Two numbers published this week don’t sit comfortably together. The UK Cybersecurity Start-up Radar 2026, compiled by Wavestone, shows genuinely active innovation across identity, cloud security, threat detection, and data protection — the UK’s cyber start-up scene is developing at pace. At the same time, Credit-Connect’s latest data shows small business growth predictions have fallen to a 12-year low. Confidence is down. Investment appetite is down. And the sector best placed to help SMEs defend themselves is producing more options than ever, at exactly the moment fewer businesses feel able to spend on them.

That gap matters because cyber risk doesn’t pause for a downturn. Attackers don’t check your growth forecast before deciding whether you’re worth targeting — if anything, economic pressure makes SMEs a softer target, since stretched teams cut corners on the basics first.

The pattern worth breaking

When confidence weakens, the instinct is to defer anything that isn’t immediately revenue-generating. Security spending is one of the first things paused, alongside hiring and modernisation projects, because the cost is visible today and the benefit is a breach that (hopefully) never happens. The problem is that deferred security spending doesn’t remove the risk — it just means you’re carrying it uninsured for longer.

The alternative isn’t spending more, it’s spending more deliberately. A weak growth forecast is a reasonable argument for sharper priorities, not for abandoning them altogether.

Three ways to keep resilience moving without a bigger budget

Fund the things that reduce friction, not just the things that look impressive. Multi-factor authentication, secure collaboration defaults, and tested backups do more for your actual risk exposure than a flashy new platform, and they’re cheap relative to the protection they buy. None of these require a large capital outlay or a lengthy procurement process — most can be switched on with existing tools you already pay for, which makes them the natural first move when budget is tight rather than the thing you get to eventually.

Be selective about the new wave of start-up tools, not dismissive of it. A thriving start-up market means more options at more price points, including tools built specifically for SME budgets rather than retrofitted enterprise products with an SME price tag stapled on. The Wavestone data is a shopping list, not just a headline — but only if you match tools to a proven need rather than buying on hype because a category is getting attention. Ask what specific risk a tool closes before you ask what it costs.

Frame security spending as continuity, not fear. “This protects the business if things go wrong” tends to survive budget conversations better than “this might stop a scary thing from happening,” because it ties the spend to something the whole leadership team already cares about — staying operational — rather than to a hypothetical worst case that’s easy to discount under pressure. If you’re not sure where your actual gaps are, a plain-English risk review from KeepSafe gives you a prioritised list to work from, so spending decisions are based on your real exposure rather than a guess or last year’s headlines.

Why the timing makes this worse, not better

Downturns tend to compress security decisions into two bad patterns: either everything gets frozen indiscriminately, including the low-cost basics that were never really optional, or spending gets reactive — nothing happens until an incident forces the issue, at which point the bill is far higher than the prevention would have been. Both patterns are understandable under pressure, and both leave a business more exposed than a calmer, prioritised approach would. The businesses handling this well right now aren’t the ones with bigger budgets — they’re the ones who separated “nice to have” from “keeps us running” before the pressure hit, so the freeze only touched the former.

The takeaway

A booming cyber start-up sector and a nervous SME market are both real at the same time, and the businesses that come out ahead won’t be the ones spending the most — they’ll be the ones spending on the right things despite the caution. Treat this year’s tighter budget as a reason to prioritise your resilience spending more sharply, not a reason to pause it altogether.