Developing new technology takes considerable investment, whether that’s in research, specialist people or bringing a product to market. But how much attention is being given to protecting that investment?
For UK technology start-ups and spinouts, valuable intellectual property, research and commercial information can attract attention from competitors, cyber criminals and even state-backed actors.
And it isn’t always a sophisticated cyber attack that puts a business at risk. An employee sharing sensitive information, a supplier with unnecessary access or inadequate security at a research facility could all create opportunities for someone looking to obtain valuable information.
The UK Government’s Secure Innovation Security Review Scheme has been established to help innovative businesses identify and address these risks.
Through the scheme, eligible businesses can access a security review worth £3,000 for just £500, with the remaining £2,500 funded by the Government.
Toro Solutions is an approved Security Reviewer under the scheme and we’re keen to make more businesses aware of the support available.
Why should technology start ups be thinking about security?
When a business is developing new technology, its most valuable assets might be research findings, software, designs or commercially sensitive information that has taken years to develop.
Losing control of that information could have serious consequences, particularly for businesses working in areas such as artificial intelligence, defence, advanced manufacturing or quantum technologies.
The National Protective Security Authority (NPSA) and National Cyber Security Centre (NCSC) have highlighted the risks that state-backed actors can pose to innovative UK businesses, including attempts to acquire sensitive technology and research.
Smaller organisations are not necessarily less attractive targets. They may hold valuable information but have fewer resources dedicated to protecting it.
As businesses recruit employees, establish partnerships, seek investment and expand their operations, the challenge is understanding where they are exposed and which security measures should take priority.
What is the Secure Innovation Security Review Scheme?
The scheme gives eligible UK businesses access to an approved Security Reviewer who can assess their existing arrangements and provide advice on protecting their technology, information and operations.
It is a joint initiative involving the Department for Science, Innovation and Technology (DSIT), NPSA and NCSC, with delivery supported by Innovate UK Business Growth. The reviews use a protective security framework developed by NPSA and NCSC.
Importantly, the review looks beyond cyber security.
A business might have strong technical controls but limited procedures for managing visitors, protecting sensitive research or assessing the security of commercial partners.
The review considers six areas:
- Protective security governance: How security is managed across the organisation, including responsibilities, policies and oversight.
- Security culture: Whether employees understand the risks and their role in protecting the business.
- Risk management: How threats and vulnerabilities are identified and addressed.
- Cyber security: How systems, technology and information are protected.
- Secure supply chains and partnerships: The risks associated with suppliers, investors, collaborators and other third parties.
- Incident management: How the organisation prepares for and responds to security incidents.
Looking at these areas together can help businesses identify weaknesses that might otherwise be missed, including risks involving people, physical environments and third-party relationships.
What does the security review include?
The review is intended to give businesses a clearer understanding of their current security arrangements and where improvements may be needed.
It includes:
- An in person security assessment – An approved Security Reviewer visits the business to understand its operations, existing security arrangements and potential areas of exposure.
- A tailored report with practical recommendations – Following the assessment, the business receives a report setting out the findings and recommended improvements. This helps organisations prioritise the measures that matter most, taking account of their operations and the risks they face. The report is treated as confidential, although it may be shared with specified organisations involved in administering and overseeing the scheme.
- A six-month follow-up – The reviewer follows up with the business six months later to discuss progress and any improvements made following the initial assessment.
- A £300 Cyber Essentials voucher – Participating businesses also receive a £300 voucher towards Cyber Essentials Level 1 certification or recertification through IASME. The voucher is non-transferable, must be redeemed by 31 March 2027 and is subject to the scheme’s terms. The review is a high-level assessment rather than a penetration test or certification. The £3,000 covers the review itself, not the cost of implementing any recommended security improvements.
Who is eligible?
The scheme is aimed at innovative UK businesses, particularly early-stage technology companies and university spinouts.
To qualify, organisations must meet several requirements, including:
- Being registered and trading in the UK.
- Having fewer than 250 employees.
- Operating in an eligible sector.
- Agreeing to contribute £500, including VAT, towards the review.
- Being willing to dedicate time and resources to the review process, including preparatory work, documentation and the six-month follow-up.
Eligible sectors include artificial intelligence, cyber security, defence, advanced manufacturing, life sciences, quantum technologies, semiconductors and other areas identified in the scheme’s criteria.
The scheme is also subject to subsidy control requirements, including limits on previous Minimal Financial Assistance and De Minimis support received.
Businesses should check the full eligibility criteria before applying, including the applicable subsidy limits and any additional requirements.
How much funding is available?
The total cost of the security review is £3,000, including VAT.
Of this, £2,500 is funded through the scheme, leaving the participating business to contribute £500.
Applications for the current funding round close on 31 January 2027, with more than 300 grants allocated to the round.
Funding is allocated on a first-come, first-served basis to businesses that meet the eligibility criteria and successfully complete the application process. It is not guaranteed and places may be taken before the closing date.
The wider scheme is expected to support up to 1,000 organisations through to 2029.
How can Toro Solutions help?
Toro Solutions is an approved Security Reviewer under the Secure Innovation Security Review Scheme.
Our team works across cyber security, physical security and wider organisational risk. We understand that protecting valuable technology involves more than securing IT systems. It also means considering the people who have access to information, the organisations you work with and the physical environments where research and development take place.
Through the scheme, we can help eligible businesses assess their existing arrangements, understand where they may be exposed and identify practical improvements.
How do you apply?
Applications are managed through Innovate UK Business Growth.
Businesses must first apply and receive approval. Once accepted, they can select an approved Security Reviewer from the list provided.
The business then completes the necessary preparatory work before arranging its assessment. The £500 contribution is paid directly to the selected reviewer.
Following the visit, the reviewer prepares the report, which the business reviews and approves before submission through the scheme’s process. A six-month follow-up is also included.
If you’re developing innovative technology and want to understand whether your business qualifies, you can check the eligibility criteria and apply through Innovate UK Business Growth.
Check your eligibility and apply through Innovate UK
Toro Solutions is an approved Security Reviewer under the scheme. If you’d like to understand what’s involved in the review or discuss how we could support your business, please get in touch.