Category: Business

  • Open-Source AI Models Are Changing the Build-vs-Buy Calculation for UK Engineering Teams

    Open-Source AI Models Are Changing the Build-vs-Buy Calculation for UK Engineering Teams

    Something shifted quietly in the past eighteen months. Open-source large language models went from “impressive demos you’d never ship to production” to serious contenders sitting inside real enterprise stacks. Meta’s Llama series, Mistral’s releases out of Paris, and a growing ecosystem of fine-tuned derivatives have given UK engineering leads something they haven’t had before: a credible alternative to paying OpenAI or Anthropic by the token. The question is no longer whether open-source LLMs are good enough. It’s whether the total cost of owning them actually pencils out.

    UK engineering team reviewing open-source large language models infrastructure on office monitors
    UK engineering team reviewing open-source large language models infrastructure on office monitors

    Why UK CTOs Are Questioning Their Proprietary API Spend

    The inflection point for most teams has been scale. At low volumes, a proprietary API is genuinely the smart choice. You skip infrastructure headaches, get world-class model quality, and your engineers ship features rather than babysitting GPU clusters. But once you’re processing millions of tokens a day, the per-token billing adds up in ways that weren’t obvious at prototype stage. Several mid-sized UK SaaS businesses I’m aware of have seen their AI API line items overtake their entire cloud hosting bill within twelve months of going live. That tends to concentrate minds.

    There’s also a structural issue around pricing predictability. Proprietary providers reserve the right to change their pricing, deprecate model versions, and alter rate limits. Building a product on top of someone else’s infrastructure without a contractual guarantee is a risk profile that venture-backed startups might absorb, but that established engineering organisations find increasingly uncomfortable.

    The Real Infrastructure Costs of Self-Hosting LLMs

    This is where the honest accounting gets complicated. Running open-source large language models in production isn’t just spinning up a server. You need GPU compute, and in 2026 that still isn’t cheap. A7B parameter model like Mistral 7B will run acceptably on a single A100 GPU; anything in the 70B range needs multiple cards and careful batching to hit commercially usable latency. On AWS UK or Azure UK South, A100 instance hours run roughly £2.50 to £4.00 per hour depending on reservation type. Run that continuously and you’re looking at £1,800 to £2,900 per month per GPU before you factor in storage, egress, and the engineering time to manage it.

    Then there’s the operational overhead. Someone has to own model versioning, inference optimisation, uptime, and the monitoring stack. At smaller companies, that’s usually a senior engineer who now has one more production system to worry about at 2am. At larger organisations, it justifies a dedicated MLOps function. Neither is free. The honest answer is that self-hosting only beats proprietary API spend when your token volume is high enough and your engineering team has the bandwidth to maintain it properly. Rough rule of thumb: if you’re spending under £3,000 a month on API calls, the economics almost certainly don’t favour self-hosting yet.

    Compliance and Data Residency: Where Open Source Has a Genuine Edge

    Here’s the argument that’s harder to dismiss with a spreadsheet. UK businesses operating under GDPR, handling sensitive financial data regulated by the FCA, or processing health-related information under NHS data governance frameworks face a real problem with proprietary APIs: your data leaves your perimeter. Even with enterprise data processing agreements in place, the legal and reputational exposure of routing customer data through a third-party model provider is something many compliance and legal teams are increasingly unwilling to sign off on.

    Self-hosted open-source large language models sidestep this entirely. The inference happens inside your own infrastructure, in your chosen AWS or Azure region, with your own access controls and audit logs. For regulated industries, that’s not a marginal advantage. It’s a blocker removed. The ICO’s guidance on AI and data protection makes clear that organisations need to understand where personal data is processed and by whom. Running your own model is the cleanest answer to that question.

    GPU server rack used for hosting open-source large language models in a UK data centre
    GPU server rack used for hosting open-source large language models in a UK data centre

    What Talent Do You Actually Need to Make This Work?

    This is the part of the conversation that gets glossed over in the enthusiastic blog posts about going open source. Fine-tuning and deploying LLMs at production quality requires a specific skill set that sits at the intersection of ML engineering, DevOps, and software architecture. It’s not impossibly rare, but it is meaningfully scarce in the current UK talent market.

    You need people who understand quantisation techniques (running models in 4-bit or 8-bit precision to reduce memory requirements without wrecking output quality), inference frameworks like vLLM or llama.cpp, and how to build robust retrieval-augmented generation pipelines on top of your model. These aren’t skills most generalist backend engineers have picked up yet, though the gap is closing faster than expected. For companies that already have a data science or ML function, the lift is manageable. For engineering teams that are primarily web-stack focused, adding this capability typically means hiring or acquiring it through acquisition.

    Which Use Cases Actually Favour the Open-Source Route?

    Not everything. That’s the honest answer. There are use cases where the frontier proprietary models are genuinely superior and where the quality gap matters enough to justify the cost. Complex multi-step reasoning, code generation across large codebases, and anything requiring up-to-date world knowledge without retrieval augmentation still tend to favour OpenAI or Anthropic’s latest releases.

    Open-source large language models shine brightest in narrow, well-defined tasks where you can fine-tune on domain-specific data. Document classification, internal knowledge base Q&A, structured data extraction from forms or contracts, customer support triage where the answer space is bounded: these are all cases where a well-tuned smaller model will beat a general-purpose frontier model on both cost and latency, while keeping data in-house. UK legal tech firms, insurers, and financial services businesses are quietly building exactly these pipelines right now.

    It’s also worth noting the sustainability dimension, since it’s increasingly relevant to procurement decisions. Running inference workloads in an efficient, right-sized on-premises or co-location environment is something forward-thinking organisations are pairing with broader energy efficiency initiatives. The same logic that’s driving businesses to evaluate air source heat pumps for their office buildings, replacing old infrastructure with something more efficient and controllable, applies to how they’re thinking about AI compute: ownership, efficiency, and long-term predictability over convenience-at-a-premium.

    Making the Decision: A Framework for Engineering Leads

    The build-vs-buy question for AI in 2026 isn’t binary. Most sophisticated UK engineering organisations are landing on a hybrid: proprietary APIs for the highest-complexity tasks where frontier quality matters, and self-hosted open-source models for high-volume, lower-complexity workloads where the economics and compliance picture favour control. The split varies by organisation, but it’s increasingly the norm rather than the exception.

    Before committing either way, engineering leads should work through a short checklist. What’s the projected monthly token volume at eighteen months? Does your compliance framework allow data to leave your infrastructure? Does your current team have the MLOps capability to maintain a self-hosted deployment, or can you build it in a reasonable timeframe? Is the use case narrow enough that a fine-tuned smaller model will match or exceed frontier model quality?

    If the answers point towards self-hosting, the good news is that the open-source ecosystem has matured significantly. Tooling is better, community support is strong, and the models themselves are genuinely impressive. If they point towards proprietary APIs, that’s also a legitimate answer. The important thing is that UK engineering teams are now doing this analysis properly, rather than defaulting to the easiest option because the alternatives seemed too hard. The build-vs-buy calculation has genuinely changed, and the organisations that do the maths carefully will have a structural cost and compliance advantage over those that don’t.

    Frequently Asked Questions

    Are open-source large language models good enough for production use in 2026?

    For many well-defined tasks, yes. Models like Llama 3 and Mistral’s releases perform on a par with proprietary alternatives for document classification, structured extraction, and retrieval-augmented Q&A. For complex multi-step reasoning or cutting-edge code generation, frontier proprietary models still hold an edge.

