme index 3.86, net tone +64)
- M&A & Investment: 20.4% of NCC Group's coverage (theme index 3.46, net tone +45)

Notable positive coverage:

- 21 January 2026, reuters.com: [UK's NCC Group to sell Escode for $369.4 million](https://www.reuters.com/business/uks-ncc-group-sell-escode-3694-million-2026-01-21/). NCC Group agreed to sell its Escode software-escrow business to TDR Capital for £275 million. The divestment is intended to leave NCC focused on cyber-security resilience and support shareholder returns.
- 21 January 2026, businesscloud.co.uk: [NCC Group to sell Escode business to PE firm in £275m deal](https://businesscloud.co.uk/news/ncc-group-to-sell-escode-business-to-pe-firm-in-275m-deal/). NCC Group agreed to sell Escode to TDR Capital for £275m, subject to conditions and approvals. NCC says the sale will support its strategy to operate as a pure-play cybersecurity and resilience company.
- 22 January 2026, businesscloud.co.uk: [NCC Group strikes San Francisco deal a day after £275m sale](https://businesscloud.co.uk/news/ncc-group-strikes-san-francisco-deal-a-day-after-275m-sale/). NCC Group partnered with Delinea to provide managed, cloud-native privileged-access-management services. The agreement supports NCC Group's strategy to become a pure-play global cyber resilience company following the Escode sale.

- [NCC Group deep dive](https://www.omniscan.ai/benchmarks/uk-cybersecurity-2026-h1?entity=nccgroup&view=deep-dive)
- [NCC Group PDF report](https://www.omniscan.ai/benchmarks/uk-cybersecurity-2026-h1/reports/nccgroup.pdf)

### Darktrace

**Darktrace’s visibility shifted from leadership change to threat research**

Darktrace ranked 3rd of 6 by average monthly share of coverage (21.4%) in the UK Cybersecurity benchmark for H1 2026, with 36 mentions and a net tone of +36.

Darktrace was second in January and February, moved to first with 36.4% in March, returned to second in April and had no measured mentions or rank in May. March coverage also examined slower revenue growth, planned US investment of more than $200 million and the launch of managed email security for service providers. Visibility peaked in March 2026 at 36.4%, compared with 0% in May 2026. January 2026: Jill Popelka was forced out after 16 months as chief executive, reported by The Times. February 2026: share rose 6.7 points to 29.2% while volume fell from nine to seven; stories included Darktrace’s finding of more than 32 million phishing emails and its launch of SECURE AI. March 2026: share increased 7.2 points to 36.4% and rank moved from second to first; contemporaneous coverage included Ed Jennings’s appointment and the managed email-security launch. February 2026: Darktrace reported detecting more than 32 million high-confidence phishing emails in 2025, covered by Infosecurity Magazine. March 2026: Darktrace appointed Ed Jennings as president and CEO amid a US expansion drive, reported by the Financial Times. April 2026: Darktrace analysed the incomplete ZionSiphon malware designed to target water-treatment systems, covered by BleepingComputer.

Key messages:

- Visibility peaked in March 2026 at 36.4%, compared with 0% in May 2026.
- January 2026: Jill Popelka was forced out after 16 months as chief executive, reported by The Times.
- Darktrace appointed Terry Doyle as its first CIO to unify its enterprise IT and data functions. He will work from London and report to CFO Suman Raju.
- Thoma Bravo-owned Darktrace appointed Ed Jennings as its third CEO in 18 months after Jill Popelka's departure. The report says the board sought faster revenue growth while highlighting the firm's UK operations and AI security positioning.
- Darktrace launched an AI-native managed email-security offering for MSSPs and expanded its Defenders Partner Program. The service adds multi-tenant operations and AI-led detection, investigation and response capabilities.
- Darktrace research found that 84% of surveyed professional sports organisations experienced a cyber incident in the preceding year, with AI-related risks a growing concern. Its telemetry also reported elevated phishing volumes targeting sports-sector customers.

