Furthering our work with the former Department for Science, Innovation and Technology (DSIT) cyber security team, Plexal has researched the inner workings of the national software market, the findings from which have been published on Gov.UK.
The UK Software Market Analysis marks the first time the UK software market, a large, SME-dominated, globally connected sector, has been mapped to this scale.
And the goal of our analysis is to drive policymaking that can boost software market adoption of core security principles, improving resilience for vendors and their customers.
One such example is the government’s voluntary Software Security Code of Practice, which comprises 14 principles for software vendors to implement for a consistent security baseline. Elsewhere, findings will also support consideration of additional market incentives.
Working with AI research organisation Glass.AI on this project, we identified 62,339 UK software companies, of which 97% are SMEs, with further growth expected.
Although innovation is ripe and early-stage vendors begin selling their products directly, resellers play a key part in achieving further scale. Hyperscalers such as Amazon Web Services, Microsoft Azure and Google Cloud are highly influential across the market, shaping development, distribution and security trends.
Alex Wakefield, Innovation Lead at Plexal, explained what a milestone moment this is: “Previously, there wasn’t a clear baseline understanding within DSIT of what constitutes the UK software market. But we’ve established the starting point and provided a foundational view that can inform future software policy.
“Through exploring hyperscalers, resellers and developers, we can better understand where influence sits in the ecosystem, which is critical insight to improve software security practices, whether through codes of practice or targeted standards.
“Crucially, we’ve successfully helped government focus its efforts. Rather than treating software as a single, broad sector, priority segments have been identified and can be engaged more effectively. By understanding their barriers, concerns and the reasons behind low uptake of existing guidance. That means more targeted, impactful action where it matters most.”
In July 2026, the DSIT cyber security team was moved into the new Department for Digital, Culture, Media and Sport (DCMS) as part of wider government departmental changes.