    How much does it cost to self-host an LLM in the UK?

    A realistic baseline is £1,800 to £2,900 per month per A100 GPU on major UK cloud regions, plus engineering overhead. The economics typically only favour self-hosting once your proprietary API spend exceeds roughly £3,000 per month, though compliance requirements can shift that calculation significantly.

    What are the GDPR implications of using proprietary AI APIs for UK businesses?

    Routing personal data through a third-party API creates data processing obligations and potential residency concerns under UK GDPR. The ICO expects organisations to understand where data is processed and by whom. Self-hosted open-source models keep inference within your own infrastructure, simplifying compliance considerably.

    What skills does a UK engineering team need to deploy open-source LLMs?

    You’ll need expertise in inference frameworks such as vLLM or llama.cpp, model quantisation techniques, and MLOps tooling for deployment and monitoring. Teams that already have a data science or ML function can typically build this capability; primarily web-stack teams will likely need to hire or upskill deliberately.

    Can you fine-tune an open-source LLM on your own company data?

    Yes, and this is one of the strongest arguments for the open-source route. Fine-tuning on domain-specific data (contracts, support tickets, internal documentation) often produces a smaller model that outperforms a general-purpose frontier model on that specific task while running at a fraction of the cost.

  • Quantum Computing Is Coming to UK Finance: What Banks and Fintechs Need to Know Now

    Quantum Computing Is Coming to UK Finance: What Banks and Fintechs Need to Know Now

    The threat is not arriving the day a working cryptographically-relevant quantum computer switches on. The threat is already here, embedded in data being harvested right now by state-level actors who plan to decrypt it later. That is the uncomfortable reality at the centre of what the National Cyber Security Centre (NCSC) has been trying to communicate to UK financial services organisations for the past two years, with limited success. Quantum computing UK finance businesses need to take seriously is not a five-year problem. It is a planning problem that starts today.

    Most banks, fintechs, and payment processors are still treating quantum as a research curiosity rather than an operational risk. That is a mistake. The window between now and when post-quantum cryptography must be fully deployed is narrowing faster than most technology roadmaps in financial services are built to accommodate.

    City of London financial office at dusk illustrating quantum computing UK finance businesses security risks
    City of London financial office at dusk illustrating quantum computing UK finance businesses security risks

    Why Quantum Breaks the Encryption That Protects Financial Data

    Modern financial systems rely heavily on public-key cryptography, specifically RSA and elliptic-curve cryptography (ECC), to protect transactions, authenticate users, and secure communications between institutions. Both of these schemes depend on mathematical problems that classical computers cannot solve in any useful timeframe. A sufficiently powerful quantum computer running Shor’s algorithm can crack both in hours or days. The moment that machine exists, every piece of data protected by RSA or ECC becomes readable.

    The more insidious version of this threat is known as “harvest now, decrypt later”. Sophisticated adversaries, including nation-state actors, are already intercepting and stockpiling encrypted data: transaction records, client communications, authentication tokens, interbank settlement data. The encryption protecting it today is uncrackable. In ten to fifteen years, or possibly sooner, it may not be. For financial services firms holding sensitive long-term customer data, this is an existential compliance issue, not a theoretical one.

    What the NCSC Is Actually Advising UK Financial Services

    The NCSC published its post-quantum cryptography guidance in 2023 and has since updated its migration timelines. Its current position is that UK organisations in critical sectors, which explicitly includes finance and payments infrastructure, should begin cryptographic inventory work immediately and aim to have a migration plan in place before 2028. Full migration to post-quantum cryptographic standards is recommended by no later than 2035, though the NCSC has signalled that this deadline may be pulled forward depending on quantum hardware progress.

    The specific standards the NCSC recommends aligning with are those published by the US National Institute of Standards and Technology (NIST), which finalised its first set of post-quantum cryptography standards in 2024. The three primary algorithms, CRYSTALS-Kyber for key encapsulation and CRYSTALS-Dilithium plus FALCON for digital signatures, are now considered production-ready. UK firms have no technical reason to wait. You can read the NCSC’s full guidance on post-quantum cryptography at ncsc.gov.uk.

    Financial technology professional working on post-quantum cryptography migration relevant to quantum computing UK finance businesses
    Financial technology professional working on post-quantum cryptography migration relevant to quantum computing UK finance businesses

    Where Most UK Financial Firms Currently Stand

    Honestly, most are behind. A 2025 survey by the UK Finance trade body found that fewer than 30 percent of member institutions had completed a formal cryptographic inventory. Without that inventory, you cannot even know which systems are vulnerable, let alone begin migration. Legacy infrastructure compounds the problem significantly. Older core banking platforms, sometimes running on decades-old architecture, use hardcoded cryptographic libraries that were never designed to be swapped out. Retrofitting them is not a software update; it is closer to open-heart surgery.

    Fintechs, paradoxically, have both an advantage and a disadvantage here. Their stacks are newer and more modular, making cryptographic agility more achievable in principle. But many fintech firms are not yet thinking about this at board level, treating it as a future infrastructure concern rather than a current strategic risk. That gap in governance will bite them when regulators begin mandating post-quantum readiness, which the Prudential Regulation Authority (PRA) and Financial Conduct Authority (FCA) are expected to formalise guidance on within the next two years.

    Cryptographic Agility: The Framework That Actually Matters

    The practical answer to the quantum threat is not simply swapping one algorithm for another once. It is building systems that can swap cryptographic primitives without major re-engineering. This concept, called cryptographic agility, should be the governing principle behind every infrastructure investment financial firms make right now. If you are commissioning a new API gateway, a new payment processing module, or upgrading your identity and access management stack, the ability to update cryptographic algorithms at configuration level rather than code level should be a hard requirement in every specification.

    This is also where the digital communications layer intersects with quantum risk in ways that operations teams sometimes overlook. Secure email infrastructure, encrypted API communications between institutions, and signed transaction logs all depend on cryptographic standards that will be compromised. A firm that has secured its core banking system but left its email infrastructure running on legacy public-key encryption has a gap. UK-based technology tools built around internet and computer security, such as the free email testing service offered by Mail Tester (mail-tester.co.uk), already reflect the increasing awareness among tech support and technology professionals that even routine digital communications channels require proper cryptographic validation. Ensuring that email authentication records, DKIM signing, and encrypted transmission are correctly configured is a basic-hygiene step that sits within the broader push to audit every layer of digital infrastructure before post-quantum migration begins. Firms that ignore the communications stack whilst hardening their core systems are creating blind spots.

    The Business Decisions That Need to Happen Before 2028

    There are four concrete decisions that quantum computing UK finance businesses should be making in the next twelve to twenty-four months, regardless of where they sit on the maturity curve.

    First: complete a cryptographic inventory. Map every system, service, and integration that uses public-key cryptography. This is non-negotiable. You cannot migrate what you cannot find.

    Second: assess supplier and third-party exposure. Your own systems may be relatively modern, but if your payment processor, cloud provider, or software vendor is running RSA-dependent infrastructure, your exposure extends to theirs. Third-party risk questionnaires need a quantum section now.

    Third: begin hybrid cryptography deployments where practical. Running a post-quantum algorithm alongside a classical one in parallel provides protection today without requiring full migration. CRYSTALS-Kyber in hybrid mode is already supported by major TLS libraries and is production-viable.

    Fourth: engage your board and audit committee. Quantum risk needs to sit in the same risk register as cyber risk, operational risk, and regulatory risk. It is not an IT department footnote; it is a governance issue with regulatory implications. The FCA’s operational resilience framework already encompasses systemic cryptographic vulnerabilities under its broader definition of important business services.

