Summary
- Context reports 75.9% year-on-year growth in compliance, awareness, and training product revenues through distribution.
- Identity and access management revenues rose 33.7% in the cited figures.
- Channel sales trends describe purchasing through distributors, not total UK cyber incident risk.
UK cybersecurity purchasing through distribution channels is shifting towards compliance, staff awareness, and identity controls, according to third-quarter figures from market research company Context. Reporting published on 12 October cites annual revenue growth of 75.9% for compliance, awareness, and training products, while identity and access management grew by 33.7%.
The figures, discussed alongside commentary from Omdia, indicate how customers and resellers are changing spending priorities as organisations manage regulatory demands and increasingly complex technology estates. They cover particular product categories sold through distribution, rather than the entirety of cybersecurity expenditure or the volume of security incidents in the UK.
Compliance tools can encompass software that helps companies organise controls, document assessments, manage policies, and produce evidence for audits. Awareness and training products address the human elements of security programmes, while identity products govern how employees, contractors, machines, and applications gain access to services. The categories overlap in practice, but their purchasing drivers can differ.
For identity and access management, the rise of cloud services and remote administration has expanded the number of credentials, roles, and connections organisations must control. Increasing use of automated software and AI agents can add non-human identities whose privileges need to be assigned, monitored, and withdrawn. Growth in category revenue does not reveal which individual use cases accounted for purchases in the Context sample.
Distribution figures and business decisions
A distributor’s revenue is affected by prices, product mix, channel coverage, and timing as well as end-customer demand. A strong percentage increase may represent a large absolute expansion, but it can also be amplified by a comparatively small base in the previous period. Without the original category totals and collection method, it is not possible to identify the precise market share of either compliance products or identity systems.
Regulatory pressure provides a plausible part of the wider context. UK businesses work with domestic privacy and cybersecurity obligations, while some companies with European operations also face requirements relating to digital operational resilience, products, and essential services. Buying software can assist those efforts, but possession of a compliance platform is not equivalent to meeting the underlying duty.
Similarly, a growth figure for employee awareness programmes cannot establish that human error is increasing, that training will prevent every phishing attempt, or that technical controls have become less important. Security budgets usually involve a combination of prevention, detection, response, recovery, and governance; the balance depends on an organisation’s architecture and exposure.
The Omdia commentary accompanying the distribution research indicates that resellers are responding to changing questions from enterprise customers. For an integrator, this may influence which technical skills and advisory services are necessary to design systems that work within existing client infrastructure. Any broad claim that the whole channel has changed direction should nevertheless be grounded in more than one quarter’s figures.
Identity and compliance are closely related in operational terms. Policies determine who may access a system, technical controls enforce that decision, and records allow an organisation to demonstrate what happened. A purchase prompted by regulatory scrutiny can therefore expose weaknesses in identity inventories, privileged accounts, or responsibility for access provided to external suppliers.
Product bundling can complicate categories. Software sold primarily as an identity service may include governance reporting, while a compliance package may include training or audit functions. A purchase may consequently be assigned to different segments according to the provider’s product definitions. Stable category rules and visibility of direct vendor sales would be needed to determine whether the distribution figures represent an enduring change across the whole UK security market.
The distribution figures describe growth in particular channel categories, rather than proving a wholesale change in all enterprise cybersecurity spending. It shows unusually strong reported year-on-year revenue growth in particular distributed security categories during the third quarter, while leaving open the share of purchases made directly from vendors and the durability of the trend in subsequent periods.