Leading themes:

- Threat Intelligence & Research: 36.1% of Darktrace's coverage (theme index 0.97, net tone +46)
- Talent & Skills: 22.2% of Darktrace's coverage (theme index 4.35, net tone +50)
- Products & Technology: 16.7% of Darktrace's coverage (theme index 1.52, net tone +67)

Notable positive coverage:

- 14 January 2026, itpro.com: [Darktrace just hired its first chief information officer](https://www.itpro.com/business/leadership/darktrace-just-hired-its-first-chief-information-officer). Darktrace appointed Terry Doyle as its first CIO to unify its enterprise IT and data functions. He will work from London and report to CFO Suman Raju.
- 10 March 2026, itpro.com: [Darktrace names Ed Jennings as new president and CEO](https://www.itpro.com/business/leadership/darktrace-names-ed-jennings-as-new-president-and-ceo). Darktrace appointed Ed Jennings as president and CEO, effective March 23, following Jill Popelka's departure. The company said Jennings will support growth of its AI-native security platform and customer base.
- 24 March 2026, helpnetsecurity.com: [Darktrace expands MSSP offering with AI-driven managed email security](https://www.helpnetsecurity.com/2026/03/24/darktrace-managed-email-security-offering/). Darktrace launched an AI-native managed email-security offering for MSSPs and expanded its Defenders Partner Program. The service adds multi-tenant operations and AI-led detection, investigation and response capabilities.

Notable negative coverage:

- 27 January 2026, thetimes.com: [Darktrace boss Jill Popelka forced out after just 16 months](https://www.thetimes.com/business/technology/article/darktrace-boss-jill-popelka-forced-out-after-just-16-months-xh7qm30dg). Darktrace chief executive Jill Popelka was forced out after 16 months. Thoma Bravo operating partner William Goodman said the company needs to re-accelerate growth.
- 30 January 2026, businesscloud.co.uk: [Man Utd stadium; Darktrace; Jenna Meek; Dragons' Den: the week's best-read stories](https://businesscloud.co.uk/news/man-utd-stadium-darktrace-jenna-meek-dragons-den-the-weeks-best-read-stories/). A business-news roundup reports that Darktrace's private-equity owner forced out CEO Jill Popelka and appointed an interim chief executive.
- 23 March 2026, sharecast.com: [GSK lung cancer treatment gets orphan drug designation in Japan, PPHE secures loan agreement](https://www.sharecast.com/news/market-live-email/gsk-lung-cancer-treatment-gets-orphan-drug-designation-in-japan-pphe-secures-loan-agreement--22126410.html). A newspaper round-up reports that Darktrace's revenue growth slowed during its first year as a private company. Ed Jennings becomes chief executive after Jill Popelka's departure.

- [Darktrace deep dive](https://www.omniscan.ai/benchmarks/uk-cybersecurity-2026-h1?entity=darktrace&view=deep-dive)
- [Darktrace PDF report](https://www.omniscan.ai/benchmarks/uk-cybersecurity-2026-h1/reports/darktrace.pdf)

### Bridewell

**Bridewell usually ranked fourth; coverage concentrated in March and June**

Bridewell ranked 4th of 6 by average monthly share of coverage (5.1%) in the UK Cybersecurity benchmark for H1 2026, with 9 mentions and a net tone of +56.

Its profile was predominantly fourth-place, with May the exception: Bridewell ranked third on a 3.7% share when Infosecurity Magazine covered its research into identity-based attacks, infostealers and ransomware. Company-focused research coverage was concentrated in March and June, when share was 9.1% in each month. March reporting across Computer Weekly, Infosecurity Magazine and New Civil Engineer examined Bridewell’s findings on AI risk, cyber incidents, regulation-led investment and attacks on critical infrastructure. June broadened that research agenda through ITPro’s coverage of legacy systems at utilities, SecurityBrief’s report on Bridewell’s analysis of ICO penalties and Professional Security’s account of its healthcare cyber research. Visibility peaked in March 2026 at 9.1%, compared with 0% in February 2026. Bridewell usually ranked fourth; coverage concentrated in March and June. Bridewell's UK CNI survey reports that AI risk has become a leading concern and that 93% of surveyed organisations experienced a cyber incident in the past year. It also identifies gaps in regulatory-framework adoption and operational technology security. Bridewell's 2026 critical-national-infrastructure report says 77% of utilities organisations faced cyber incidents involving legacy software or unavailable patches. The company recommends stronger asset visibility, risk-based remediation, monitoring and incident-response preparation. Bridewell's 2026 UK CNI report found regulation is increasingly driving cyber investment, while adoption of major frameworks remains uneven. The report highlights the Cyber Security and Resilience Bill and the NCSC Cyber Assessment Framework.