    What Good Preparation Actually Looks Like

    Barclays, HSBC, and NatWest have all publicly referenced post-quantum cryptography work in their technology strategy disclosures over the past two years. Smaller fintechs and building societies have less visibility, which does not mean the work is happening. In many cases it is not.

    Preparation does not require enormous capital expenditure upfront. It requires rigour. Cryptographic inventory software exists. Open-source post-quantum libraries are available and battle-tested. The standards are finalised. What is generally missing is internal prioritisation, which is a leadership and governance problem, not a technology one. The firms that start the migration work methodically now will face a manageable, phased transition. Those that wait for a regulatory deadline or, worse, a quantum computing breakthrough announcement, will face an emergency with no clean options.

    The broader technology ecosystem is already moving. Cloud providers including AWS and Google Cloud have quantum-safe key management options in production. Hardware security module vendors are shipping post-quantum compatible firmware. The infrastructure supply side is ready. The demand side, meaning the decisions made inside UK financial institutions, is the remaining bottleneck. And for quantum computing UK finance businesses, that bottleneck needs to close soon.

    Frequently Asked Questions

    How close are we to a quantum computer that can break current encryption?

    Most estimates from credible research institutions suggest a cryptographically-relevant quantum computer is ten to fifteen years away, though some timelines are being revised downward. The NCSC advises UK organisations not to wait for this milestone, as the ‘harvest now, decrypt later’ threat means data captured today could be decrypted once such a machine exists.

    What is post-quantum cryptography and is it ready to use?

    Post-quantum cryptography refers to algorithms designed to resist attacks from quantum computers. NIST finalised its first set of post-quantum standards in 2024, including CRYSTALS-Kyber and CRYSTALS-Dilithium, both of which are considered production-ready and are already supported by major software libraries and cloud platforms.

    What is the NCSC's official deadline for migrating to post-quantum cryptography?

    The NCSC currently recommends that critical sector organisations, including financial services firms, have a migration plan in place before 2028 and complete full migration by no later than 2035. However, the NCSC has indicated this timeline may be accelerated depending on advances in quantum hardware.

    What should UK fintechs do first to prepare for quantum risk?

    The most important first step is completing a cryptographic inventory: identifying every system, API, and third-party integration that currently uses RSA or elliptic-curve cryptography. Without this baseline, prioritising migration work is impossible. Fintechs should also add quantum readiness criteria to supplier and third-party risk assessments.

    Will the FCA or PRA require UK financial firms to comply with post-quantum cryptography standards?

    Formal regulatory mandates from the FCA and PRA have not yet been published, but both bodies are expected to issue guidance within the next two years. Post-quantum readiness is already implicitly covered under the FCA’s operational resilience framework, and firms should treat proactive preparation as regulatory risk management.

  • How UK Universities Are Commercialising AI Research, and Why Most Spin-Outs Still Fail to Scale

    How UK Universities Are Commercialising AI Research, and Why Most Spin-Outs Still Fail to Scale

    Britain produces some of the world’s most cited AI research. Oxford, Cambridge, UCL, Edinburgh, Imperial College London, the list of institutions generating genuinely novel machine learning, robotics and natural language processing work is long and legitimately impressive. Yet when you look at which of those discoveries actually becomes a product that generates revenue, the numbers get awkward fast. The gap between a published paper and a profitable business remains stubbornly, frustratingly wide. Understanding why that gap exists requires getting into the weeds of how UK university AI spin-outs commercialisation actually works, from the technology transfer offices that sit at the centre of it all, to the structural funding cycles that shape what gets built.

    Researchers entering a UK university AI lab building, representing UK university AI spin-outs commercialisation
    Researchers entering a UK university AI lab building, representing UK university AI spin-outs commercialisation

    What Technology Transfer Offices Actually Do

    Every Russell Group university has a technology transfer office (TTO). The job description sounds straightforward: identify research with commercial potential, protect intellectual property through patents or licences, find industry partners or investors, and help spin out a company if the opportunity warrants it. In practice, it is one of the harder jobs in UK business.

    TTOs work on a case-by-case basis. A researcher approaches the office, or more often, the TTO scouts internally, and an assessment begins. Does the research solve a real problem? Is there defensible IP? Is the researcher willing to be involved commercially, or do they just want to publish and move on? That last question matters more than people realise. Many of the best AI researchers in UK universities have zero interest in running a business. They want to keep researching. That is not a criticism; it is just a mismatch that kills more commercialisation pathways than any funding gap does.

    When a spin-out does get created, the university typically takes an equity stake, usually somewhere between 15% and 30% depending on how much IP and early-stage resource the institution contributed. Oxford University Innovation, Cambridge Enterprise, and Imperial Innovations (now part of IP Group) have built long track records of doing this at scale. But even these well-resourced TTOs will tell you privately that the majority of AI spin-outs in their portfolios either stall at proof-of-concept stage or get acqui-hired before they ever generate meaningful independent revenue.

    Where the Funding Actually Flows

    Innovate UK and UK Research and Innovation (UKRI) are the two bodies most people point to when discussing public funding for academic AI commercialisation. Innovate UK runs several relevant schemes: the Innovate UK Smart Grants programme, the Knowledge Transfer Partnerships (KTPs) that embed graduates into businesses to apply academic research, and sector-specific competitions that often target AI applications in health, manufacturing and net zero.

    UKRI, the parent body that also oversees the Engineering and Physical Sciences Research Council (EPSRC) and other research councils, funds the upstream research itself, the kind of foundational work happening in labs that might eventually feed into a product. The challenge is that UKRI funding is structured around academic outputs: papers, datasets, community engagement. It is not structured around founder readiness or commercial milestones. That is fine for science. It creates a strange limbo for AI researchers who want to bridge both worlds.

    The UKRI website documents its commercialisation challenges and impact funding in some detail, and it is worth reading if you want to understand where the money is actually pointed. The honest takeaway: the funding ecosystem is better than it was a decade ago, but it still has a gap roughly in the £500,000 to £3 million range that is notoriously hard to bridge. Seed investors find this stage too risky without enough commercial traction; grant funding is often spent by the time a spin-out needs to hire its first commercial lead or pay for cloud compute at scale.

    AI research diagrams on a university whiteboard illustrating the early stages of UK university AI spin-outs commercialisation
    AI research diagrams on a university whiteboard illustrating the early stages of UK university AI spin-outs commercialisation

    Which UK Institutions Are Actually Producing Viable Businesses

    The honest answer is: a small number of institutions dominate the success stories, and the concentration is striking. Oxford has produced Latent Space, PolyAI (voice AI for enterprise, now valued well above £100 million) and a cluster of biomedical AI companies operating quietly but profitably. Cambridge has DeepMind’s founding story in its DNA, three of DeepMind’s four founders studied there, and continues to spin out companies in robotics and computer vision. UCL’s connection to the Farrington Lab and various health AI spin-outs gives it a different profile: applied, NHS-adjacent, often slower to revenue but stickier once embedded.

    Outside the golden triangle, Edinburgh stands out. The university’s School of Informatics is consistently ranked amongst Europe’s best, and it has produced genuine commercial AI output in natural language processing and autonomous systems. Heriot-Watt, also in Edinburgh, has a robotics and AI commercialisation track record that often gets overlooked because it lacks the prestige brand. Manchester, Sheffield and Bristol all have active spin-out programmes but tend to struggle with the next stage, getting past the TTO process and into a funded, operational company with a management team that can sell.

