Shearwater Group’s Brookcourt Solutions has won a two-year, £1.7m contract to run a threat intelligence platform for a central government department that it already serves. The deal is small by Whitehall standards, but it suggests buyers see value in spotting threats early rather than cleaning up afterwards.
What happened
On the morning of 20 October 2026, Shearwater Group plc (AIM: SWG) told the market that its subsidiary Brookcourt Solutions had signed a new £1.7m contract with an existing central government customer. The group did not name the department, and nothing in the announcement or the coverage that followed identifies it. The contract runs for two years and covers what the company describes as advanced threat intelligence capabilities.
It is a renewal with more scope. The customer’s previous agreement had expired, and the new one adds platform features and covers more users. Shearwater said the work will help the department protect GOV.UK sites and services, members of the public and the department’s wider supply chain against both cyber attacks and fraud.
The contract went through G-Cloud 15, the government’s procurement framework for cloud software, hosting and support. On 6 August 2026 Shearwater announced that Brookcourt’s offering on that framework had grown. UK Investor Magazine reported that two group subsidiaries were added to G-Cloud 15 that month and that an in-house AI tool helped with the submission. Shearwater links today’s win directly to that expansion.
The market noticed. Alliance News, as republished by MarketScreener, reported that Shearwater shares rose about 5.8% in early AIM trading. That came on a weak morning for AIM, and intraday figures varied between data providers. The news also lands a week before Shearwater’s results for the year to 30 June 2026, which are due on 27 October.
The detail
A threat intelligence platform for a department like this one usually does a few related jobs. It watches the open web, social media, criminal forums and domain registrations for anything that impersonates or targets the organisation. It then turns that material into alerts and takedown requests that analysts can act on. The announcement mentions fraud as well as cyber threats, which points to brand and citizen protection: fake GOV.UK lookalike sites, phishing campaigns that use government branding, and scams aimed at people who deal with public services online.
Shearwater’s chief executive, Phil Higgins, described the aim as spotting risks “before they result in a successful attack”. The company presents this as pre-emptive defence. For a public-facing department, that means finding a cloned payment page or a spoofed tax refund message before citizens start reporting it.
Three details stand out commercially. First, this is a re-procurement, not a first purchase: an existing customer chose to renew and bought more. Second, more users suggests the intelligence reaches beyond the central security team. Third, using G-Cloud tends to keep procurement quick, and a two-year term leaves room to re-tender as AI reshapes the market.
Why it matters for UK organisations
At £850,000 a year on average, this contract will not change the government cyber market on its own. It matters as a sign of where demand is going. Government has learnt that its digital front door is a target in its own right. Criminals copy GOV.UK because people trust it, and much of the harm happens beyond the department’s control: search adverts, texts, lookalike domains and suppliers. A firewall cannot see any of that, but external threat intelligence can.
Private sector organisations should take note. Any UK business with a well-known brand, a customer portal or a large supply chain has the same problem on a smaller scale. Supplier compromise has been a recurring theme in UK incidents this year. A central department paying for a broader platform, with more users on it, suggests that the government’s own security buyers think outside-in visibility is worth the money.
The deal also matters for the UK security sector. G-Cloud remains one of the more realistic ways for small, listed UK suppliers to win government work against much larger integrators. For a company of Shearwater’s size, a seven-figure renewal is material, hence the market announcement.
Expert view
In my experience, threat intelligence is one of the most oversold and least well used areas of security spending. Too many organisations buy a feed, plug it into a SIEM and never ask whether it changed a decision. The test is not how much data a platform brings in. The test is whether someone acts on it: a lookalike domain taken down, a supplier warned, a fraudulent page reported before it collects payments. What I find encouraging here is that an existing customer chose to renew and added users. That is the strongest evidence of value the public sector usually provides.
When we run external reconnaissance as part of a test, the first thing we do is look at an organisation the way an attacker would: exposed services, leaked credentials, forgotten subdomains, brand abuse, and suppliers holding privileged access. A well-run intelligence service does that work continuously instead of once a year. That is the right direction, but not a substitute for hygiene. Intelligence about a phishing kit is little use if the targeted accounts lack strong multi-factor authentication.
A word of caution on reading this story. Contract announcements from listed companies are written for investors. The department has not commented, the platform vendor behind Brookcourt’s service is not named, and how well the service works is not public. The share price rise reflects investor sentiment ahead of results, not an independent judgement of the platform.
What to do now
For security leaders weighing up a similar investment, I would prioritise as follows:
- Start with outcomes, not feeds. Decide what you want intelligence to change, such as takedowns, fraud losses or supplier warnings, and measure that from the first day.
- Map your external attack surface. List domains, subdomains, exposed services and cloud assets. Unknown internet-facing systems undermine the Cyber Essentials firewall and secure configuration controls.
- Watch for brand impersonation. Monitor lookalike domains and fake social accounts, and agree a fast takedown route with your registrar or provider before you need it.
- Bring suppliers into scope. Include critical third parties in monitoring and contracts, and check their access against the Cyber Essentials user access control requirements.
- Close the loop with the basics. Use intelligence on credential theft and phishing kits to prioritise phishing-resistant MFA, patching and account reviews. Cyber Essentials covers these under user access control, security update management and malware protection.
- Keep contracts flexible. Consider shorter terms, like the two years agreed here, and frameworks that let you re-tender as AI changes what tools can do.
Bottom line
A £1.7m renewal will not make the national news, but it is a clear sign of demand. A central government department has paid for a broader, more widely used threat intelligence service to protect GOV.UK and the citizens who rely on it. For Shearwater, it is useful momentum before next week’s results. For everyone else, it is a reminder that a growing share of the attack surface sits outside your own network, and you need to watch it.
Sources
- Investegate (RNS): Shearwater Group PLC – Central Government Cyber Security Contract Win
- Vox Markets: Shearwater Group secures £1.7 million government cyber security contract
- MarketScreener (Alliance News): Stocks down as oil climbs, France worry lingers
- UK Investor Magazine: Shearwater: secure future
- Investegate (RNS): Shearwater Group PLC – Notice of Results and Investor Presentation