Key messages:

- Visibility peaked in March 2026 at 9.1%, compared with 0% in February 2026.
- Bridewell's UK CNI survey reports that AI risk has become a leading concern and that 93% of surveyed organisations experienced a cyber incident in the past year. It also identifies gaps in regulatory-framework adoption and operational technology security.
- Bridewell's 2026 critical-national-infrastructure report says 77% of utilities organisations faced cyber incidents involving legacy software or unavailable patches. The company recommends stronger asset visibility, risk-based remediation, monitoring and incident-response preparation.
- Bridewell's 2026 UK CNI report found regulation is increasingly driving cyber investment, while adoption of major frameworks remains uneven. The report highlights the Cyber Security and Resilience Bill and the NCSC Cyber Assessment Framework.

Leading themes:

- Threat Intelligence & Research: 66.7% of Bridewell's coverage (theme index 1.89, net tone +50)
- NCSC & Government Policy: 22.2% of Bridewell's coverage (theme index 4.05, net tone +50)
- Regulation & Enforcement: 11.1% of Bridewell's coverage (theme index 0, net tone +100)

Notable positive coverage:

- 19 March 2026, computerweekly.com: [AI makes debut in Bridewell cyber security in CNI report](https://www.computerweekly.com/news/366640469/AI-makes-debut-in-Bridewell-cyber-security-in-CNI-report). Bridewell's UK CNI survey reports that AI risk has become a leading concern and that 93% of surveyed organisations experienced a cyber incident in the past year. It also identifies gaps in regulatory-framework adoption and operational technology security.
- 19 June 2026, itpro.com: [Legacy kit behind vast majority of cyber attacks on utilities](https://www.itpro.com/security/legacy-kit-behind-vast-majority-of-cyber-attacks-on-utilities). Bridewell's 2026 critical-national-infrastructure report says 77% of utilities organisations faced cyber incidents involving legacy software or unavailable patches. The company recommends stronger asset visibility, risk-based remediation, monitoring and incident-response preparation.
- 20 March 2026, newcivilengineer.com: [93% of UK critical national infrastructure operators faced cyber attacks in past year](https://www.newcivilengineer.com/latest/93-of-uk-critical-national-infrastructure-operators-faced-cyber-attacks-in-past-year-20-03-2026/). Bridewell's CNI Research Report 2026 found that 93% of UK critical-national-infrastructure operators experienced a cyberattack in the previous year. The report highlights phishing, ransomware, patching challenges and growing AI risk.

- [Bridewell deep dive](https://www.omniscan.ai/benchmarks/uk-cybersecurity-2026-h1?entity=bridewell&view=deep-dive)
- [Bridewell PDF report](https://www.omniscan.ai/benchmarks/uk-cybersecurity-2026-h1/reports/bridewell.pdf)

### BAE Systems Digital Intelligence

**Japan cyber-defence agreement defined a brief June presence**

BAE Systems Digital Intelligence ranked 5th of 6 by average monthly share of coverage (3.0%) in the UK Cybersecurity benchmark for H1 2026, with 6 mentions and a net tone of +100.

Its June share was 18.2% of tracked-company mentions, placing it third that month. Visibility peaked in June 2026 at 18.2%, compared with 0% in January 2026. June 2026: Coverage rose from zero to six mentions and an 18.2% share, alongside the BAE Systems–NEC active cyber-defence MoU for Japan. Japan cyber-defence agreement defined a brief June presence. Across the period, the balance of company-led announcements and externally driven reporting determined both BAE Systems Digital Intelligence's visibility and tone. The leading editorial themes show where attention was sustained and where individual stories changed the direction of coverage. The evidence should therefore be read as a connected reputation story: coverage volume establishes prominence, sentiment shows how that attention was framed, and the underlying themes and articles explain why the profile changed. BAE Systems and NEC agreed to collaborate on active cyber-defence capabilities for Japan's government. BAE Systems Digital Intelligence is presented as contributing cyber and digital expertise to the partnership.

