Bytes Technology Group has agreed to buy London managed security provider CyberOne for an initial £19.4m, giving the FTSE-listed reseller its own round-the-clock security operations centre. The deal lands in a record quarter for cyber M&A and says a lot about where UK buyers are now spending their security budgets.
What happened
On 13 October 2026 Bytes Technology Group (BTG), the software, cloud and security reseller listed on the London and Johannesburg stock exchanges, announced the purchase of CyberOne Limited. The announcement came on the same morning as its results for the six months to 31 August. According to the interim statement, contracts were exchanged on 9 October, and completion depends on clearance under the National Security and Investment Act 2021, which BTG expects before the end of October.
The headline price is £19.4m, paid from cash BTG already holds. Further payments depend on how CyberOne performs over the next 16 months. BTG’s results statement caps those payments at £18.0m, and IT Channel Oxygen’s coverage gives the same “up to £18m” ceiling, so the total could reach £37.4m. IT Channel Oxygen describes it as the group’s first acquisition in several years.
CyberOne was founded in 2005, is based in London and employs more than 80 people across the UK and the Philippines. It generated £9.5m of revenue in the year to 31 July 2026, with what BTG calls high double-digit growth and widening gross margins. Chief executive Sam Mudd called the business “a strong strategic fit”, and CyberOne founder Dominic List and his leadership team will stay on, running it initially as a standalone unit alongside BTG’s sales teams.
The detail
CyberOne sells AI-enabled managed security, security operations, resilience consulting and professional services, built on Microsoft technology. It holds Microsoft Security Elite Partner status and belongs to the Microsoft Intelligent Security Association. BTG says roughly 90% of CyberOne’s income is recurring revenue under multi-year contracts.
IT Channel Oxygen reports that the purchase is meant to reduce reliance on third parties for 24×7 security operations at Bytes Software Services, BTG’s private sector arm, and the results statement says the same thing in its own words. Phoenix Software, the public sector business, will keep its existing security operation because accreditation and tenancy requirements differ in government work.
The financial backdrop is strong. BTG’s gross invoiced income rose 19.6% to £1,605.2m and revenue grew 18.7% to £128.3m. Operating profit rose 6.6% to £35.3m, slower than gross profit growth of 17.8% because of cost normalisation, including bonuses, and investment in technical staff. Services income was the standout, up 41%, which BTG puts down to rising demand for managed services and security. Business Day notes that BTG expects amortisation to cancel out CyberOne’s operating profit in FY2027, with the boost to earnings per share coming in FY2028. Full-year guidance, which excludes CyberOne, stays at low to mid-teens gross profit growth.
Microsoft’s partner incentive changes, which take effect this month, matter here too. BTG says they reduce rebates on some legacy products and increase rewards on growth products that include security and AI, so a partner that can deliver managed Microsoft security services stands to gain.
Why it matters for UK organisations
This deal is one example of a wider pattern. London adviser Arrowpoint Advisory counted a record 170 cyber security transactions across Europe and North America in Q3 2026, and it singles out the UK mid-market, and in particular MSSP consolidation, as especially busy. Specialist, founder-led providers with recurring revenue are being bought by larger groups that want to offer security as a service, not just resell licences.
For customers, that has three practical consequences. First, your reseller may soon offer to monitor your environment as well as license it. That can be convenient, but it concentrates commercial and operational dependency in one supplier. Second, if you already use a smaller MSSP, ownership changes can bring new contract terms, new tooling, new staff and sometimes offshore delivery. CyberOne already operates across the UK and the Philippines, which is worth knowing for data residency and access reviews. Third, consolidation around Microsoft security gives Microsoft-heavy estates deeper partner expertise, but it can also reinforce single-vendor risk.
The National Security and Investment Act condition is also worth noting. Deals involving security service providers can attract government scrutiny, and that is likely to continue if the Cyber Security and Resilience Bill brings managed service providers further into the regulatory net.
Expert view
In my experience, the quality of a managed SOC depends far more on its people and its detection engineering than on the logo above the door. When we test organisations that outsource monitoring, the gaps usually come from scope: log sources nobody onboarded, cloud tenants left out of the contract, or alerts that go to a mailbox nobody owns out of hours. A larger parent can fund better tooling and more analysts, but integration periods are when those details slip.
The Microsoft focus has both sides. Many UK organisations pay for E5 or Defender licences and use a fraction of what they include, so a partner whose business model depends on getting that value delivered is a good thing. The risk is a monoculture: if your detection, identity and email security all sit in one ecosystem, run by a partner whose commercial incentives are tied to that vendor, you need independent assurance that it actually works. That is where penetration testing and purple team exercises earn their keep.
I would also say the price looks reasonable rather than frothy. Around two times trailing revenue upfront, with a substantial earn-out, shows a buyer paying for growth it wants to see delivered. That should reduce the risk of post-deal cost-cutting.
What to do now
- Map your supplier dependencies. List who licenses, configures and monitors each part of your security stack, and identify where one company now covers more than one of those roles.
- Review MSSP contracts for change of control. Check notification duties, the right to terminate, data location commitments and whether named analysts or service levels are guaranteed after an acquisition.
- Check offshore access. Where any provider uses staff outside the UK, confirm which systems they can reach and how privileged access is logged, in line with the Cyber Essentials user access control requirements.
- Test the SOC independently. Commission an assumed breach or purple team exercise to confirm alerts fire and escalate out of hours, rather than relying on dashboards.
- Get value from licences you already own. Audit which Defender, Entra and Purview features you are paying for and not using, and make secure configuration and malware protection the first priorities.
- Prepare for regulation. If you are, or rely on, a managed service provider, follow the Cyber Security and Resilience Bill and plan for incident reporting duties.
Bottom line
Bytes buying CyberOne is a modest deal with a clear message: UK resellers want to own the security service, not just sell the software beneath it. That can mean better-resourced monitoring for customers, provided they keep their contracts tight, their supplier map current and their assurance independent.
Sources
- Investegate (RNS): Bytes Technology Group, Acquisition of CyberOne
- Investegate (RNS): Bytes Technology Group, Interim Results
- Business Day: Bytes acquires CyberOne as first-half earnings rise
- IT Channel Oxygen: Bytes Technology Group makes £19.6m acquisition as it hails positive Microsoft incentive changes
- Arrowpoint Advisory: Q3 2026 Cyber Security Update