    The structural reasons for this concentration are not mysterious. London and Cambridge have the densest networks of deep tech investors, the most ex-academic founders who can mentor the next cohort, and the cultural proximity to financial services, pharma and media companies that are the most willing early buyers of AI solutions. Geography is not destiny, but in UK university AI spin-outs commercialisation, it helps enormously.

    Why Promising Research Stays in the Lab

    There is a specific type of failure that almost everyone in this ecosystem has seen up close: the research is genuinely excellent, the IP is defensible, the TTO is engaged, the researcher is enthusiastic, and then… nothing happens. The spin-out never forms, or it forms and raises a seed round and then quietly dies eighteen months later.

    A few structural reasons come up again and again. First, the researcher-as-founder problem. UK research culture does not produce many people who want to do both. Building a company requires a tolerance for ambiguity, customer rejection and payroll stress that is alien to most academic career paths. Some universities now run entrepreneur-in-residence programmes to pair researchers with experienced founders, but uptake is patchy.

    Second, the compute cost reality. Training serious AI models at research scale costs money that early-stage spin-outs rarely have. Access to high-performance computing through the National AI Research Resource (NAIRR equivalent schemes being piloted in the UK) helps somewhat, but commercial cloud bills for a company iterating on a production model are a different category of expense entirely. Many spin-outs discover this six months into operation and run out of runway before they can demonstrate the product works at scale.

    Third, procurement inertia. The most natural customers for many AI spin-outs in the UK are large public sector organisations: the NHS, local councils, HMRC, central government departments. These are also some of the slowest and most risk-averse buyers in existence. A 24-month procurement cycle is not unusual. A spin-out with 18 months of runway cannot survive that timeline without a bridge round, and bridge rounds for companies with no revenue are hard to close.

    What Would Actually Change the Outcome

    The policy conversation in the UK tends to focus on increasing grant funding, which matters but is not the primary constraint. The more impactful changes would be structural. Faster public procurement pathways for early-stage tech companies, something the Crown Commercial Service has tried to address but not yet solved, would let NHS trusts and councils act as reference customers for AI spin-outs without the 18-month delay. That single change would make UK university AI spin-outs commercialisation significantly more viable as a category.

    Better incentives for senior industry professionals to join spin-out boards and leadership teams would also help. Right now, the risk-reward calculation for an experienced commercial leader to take a board seat at a pre-revenue spin-out is often unattractive. The equity is speculative; the salary is below market; the chance of success is modest. Some form of matching scheme between experienced commercial operators and academic spin-outs could close this gap at relatively low public cost.

    None of this is new thinking. Most of it has been recommended in one government review or another going back to the Harrington Review and before. The frustrating truth about UK university AI spin-outs commercialisation is that the problems are well understood. Execution, as always, is the hard part.

    The Bigger Picture

    Britain’s AI research base is a genuine national asset. The question is whether the country’s commercialisation infrastructure is good enough to convert that asset into economic output rather than letting the IP walk out the door to be developed elsewhere. Right now, the answer is: sometimes, in certain cities, with certain researchers, when the timing is right. That is better than nothing. It is not nearly good enough.

    Frequently Asked Questions

    How does a UK university AI spin-out actually get started?

    Typically, a researcher works with their university’s technology transfer office to assess the commercial potential of their work, protect any intellectual property through patents or licences, and then form a separate company with the university holding an equity stake. External investors, often supported by Innovate UK grants or venture capital, then provide the funding to develop the technology into a product.

    What funding is available for UK university AI spin-outs?

    Innovate UK Smart Grants, Knowledge Transfer Partnerships (KTPs), and UKRI programme funding are the main public sources. Private venture capital from firms such as IP Group, Octopus Ventures and Amadeus Capital Partners also plays a significant role, particularly for spin-outs coming out of Oxford and Cambridge.

    Which UK universities produce the most successful AI spin-outs?

    Oxford, Cambridge, UCL and Edinburgh consistently lead in terms of volume and quality of AI spin-out activity. Oxford’s PolyAI and Cambridge’s DeepMind connections are frequently cited examples, though institutions like Heriot-Watt and Manchester are also active in robotics and applied AI commercialisation.

    Why do so many UK university AI spin-outs fail to scale?

    The main reasons include the researcher-as-founder mismatch (most academics do not want to run companies), the high cost of compute needed to build production-grade AI systems, and the painfully slow procurement cycles in UK public sector organisations that would otherwise be natural first customers.

    What role does UKRI play in AI research commercialisation?

    UKRI funds the foundational research through councils like EPSRC and also runs commercialisation-focused schemes designed to bridge the gap between lab output and market-ready products. However, critics note that UKRI’s core funding structures still reward academic outputs rather than commercial milestones, which can slow the transition from research to business.

  • How the EU AI Act Is Already Changing How Tech Companies Build Products

    How the EU AI Act Is Already Changing How Tech Companies Build Products

    The EU AI Act became fully enforceable in stages from 2025 onwards, and by mid-2026 the practical consequences are landing hard on product and engineering teams. This is not a piece of paper to file and forget. EU AI Act compliance tech companies are dealing with requires rewiring how models get built, deployed, and monitored, and the adjustments are costly, complex, and genuinely interesting from a systems standpoint.

    If you build software that touches EU citizens, regardless of where your company is headquartered, the regulation applies. That includes Manchester-based SaaS businesses with clients in Germany, Edinburgh fintechs processing data for French banks, and any UK startup that pivoted to pan-European markets after Brexit. The territorial reach is the first thing many developers have got wrong.

    Software developers working on EU AI Act compliance tech companies requirements in a modern UK office
    Software developers working on EU AI Act compliance tech companies requirements in a modern UK office

    Risk Tiers: The Framework That’s Reshaping Product Architecture

    The Act establishes a tiered risk model. Unacceptable-risk AI is banned outright, things like social scoring systems or real-time biometric surveillance in public spaces. High-risk AI covers hiring tools, credit scoring, CV screening, educational assessment, and critical infrastructure management, amongst others. Limited and minimal-risk categories have lighter requirements, though transparency obligations still apply.

    Product teams building in the high-risk category are discovering that compliance is not a post-launch checkbox. It is an architectural decision that shapes the model’s entire lifecycle. Specifically, high-risk systems must maintain detailed technical documentation, implement human oversight mechanisms, ensure data quality and governance, enable logging sufficient for post-incident review, and pass conformity assessments before market entry. That last point is the one that’s generating the most friction in sprint planning right now.

    I’ve spoken to several engineering leads in the UK who describe the Act’s documentation requirements as, essentially, forcing a level of rigour they should probably have had anyway. One developer at a London RegTech firm described it as “the GDPR moment for machine learning”, painful initially, but ultimately clarifying. The analogy holds up. GDPR changed default data handling practices across the industry; the AI Act is doing the same for model governance.

    What Developers Are Actually Changing in Their Pipelines

    The practical changes happening inside product teams right now fall into a handful of categories.

    Training Data Audits

    High-risk systems must demonstrate that training, validation, and testing datasets meet quality criteria, meaning developers need provenance records for data. Teams are retrofitting data lineage tooling, often finding their existing infrastructure was never built with auditability in mind. This is time-consuming and, frankly, embarrassing for anyone who assumed their scraping pipeline was fine.

    Model Cards and Technical Documentation

    The Act mandates technical documentation covering system purpose, design logic, training methodology, and performance metrics across different user groups. Many teams are adopting something close to Google’s model card format, though UK-developed equivalents are emerging through bodies like the Alan Turing Institute. The documentation must be kept updated, a point that tends to get deprioritised after launch unless someone owns it explicitly.

