Security is usually sold to founders as a cost. Done properly, it is a sales asset. A start-up security review under the government’s Secure Innovation scheme is one of the simplest ways I know to test that idea, because the government pays most of the bill.
Last week I explained what the Secure Innovation Security Review is and who can apply. This week I want to look at what you actually get for your £500, and why I think it is worth more than the price suggests.
What does a start-up security review include?
The review is valued at £3,000. Your company contributes £500, including VAT, and government funds the remaining £2,500. For that, you receive:
- an in-person review with an Approved Reviewer
- a confidential, tailored report with practical recommendations
- a £300 Cyber Essentials voucher
- a follow-up session six months later to check progress and agree next steps
The review covers far more than IT. It looks at governance, security culture, risk management, supply chains and partnerships, incident management, and physical and personnel security, as well as cyber.
The report stays confidential. It is shared only with the small number of government bodies that run the scheme.
One thing to be clear about: the funding covers the review itself, not the cost of putting the recommendations in place. A good reviewer keeps that in mind and recommends what your business can realistically do.
Why the Cyber Essentials voucher matters
Cyber Essentials is the government-backed baseline for cyber security. It covers a small set of technical controls that protect against the most common online attacks, such as phishing and password guessing.
The certificate itself is modest. What it opens up is not. A growing number of organisations, including many UK government buyers, expect suppliers to hold Cyber Essentials before they will award a contract. For a start-up chasing its first large customer, that can be the difference between being on the shortlist and not.
The £300 voucher covers much of the cost of getting there. You can read more about the standard on the NCSC Cyber Essentials pages.
Security as a sales asset
Large customers and serious investors ask about security early. It shows up in supplier questionnaires, in procurement checks and in investor due diligence. A founder who can answer those questions clearly, and show they have had an independent review and acted on it, builds confidence quickly.
I see this from the other side too. HawkSight sells to large organisations, and holding ISO 27001 has made those conversations far easier. Security that you can evidence is security that helps you sell.
It is worth being honest about the limits. The review is not a certification, and there is no badge at the end. But you can tell customers and investors that you have completed one, and explain what you have done since. That is often a more convincing answer than a logo.
What a good start-up security review should leave you with
The value of any review lies in what happens next. A long list of findings that nobody has time to address helps no one. What a founder needs is a short, prioritised plan: what matters now, what can wait, and what to do next.
That plan should fit the size of your team and your budget. Each action should have an owner. And the six-month follow-up gives you a natural point to check progress, rather than letting the report gather dust.
How to get started
The scheme is open to UK-registered companies with fewer than 250 people, working in the sensitive sectors set out under the National Security and Investment Act. Funding is limited and allocated on a first-come, first-served basis.
When you apply through Innovate UK Business Connect, you can read the profiles of the Approved Reviewers and choose who you would like to work with. If you would like that to be me, look for Paul Mercer on the list, or get in touch first if you have questions.
If a major customer sent you their supplier security questionnaire tomorrow, how confidently could you answer it?
This article was written with AI assistance.