Key messages:

- Visibility peaked in June 2026 at 18.2%, compared with 0% in January 2026.
- BAE Systems and NEC signed an MoU to pursue active cyber-defence work for the Japanese government under the Japan-UK Strategic Cyber Partnership. The article identifies BAE Systems Digital Intelligence leadership and expertise as central to the collaboration.
- Contracts & Partnerships accounted for 6 mentions in this edition.
- Independent editorial reporting cited BAE Systems Digital Intelligence as supplying cyber and digital capability to the BAE Systems–NEC agreement. A technical briefing confined to that stated role could strengthen its association with the captured Japan cyber-defence partnership and address a measured position ranked 5th by average monthly share, 2.4 share points behind Bridewell.

Leading themes:

- Contracts & Partnerships: 100.0% of BAE Systems Digital Intelligence's coverage (theme index 41.75, net tone +100)

Notable positive coverage:

- 15 June 2026, adsadvance.co.uk: [BAE Systems and NEC sign MoU to strengthen Japan’s cyber defence](https://www.adsadvance.co.uk/bae-systems-and-nec-sign-mou-to-strengthen-japan-s-cyber-defence/). BAE Systems and NEC agreed to collaborate on active cyber-defence capabilities for Japan's government. BAE Systems Digital Intelligence is presented as contributing cyber and digital expertise to the partnership.
- 15 June 2026, enterprisetimes.co.uk: [NEC and BAE sign MoU to win Active Cyber Defence contracts in Japan -](https://www.enterprisetimes.co.uk/2026/06/15/nec-and-bae-sign-mou-to-win-active-cyber-defence-contracts-in-japan/). BAE Systems and NEC signed an MoU to pursue active cyber-defence work for the Japanese government under the Japan-UK Strategic Cyber Partnership. The article identifies BAE Systems Digital Intelligence leadership and expertise as central to the collaboration.
- 17 June 2026, asiapacificsecuritymagazine.com: [BAE Systems and NEC sign MoU on active cyber defence work for Japan](https://www.asiapacificsecuritymagazine.com/bae-systems-and-nec-sign-mou-on-active-cyber-defence-work-for-japan/). BAE Systems Digital Intelligence and NEC signed an MoU to explore active cyber-defence capabilities supporting Japan's government. The collaboration is linked to the UK-Japan Strategic Cyber Partnership.

- [BAE Systems Digital Intelligence deep dive](https://www.omniscan.ai/benchmarks/uk-cybersecurity-2026-h1?entity=baesystemsdigitalintelligence&view=deep-dive)
- [BAE Systems Digital Intelligence PDF report](https://www.omniscan.ai/benchmarks/uk-cybersecurity-2026-h1/reports/baesystemsdigitalintelligence.pdf)

### Immersive Labs

**Talent & Skills shaped Immersive Labs' media profile during H1 2026**

Immersive Labs ranked 6th of 6 by average monthly share of coverage (1.6%) in the UK Cybersecurity benchmark for H1 2026, with 3 mentions and a net tone of +100.

Immersive Labs recorded 3 mentions in the edition, averaged 1.6% cohort share and ranked #6 by average share of coverage. Overall net tone was +100, based on 3 positive, 0 neutral and 0 negative mentions. This analysis covers January to June 2026. March 2026 recorded 1 mention, 3% cohort share and rank #5, and net tone +100. Talent & Skills was the month's largest subject, with 1 mention. Leading evidence included “Why your phishing simulations aren't building a security culture” (helpnetsecurity.com, 25 March; Talent & Skills). May 2026 recorded 1 mention, 3.7% cohort share and rank #3, and net tone +100. Talent & Skills was the month's largest subject, with 1 mention. Leading evidence included “Are cyber pros fooling themselves with skills development?” (techradar.com, 26 May; Talent & Skills). June 2026 recorded 1 mention, 3% cohort share and rank #6, and net tone +100. Talent & Skills was the month's largest subject, with 1 mention. Leading evidence included “SC Media UK” (insight.scmagazineuk.com, 4 June; Talent & Skills). Talent & Skills accounted for 3 mentions. Talent & Skills was the largest positive thematic driver; the edition contained no negative mentions. Immersive VP Dan Potter argued that realistic, pressure-based exercises and targeted micro-learning build stronger cyber resilience than routine phishing simulations. Immersive's Dan Potter argues that cyber-skills programmes can create misplaced confidence when they measure completion rather than crisis performance. Immersive benchmark data indicates decision-making accuracy falls sharply during breach exercises.