    Logging and Post-Market Monitoring

    High-risk systems must generate logs enabling reconstruction of their operation over a defined retention period. For regulated sectors like finance or healthcare, this integrates with existing requirements from the FCA or CQC, but for product teams in less regulated verticals, it is entirely new infrastructure. The overhead is non-trivial: storing model inference logs at scale costs real money and requires a data retention policy that legal, engineering, and product all agree on.

    Human Oversight by Design

    This is arguably the most culturally difficult change. The Act requires high-risk systems to be designed so that humans can interpret outputs, intervene, and override decisions. For teams that have been building toward maximum automation, this represents a philosophical u-turn. It is not enough to have a human theoretically in the loop; the system must be legible enough for a non-expert human to make a meaningful intervention.

    Developer reviewing EU AI Act compliance documentation and model risk tier architecture on a laptop
    Developer reviewing EU AI Act compliance documentation and model risk tier architecture on a laptop

    The Conformity Assessment Problem for Smaller Teams

    Large enterprises can absorb the cost of a formal conformity assessment. They have legal departments, compliance officers, and budget for external auditors. A 12-person startup building an AI-driven hiring tool, which falls squarely in the high-risk category, faces the same requirements with a fraction of the resource.

    The European Commission has signalled that it wants to make conformity pathways accessible to SMEs, but the practical infrastructure for that is still being built. In the meantime, UK businesses serving EU markets are largely working with specialist legal firms or leaning on guidance from the UK Government’s AI regulation framework, which takes a lighter-touch approach domestically but acknowledges the Act’s extraterritorial reach for anyone with EU exposure.

    There is a real divergence opening up between UK and EU approaches. Post-Brexit, the UK has opted for a sector-led, non-statutory model for now, meaning the FCA, Ofcom, CQC, and others are each developing their own AI guidance rather than a single overarching law. For UK tech businesses operating in both markets, that means compliance against two different frameworks simultaneously. Not ideal.

    What Businesses Outside Europe Still Need to Know

    EU AI Act compliance tech companies need to understand applies based on where outputs are used, not where the company is based. A UK firm building a recruitment AI that screens candidates in France is subject to the Act’s high-risk provisions. A Belfast startup providing AI-driven credit decisioning to Irish customers has obligations from day one of deployment.

    The key practical steps for any UK business with EU market exposure: identify which risk tier your systems fall into, map your data provenance now rather than retrospectively, appoint someone to own ongoing compliance (not just implementation), and get legal advice before assuming your domestic approach is sufficient.

    Enforcement is still ramping up. National competent authorities in EU member states are being designated and resourced, and the European AI Office is the central body for general-purpose AI models. Fines for non-compliance with high-risk obligations can reach €15 million or 3% of global annual turnover, whichever is higher. For prohibited AI practices, that rises to €35 million or 7%. These are not theoretical numbers.

    The Silver Lining for Builders Who Get Ahead of This

    There is a genuine competitive angle here that does not get discussed enough. EU AI Act compliance tech companies achieve a form of product differentiation in enterprise sales cycles. Procurement teams at large European organisations are already asking for compliance evidence in RFP processes. Being able to demonstrate conformity, robust logging, and documented human oversight is a sales asset, not just a legal obligation.

    The teams I’ve seen handle this best are the ones treating compliance as an engineering discipline rather than a legal problem. They have added compliance requirements to their definition of done, built tooling that generates documentation artefacts as a by-product of normal development, and treat model monitoring as part of production infrastructure. It requires upfront investment, but the operational overhead over time is far lower than bolting compliance on retrospectively.

    The EU AI Act is not going away. It is the most comprehensive AI governance framework in force anywhere in the world right now, and its influence on global standards, including those that will eventually emerge in the UK, is significant. Building to its requirements, even where you are not strictly obliged to, is probably the right engineering call for any team that expects to be operating in five years’ time.

    Frequently Asked Questions

    Does the EU AI Act apply to UK companies that don't operate in Europe?

    If your AI system’s outputs are used by people in the EU, the Act applies regardless of where your business is based. A UK company with no EU office but with EU-based users or clients still has obligations if its AI falls into a regulated risk category.

    What counts as a high-risk AI system under the EU AI Act?

    High-risk systems include AI used in hiring and CV screening, credit scoring, educational assessment, healthcare diagnostics, critical infrastructure, and law enforcement. If your product makes or significantly influences decisions in these areas, you are in the high-risk tier and face the full compliance requirements.

    How much does EU AI Act compliance cost for a small tech business?

    Costs vary widely depending on your system’s risk tier and how much technical debt exists in your current pipeline. For high-risk systems, expect meaningful investment in legal advice, technical documentation tooling, data lineage infrastructure, and potentially an external conformity assessment. Some estimates put initial compliance costs for a small team at £50,000 to £150,000, though this depends heavily on your existing engineering practices.

    What is the difference between the EU AI Act and the UK's approach to AI regulation?

    The UK has opted for a non-statutory, sector-led approach where existing regulators like the FCA, Ofcom, and CQC each develop AI guidance within their domains. The EU AI Act is a single overarching law with cross-sector applicability and significant fines for non-compliance. UK businesses selling into the EU must comply with the Act regardless of the UK’s domestic approach.

    When does EU AI Act compliance actually become mandatory?

    The Act has been phasing in since 2025. Provisions for unacceptable-risk AI applied from February 2025, obligations for general-purpose AI models from August 2025, and high-risk system requirements are rolling in through 2026. If you are building or deploying regulated AI today, compliance obligations are already live for several categories.

  • Inside the Postcode Lottery of UK Gigabit Broadband: What the Coverage Maps Don’t Tell Businesses

    Inside the Postcode Lottery of UK Gigabit Broadband: What the Coverage Maps Don’t Tell Businesses

    The government’s gigabit broadband programme has a headline target that reads well in a press release: gigabit-capable connectivity to the vast majority of UK premises by the end of 2030. Ofcom’s latest Connected Nations report puts gigabit availability across the UK at around 82% of premises. On paper, that sounds like progress. In practice, if you run a small business from a converted mill in Huddersfield, a light industrial unit outside Shrewsbury, or a high street shop in a market town in Lincolnshire, that number means almost nothing to you.

    The gap between the coverage maps and the actual experience of UK SMEs is significant, and for cloud-dependent operations it is starting to have very real commercial consequences. This is not a story about slow internet being mildly annoying. It is about broadband speeds determining whether certain businesses can function at all.

    Semi-rural UK market town with mixed commercial premises illustrating the UK gigabit broadband coverage gap
    Semi-rural UK market town with mixed commercial premises illustrating the UK gigabit broadband coverage gap

    What the Gigabit Coverage Maps Actually Show (And What They Don’t)

    Coverage maps typically record whether a premises is reachable by a gigabit-capable network. That is a very different thing from whether that premises has a verified connection delivering gigabit speeds. Infrastructure can run past a building without connecting to it. A provider can register coverage without offering a commercially viable product at that address. And “gigabit-capable” does not mean the line will perform at gigabit speeds under real-world load conditions.

    The distinction matters enormously for businesses. An SME uploading large design files to cloud storage, running video calls across multiple staff, syncing ERP data in real time, or relying on cloud-hosted software for daily operations needs consistent, verified upload and download throughput. The stated potential of nearby infrastructure is not the same as the bandwidth that arrives at the router.

