As a founder myself, I know how easy it is to assume state espionage only happens to defence primes and government departments.
It doesn’t. If your company holds valuable intellectual property, early-stage research or sensitive data, it may already interest a hostile state. You are also likely to be easier to reach than the big players. That is the problem the UK’s new Secure Innovation Security Review is designed to address. As one of the scheme’s Approved Reviewers, I want to explain what it is, who it is for and why I think it matters.
Why early-stage tech is an attractive target
Certain states deliberately target emerging technologies to fast-track their own economic and military capability. Taking a design, a dataset or a team’s know-how is quicker and cheaper than developing it from scratch.
Start-ups are attractive for simple reasons. Security is rarely anyone’s full-time job. Investors, partners and new hires arrive quickly, often before anyone has asked who they really are. And the most valuable information often sits on a handful of laptops.
None of this is negligence. It is what growth looks like. But it can leave a wide gap between the value of what a company holds and the protection around it, and anyone weighing up targets will notice that gap.
What is the Secure Innovation Security Review?
NPSA and NCSC, the UK’s national technical authorities for protective and cyber security, developed the Secure Innovation campaign. The Security Review scheme builds on it by giving early-stage technology companies part-funded access to an Approved Reviewer. Innovate UK administers the scheme.
The first year supported over 200 companies. The next round is now open, with the aim of reaching up to 1,000 organisations over the life of the scheme.
Each Secure Innovation Security Review includes:
- an in-person review of your current protective security
- a confidential, tailored report with practical recommendations
- a £300 Cyber Essentials voucher
- a follow-up session six months later to check progress
The review is valued at £3,000. Your company contributes £500, including VAT, and government funds the rest.
More than a cyber check
It’s easy to hear “security review” and think of firewalls and passwords. Cyber security is part of it. But a Secure Innovation Security Review looks at the wider picture: governance, security culture, risk management, supply chains and partnerships, incident management, and physical and personnel security.
That breadth matters. A determined adversary does not limit itself to one route in. It might use a phishing email, a well-placed job applicant, an overly curious investor or an unlocked lab, whichever is easiest. A review that only examines one of those routes leaves the others open.
I approach every assessment with three questions. What are you protecting? What are you protecting it from? How vulnerable is it? For a young tech company, the honest answer to the first question is often bigger than the founders expect, which is exactly why the other two matter.
Who can apply?
To qualify, your company must:
- be registered and based in the UK
- have fewer than 250 people
- work in one of the 17 sensitive areas of the economy set out under the National Security and Investment Act, or in selected sectors from the UK’s industrial strategy
- be willing to commit time, and potentially budget, to improving its security, including the six-month follow-up
Funding is limited and goes to eligible companies on a first-come, first-served basis, so it is worth applying early.
It is also worth being clear about what the scheme is not. It is not a certification, and there is no badge at the end. What you get is an honest, expert view of where you stand and a practical plan to improve it. You can still tell customers and investors that you have completed a review, and that is a conversation worth being able to have.
Choosing your reviewer
When you apply for a Secure Innovation Security Review, you can read the profiles of the Approved Reviewers and choose who you would like to work with.
I’ve spent the last ten years building my own technology company, so I understand what you’re going through: limited time, tight budgets and a long list of priorities competing for both. Security is my business, but I understand why it can slip down yours, and I don’t judge that.
That founder’s view sits alongside the professional one. I’m a Chartered Security Professional, with a background spanning military service, law enforcement and over two decades of senior security consulting. My aim is simple: you leave knowing what matters now, what can wait, and what to do next.
If that sounds like the right fit, look for Paul Mercer on the list.
You can find out more and apply on the Innovate UK Business Connect website. If you’d like to talk it through before applying, get in touch.
If someone were weighing up your company as a target today, how hard would you make it for them?
This article was written with AI assistance.