Key messages:

- Immersive Labs recorded 3 mentions in H1 2026, averaging 1.6% cohort share and ranking #6 by average share of coverage, with net tone +100.
- The sentiment distribution comprised 3 positive, 0 neutral and 0 negative mentions, producing overall net tone +100.
- Visibility was highest in May 2026, when Immersive Labs recorded 3.7% cohort share and 1 mention; it was lowest in March 2026, at 3% and 1 mention.
- Talent & Skills was the largest editorial theme, with 3 mentions across the edition.
- Talent & Skills led the positive evidence; a representative article was “SC Media UK” (insight.scmagazineuk.com, 4 June; Talent & Skills).

Leading themes:

- Talent & Skills: 100.0% of Immersive Labs's coverage (theme index 14.17, net tone +100)

Notable positive coverage:

- 4 June 2026, insight.scmagazineuk.com: [SC Media UK](https://insight.scmagazineuk.com/library/term/2026-awards-winners). SC Media UK lists Immersive as recognised for real-world cyber-readiness training in its 2026 awards coverage.
- 25 March 2026, helpnetsecurity.com: [Why your phishing simulations aren't building a security culture](https://www.helpnetsecurity.com/2026/03/25/security-culture-training-video/). Immersive VP Dan Potter argued that realistic, pressure-based exercises and targeted micro-learning build stronger cyber resilience than routine phishing simulations.
- 26 May 2026, techradar.com: [Are cyber pros fooling themselves with skills development?](https://www.techradar.com/pro/are-cyber-pros-fooling-themselves-with-skills-development). Immersive's Dan Potter argues that cyber-skills programmes can create misplaced confidence when they measure completion rather than crisis performance. Immersive benchmark data indicates decision-making accuracy falls sharply during breach exercises.

- [Immersive Labs deep dive](https://www.omniscan.ai/benchmarks/uk-cybersecurity-2026-h1?entity=immersivelabs&view=deep-dive)
- [Immersive Labs PDF report](https://www.omniscan.ai/benchmarks/uk-cybersecurity-2026-h1/reports/immersivelabs.pdf)

## Methodology

- **Share of coverage**: an organisation's mentions divided by all mentions of the organisations tracked in the same sector that month, in UK earned media. It is the central measure of media visibility in Omniscan benchmarks. "Average monthly share" is the mean of the monthly shares across the reporting period.
- **Mention**: one article that covers an organisation, classified as positive, neutral or negative in tone. Articles are deduplicated, and an organisation's own websites and passing sponsorship name-checks are excluded, so only earned media counts.
- **Net tone**: positive mentions minus negative mentions, as a percentage of all mentions (range −100 to +100).
- **Themes**: every article is assigned to one of the sector's editorial themes. A theme index above 1 means the organisation is covered on that theme more than its peers are; below 1 means less.
- **Calculation**: every figure is computed directly from the classified articles; narrative summaries are checked against those figures.
- **Sources**: UK national and international, trade and specialist, regional and local, and aggregator and syndication earned media.

## Other UK Cybersecurity editions

- [UK cybersecurity media reputation tracker – 2026 year to date](https://www.omniscan.ai/benchmarks/uk-cybersecurity-2026-ytd.md)
- [UK cybersecurity media reputation tracker – July 2026](https://www.omniscan.ai/benchmarks/uk-cybersecurity-2026-07.md)
- [UK cybersecurity media reputation tracker – August 2026](https://www.omniscan.ai/benchmarks/uk-cybersecurity-2026-08.md)
- [UK cybersecurity media reputation tracker – September 2026](https://www.omniscan.ai/benchmarks/uk-cybersecurity-2026-09.md)
- [All Omniscan media benchmarks](https://www.omniscan.ai/benchmarks.md)

## How to cite

Omniscan, "UK cybersecurity media reputation tracker", H1 2026 (1 January 2026–30 June 2026), published 1 September 2026. https://www.omniscan.ai/benchmarks/uk-cybersecurity-2026-h1