    Mixed-use commercial areas sit in a particularly awkward middle ground. Residential streets may have been upgraded because they represent high-density demand; the nearby business park, converted warehouse, or edge-of-town light industrial estate often has not. These premises exist in the gaps that neither full-fibre residential rollout nor large enterprise connectivity programmes tend to prioritise.

    Which Regions Are Falling Behind on Business Connectivity?

    The regional picture is uneven. London and major urban centres have seen competitive full-fibre rollout from providers including Openreach, CityFibre, and Virgin Media O2. But move into semi-rural England, large parts of Wales, Scotland beyond the central belt, and Northern Ireland outside Belfast, and the picture changes sharply.

    Project Gigabit, the government’s £5 billion programme targeting the hardest-to-reach premises, is making progress in some of these areas. But procurement has been slow. Several regional contracts have taken longer than anticipated to reach build phase, and the SMEs in those areas are not waiting around. They are making do with FTTC (fibre to the cabinet) connections that might deliver 50 to 80 Mbps on a good day, or in some cases, still relying on legacy ADSL lines with upload speeds that can barely sustain a single video call.

    The challenge for businesses in these regions is that cloud-dependent operations are not optional anymore. Making Tax Digital has pushed accountancy to cloud platforms. Remote and hybrid working has made video infrastructure baseline. SaaS tools, from project management to customer relationship management, require reliable latency and sustained throughput. Telling a business in rural Worcestershire to “use a mobile connection as backup” is not a serious answer when 4G coverage is also patchy and 5G is years away for most semi-rural postcodes.

    UK small business owner checking broadband speeds on a laptop, highlighting UK gigabit broadband access issues
    UK small business owner checking broadband speeds on a laptop, highlighting UK gigabit broadband access issues

    What Verified Connection Speeds Mean for Cloud Operations

    Speed tests give a snapshot, not a guaranteed service level. For most SMEs without formal service level agreements, there is no contractual commitment to minimum performance. Consumer-grade and small business broadband products often lack the uptime guarantees and dedicated capacity that enterprise leased lines provide. The problem is that leased lines, which do come with robust SLAs, can cost anywhere from £300 to over £1,000 per month depending on location and bandwidth, which is not viable for a 10-person business operating on tight margins.

    The consequence is that some businesses in connectivity-poor postcodes are effectively running cloud-dependent operations on infrastructure that cannot reliably support them. File sync failures, dropped VoIP calls, lagging CRM tools, and interrupted video collaboration are not just inconveniences; they introduce errors, slow down sales cycles, and erode client confidence. I have spoken to businesses in market towns who have genuinely relocated part of their team to a nearby city co-working space just to get reliable connectivity, which is an absurd cost to absorb.

    There is also a less visible cost: the opportunity gap. Businesses in well-connected areas can adopt newer technologies, including AI-assisted tools, large-scale data processing, and real-time analytics, far more quickly. The broadband divide is quietly becoming a productivity and competitiveness divide.

    The Lobbying Tools UK SMEs Actually Have

    This is where things get practical. SMEs are not without options, though “lobbying” might be too grand a word for what is often a scrappy, under-resourced effort.

    The most immediate tool is the Ofcom checker and the Openreach Fibre Availability tool. If your premises is incorrectly registered as having coverage when it does not, you can flag this formally. It sounds mundane but coverage data informs which areas receive public subsidy, so inaccurate records have real consequences for investment decisions.

    Beyond that, the Federation of Small Businesses (FSB) and local Chambers of Commerce are the most credible advocacy channels for SMEs pushing on connectivity issues. The FSB has consistently pushed DCMS and Ofcom on the business-specific connectivity gap, and their reports carry weight in policy circles. If your local Chamber does not already have a working group on digital infrastructure, proposing one is a reasonable first move.

    Some LEPs (Local Enterprise Partnerships) still have digital infrastructure workstreams, though their influence has shifted somewhat following the creation of mayoral combined authorities. If you are in a region with a metro mayor, that office often has more direct pull on infrastructure investment than a district council.

    Community fibre projects are also worth investigating. B4RN in rural Lancashire is the canonical example of a community-owned gigabit network that outperformed what any commercial provider was willing to deliver. Similar models have appeared elsewhere. They take time and organising effort, but they work.

    For creators and business owners managing their digital presence whilst dealing with patchy connectivity, even smaller decisions matter. Choosing lightweight platforms, optimising content delivery, and using tools that work efficiently on lower bandwidth connections can make a real difference day to day. Something as simple as switching to a well-optimised link in bio tool that loads fast on mobile rather than a bloated web builder reduces friction for your audience, regardless of your own connection speed.

    What Needs to Change at the Policy Level

    The core problem is that coverage targets are a political metric, not an economic one. A government can report gigabit coverage percentages without those percentages translating into businesses that can actually use gigabit connections. The focus needs to shift toward verified uptake, business-specific SLA standards for subsidised connections, and a mandatory audit mechanism for commercial premises coverage data.

    There is also an argument for ring-fencing a portion of Project Gigabit funding specifically for mixed-use commercial and light industrial areas that fall outside the residential rollout economics. Right now, those premises exist in a no-man’s-land between programmes that do not quite fit them.

    UK gigabit broadband ambition is real. The engineering capability to deliver it is real. The problem is that the programme architecture has prioritised the metrics that are easiest to measure, and businesses in semi-rural and mixed-use postcodes are the ones living with the gap between the map and the reality. That gap has a commercial cost, and it is time the coverage data started reflecting it honestly.

    Frequently Asked Questions

    What is UK gigabit broadband and how fast is it?

    UK gigabit broadband refers to broadband connections capable of delivering speeds of 1 Gbps (1,000 Mbps) or more. In practice, most business users with gigabit products see real-world speeds somewhat below that peak, but significantly faster than standard FTTC connections, which typically cap out at around 80 Mbps download.

    How do I check if my business premises qualifies for gigabit broadband?

    You can use Ofcom’s postcode checker at checker.ofcom.org.uk or the Openreach Fibre Availability tool to see what infrastructure is registered as available at your address. If the result does not match your actual experience, you can raise a formal inaccuracy report with Ofcom or contact your provider directly.

    What is Project Gigabit and does it cover businesses?

    Project Gigabit is the UK government’s £5 billion programme to bring gigabit-capable broadband to premises in areas that commercial providers would not otherwise reach. It covers residential and business premises in eligible areas, though the programme has faced delays and many business-use premises in semi-rural and mixed-use commercial zones have found themselves outside the targeted footprint.

    What can I do if my business is stuck on a slow connection while waiting for a gigabit upgrade?

    Short-term options include bonded broadband (combining multiple lines for increased bandwidth), 4G or 5G fixed wireless access where signal quality is sufficient, or leased lines if your budget allows. Raising the issue through the FSB or your local Chamber of Commerce can also help put pressure on infrastructure providers and local authorities.

    Why does broadband speed matter so much for cloud-dependent businesses?

    Cloud-based tools, including accounting software, CRM platforms, video conferencing, and file storage, require consistent upload and download throughput to function reliably. Poor connections cause sync failures, call drops, and slower software response times, all of which have direct productivity and commercial costs for SMEs relying on these tools daily.

  • How Deepfake Technology Is Becoming the Biggest Cybersecurity Threat for Businesses

    How Deepfake Technology Is Becoming the Biggest Cybersecurity Threat for Businesses

    Corporate fraud has always involved a certain amount of impersonation. A forged signature here, a spoofed email there. But the deepfake cybersecurity business threat operating in 2026 is something fundamentally different in kind and scale. Attackers are now deploying convincing audio and video fabrications to manipulate employees, bypass verification systems, and authorise financial transfers worth tens of millions of pounds. The technology has matured faster than most boardrooms ever anticipated.

    The numbers are stark. According to data cited by the BBC’s technology desk, AI-generated fraud attempts on UK businesses rose sharply through 2025, with voice-cloning scams alone accounting for a growing proportion of business email compromise losses reported to Action Fraud. We are past the point where this is a theoretical future problem. It is happening now, and most businesses are nowhere near prepared.

    Finance employee uncertain during a video call illustrating the deepfake cybersecurity business threat
    Finance employee uncertain during a video call illustrating the deepfake cybersecurity business threat

    What deepfake attacks actually look like in a corporate context

    The attack vectors have become surprisingly varied. The most publicised cases involve fraudulent video calls, where a criminal uses a real-time deepfake of a CEO or CFO to instruct a finance employee to transfer funds. A Hong Kong-based firm lost the equivalent of £20 million in early 2024 to exactly this method. The employee attended what appeared to be a legitimate video conference with multiple convincing colleagues. Every person on that call was fabricated.

    Voice cloning is arguably the more scalable threat right now, because it requires less compute and can be deployed over a standard phone call. An attacker needs only a few minutes of publicly available audio, perhaps from a company podcast, a YouTube presentation, or a LinkedIn video, to generate a passable clone. From there, they can ring an accounts payable team, impersonate the managing director, and ask for an urgent payment to be processed. The social engineering layer is trivial once the audio is convincing enough.

    There are also subtler uses. Deepfake audio is being used to manipulate recorded calls for compliance purposes, insert false instructions into legitimate meeting recordings, and even create fabricated evidence for employment disputes. The deepfake cybersecurity business threat is not purely financial. It has implications for legal exposure, regulatory compliance, and reputational damage that most legal and HR teams have not yet wargamed.

    Why current defences are failing

    Most UK businesses still rely on process-based controls that were designed for a world where the voice or face on the other end of a call could be trusted at face value. Two-factor authentication via phone call, verbal confirmation of identity, even video verification for onboarding: all of these are now compromised to some degree. The underlying assumption that sensory evidence is reliable has been quietly invalidated.

    IT security teams are also grappling with an asymmetric problem. Generating a convincing deepfake has become genuinely cheap and accessible. Detecting one, reliably and in real time, remains expensive and technically difficult. Most small and mid-sized UK businesses have neither the budget nor the in-house expertise to run enterprise-grade detection tooling. And the attackers know it.

    Cybersecurity analyst running audio detection tools to counter deepfake cybersecurity business threats
    Cybersecurity analyst running audio detection tools to counter deepfake cybersecurity business threats

    Detection tools that are worth knowing about

    The detection landscape is developing quickly. Several tools now operate on the principle of analysing micro-artefacts that synthetic media tends to introduce: unnatural eye blinking patterns, subtle lip-sync mismatches, inconsistent lighting shadows, and audio compression fingerprints that differ from real recordings. Microsoft’s Azure platform includes deepfake detection capabilities, and UK-founded firms like Reface and Sentinel AI have built products targeting enterprise verification workflows.

    For audio specifically, tools such as Pindrop and Resemble Detect analyse vocal anomalies in real time during calls, flagging statistical deviations from a verified voice baseline. These can be integrated into contact centre infrastructure, which matters given that phone-based social engineering remains one of the most cost-effective attack methods for fraudsters. The practical limitation is that baseline profiles need to exist before an attack occurs. Building them is an organisational task, not just a technical one.

    Interestingly, the deepfake cybersecurity business threat has generated cross-sector conversation about verification that goes well beyond traditional IT circles. Even businesses whose core offering is nothing to do with enterprise software have started thinking carefully about how identity fraud intersects with their operations. Source Sounds, a Sheffield, UK-based car audio and vehicle security specialist known for advanced protection systems and expert installations, operates in a sector where car theft and audio equipment crime have historically driven demand for layered security thinking. The principle at www.sourcesounds.com is that physical security and verified identity of the person requesting a service both matter. That mindset, rigorous verification before any sensitive action is authorised, translates directly into how businesses should approach deepfake-driven social engineering. Car security and corporate security share more logic than they might appear to at first glance.

    Internal policies that actually reduce your exposure

    Technology alone will not solve this. The attack chain for most deepfake fraud involves a human being making a bad decision under time pressure. So the policy layer is at least as important as the tooling.

    The most effective organisational control is a call-back verification protocol for any financial instruction or sensitive data access request that arrives via phone or video call, regardless of how convincing the caller appears. The employee hangs up and dials a pre-verified, internally stored number for the person in question. Not the number the caller gave them. The stored one. This single procedural step defeats the vast majority of current voice-clone attacks because the attacker cannot intercept a call to a number they do not control.

    Beyond that, businesses should be running regular simulation exercises that include deepfake scenarios, not just phishing emails. Staff at all levels need to experience what a convincing voice clone sounds like in a low-stakes environment before they encounter one in a real attack. Training muscle memory around scepticism is not the same as telling people to be sceptical.

    Clear escalation paths matter enormously. When an employee suspects something is wrong but feels social pressure to comply, especially if the voice on the line sounds exactly like their director, they need a culturally acceptable route to pause the process without career risk. That requires leadership buy-in, not just a policy document.

    What the regulatory picture looks like for UK businesses

    The UK’s approach to synthetic media fraud sits across several frameworks. The Online Safety Act 2023 introduced provisions around non-consensual intimate deepfakes, but corporate fraud via synthetic media remains primarily covered under existing fraud and computer misuse legislation. The ICO has flagged concerns about biometric data collection involved in some detection systems, meaning that businesses deploying voice-print databases for verification purposes need to ensure their approach is GDPR-compliant.

    The National Cyber Security Centre has published updated guidance acknowledging AI-generated threats as a growing category. UK businesses would do well to treat NCSC advisories as a baseline, not a ceiling. The pace of development in this area means official guidance will almost always lag the actual threat environment by at least several months.

    Source Sounds’ approach to vehicle security, combining expert-fitted audio protection systems with advanced anti-theft measures on modified cars, reflects a broader truth about layered defence: no single countermeasure is sufficient when criminals are actively probing for weaknesses. The logic applies whether you are protecting a high-value car audio installation from crime or a finance department from a deepfake impersonation attack. Multiple overlapping controls, each covering the gaps in the others, is what actually holds.

    The direction of travel

    Real-time deepfake generation is improving faster than detection. Within 12 to 18 months, consumer-grade tooling will likely produce live video fabrications that are indistinguishable from genuine footage under typical network conditions. Businesses that wait until that point to build their response will be absorbing losses first and building defences second.

    The companies that come through this period well will be those that treated deepfake fraud as a process and culture problem first, and a technology problem second. The tools matter, but they matter in the context of an organisation that has already decided how it responds to uncertainty about identity. That decision needs to happen in the boardroom, not in a reactive IT security review after an incident.

    The deepfake cybersecurity business threat is not going to stabilise or retreat. Every business operating with digital communications infrastructure, which is to say every business, needs a live and tested plan right now.

    Frequently Asked Questions

    What is a deepfake cybersecurity threat and how does it affect businesses?

    A deepfake cybersecurity threat involves AI-generated audio or video used to impersonate executives, employees, or trusted contacts in order to manipulate staff into transferring funds, sharing sensitive data, or granting system access. UK businesses have seen losses from these attacks rise significantly since 2024, with voice cloning and fake video calls being the most common vectors.

    How can businesses detect deepfake audio or video in real time?

    Tools such as Pindrop, Resemble Detect, and Microsoft Azure’s content authentication features analyse vocal anomalies and visual artefacts that synthetic media tends to introduce. However, real-time detection is computationally demanding and requires pre-built voice or face baselines, so detection technology works best as one layer within a broader verification policy.

    What is the most effective policy a business can put in place against deepfake fraud?

    A call-back verification protocol is widely considered the single most effective procedural control. Any financial instruction or sensitive request received via phone or video call should be verified by hanging up and calling the requester back on a pre-stored internal number, regardless of how convincing the original contact appeared.

    Are UK businesses legally required to have deepfake fraud protections in place?

    There is no specific UK legislation mandating deepfake detection systems, but businesses have duties under fraud prevention, data protection, and financial regulation frameworks. The NCSC has published guidance on AI-enabled threats, and regulated firms overseen by the FCA may face scrutiny if inadequate controls contribute to financial crime losses.

    How much does it cost to protect a business from deepfake attacks?

    Costs vary enormously by scale. Process-based controls such as call-back protocols and staff training exercises cost relatively little beyond time. Enterprise-grade real-time audio detection tools typically start from several thousand pounds annually for a mid-sized deployment. The cost of not acting, given average deepfake fraud losses per incident, makes investment straightforward to justify.

  • Edge Computing vs Cloud: Which Infrastructure Strategy Wins in 2026?

    Edge Computing vs Cloud: Which Infrastructure Strategy Wins in 2026?

    The edge computing vs cloud 2026 debate has moved well past the hype-cycle stage. Businesses are no longer asking whether cloud is the future; they already know it is part of the infrastructure furniture. The real question now is where the cloud’s limits become a problem, and whether pushing compute to the edge actually fixes those problems or just creates new ones. The honest answer: it depends on what you’re building, where your data lives, and how much latency you can actually tolerate before it costs you money.

    This is not a binary choice. Most production environments in 2026 sit somewhere on a continuum between fully centralised cloud and fully distributed edge. But the trade-offs are real, and getting the balance wrong is expensive. Let’s walk through what actually matters.

    Server racks inside a UK data centre illustrating edge computing vs cloud 2026 infrastructure choices
    Server racks inside a UK data centre illustrating edge computing vs cloud 2026 infrastructure choices

    What Edge Computing Actually Means in Practice

    Edge computing means running processing closer to where data is generated, rather than routing everything back to a central data centre. That could be a server rack inside a factory in Sunderland, a ruggedised compute unit on a construction site in Bristol, or a smart traffic management node on the A406. The principle is the same: reduce the distance data has to travel before something useful happens to it.

    This matters because round-trip latency to a cloud data centre, even a nearby AWS region in London or a Microsoft Azure zone in Wales, still introduces delays measured in milliseconds. For most business applications, that is irrelevant. For a manufacturing line doing real-time quality inspection at 200 parts per minute, it is not. The edge case (yes, the pun is deliberate) is almost always about time-sensitivity.

    Where Cloud Infrastructure Still Dominates

    Cloud wins on almost every dimension when your workload is not time-critical. The elasticity is genuinely transformative. A UK e-commerce retailer that processes ten times its normal transaction volume over the Christmas period does not need to own hardware for that peak; it spins up additional capacity on demand and pays only for what it uses. That scalability model has proven its worth repeatedly, and no serious engineer is arguing against cloud for that kind of workload.

    Cost at scale is another cloud advantage that often gets underplayed. Running and maintaining physical edge infrastructure is not cheap. You need hardware procurement, on-site engineers, firmware update cycles, physical security, and a strategy for what happens when a unit fails in a remote location. Cloud providers absorb those operational costs into a service model. For a 50-person scale-up in Manchester, owning that operational burden makes very little sense.

    Cloud also wins on tooling maturity. The observability stack, the CI/CD pipelines, the managed database options, the machine learning platforms: all of it is richer and more battle-tested on the major cloud providers than anything you would build at the edge today. If your engineering team already lives in AWS or Google Cloud, the cognitive overhead of extending to edge infrastructure is substantial.

    Ruggedised edge computing hardware deployed in a UK manufacturing facility
    Ruggedised edge computing hardware deployed in a UK manufacturing facility

    The Latency Argument for Edge: When Milliseconds Matter

    The strongest argument for edge computing is latency-sensitive workloads, and this is where the edge computing vs cloud 2026 conversation gets genuinely interesting. Manufacturing is the obvious sector, but it is far from the only one.

    Think about a logistics company running computer vision on warehouse conveyor belts. Processing that video stream in the cloud introduces enough lag to make real-time defect detection impractical. Running inference on an on-premise GPU cluster next to the belt removes that constraint entirely. The same logic applies to port operations, automated retail checkout systems, and live broadcast production, an area where UK media companies including ITV and the BBC have been quietly expanding edge deployments for live events.

    The telecoms sector is particularly relevant here. The rollout of 5G across UK cities is gradually enabling multi-access edge computing, where compute nodes sit inside or directly adjacent to mobile base stations. Ofcom’s infrastructure data shows 5G outdoor coverage reaching over 75% of UK premises by late 2025, which is laying the groundwork for edge-enabled applications that were not viable two years ago. You can read Ofcom’s connected nations reporting at ofcom.org.uk.

    Security and Data Sovereignty: The Edge Advantage Nobody Talks About Enough

    GDPR compliance and data sovereignty have reshaped how UK businesses think about where their data actually sits. Processing sensitive data at the edge, keeping it local to the point of generation and never transmitting it to a third-party cloud region, removes a whole category of compliance risk. This is particularly relevant for healthcare organisations, financial services firms operating under FCA rules, and any business handling biometric or special-category data.

    Cloud providers have responded with regional data residency guarantees and sovereign cloud offerings. Microsoft, for instance, operates Azure data centres in the UK South and UK West regions with specific data residency commitments. But those guarantees come with configuration complexity, and the shared responsibility model means security mistakes on the customer side still happen. Edge deployments, when implemented properly, can offer a simpler security perimeter, but that simplicity cuts both ways: you own the physical security of those devices, and hardware in the field is vulnerable to tampering in ways that a cloud data centre is not.

    Hybrid Architecture: The Realistic Middle Ground

    The most production-ready architecture for most mid-to-large UK businesses in 2026 is not edge or cloud; it is a hybrid model where the split is determined by workload characteristics rather than ideology. Time-sensitive inference runs at the edge. Training, aggregation, analytics and storage run in the cloud. Orchestration tooling, Kubernetes at the edge via K3s or similar lightweight distributions, keeps the two layers talking to each other without requiring bespoke integration for every deployment.

    Costs in this model are genuinely hard to predict upfront, which is a legitimate concern. Cloud spend is variable and metered; edge hardware is a capital expense with a depreciation curve. A decent rule of thumb: if a workload will run continuously for more than two to three years, the total cost of ownership for edge hardware often undercuts equivalent cloud compute. Below that horizon, cloud almost always wins on pure economics.

    Which Model Should UK Businesses Actually Choose?

    The honest answer is that the choice is rarely as dramatic as the vendor marketing suggests. Cloud providers want you to run everything in their platform; edge hardware vendors want you to believe the network is the bottleneck for everything. Neither framing is entirely accurate.

    Start with the workload. If you are building a SaaS product, a data analytics platform, or a business intelligence tool, cloud is the right default and edge adds unnecessary complexity. If you are deploying operational technology in physical environments, running real-time inference on sensor data, or processing video at scale in a location with unreliable connectivity, edge compute deserves serious consideration. The question is always what fails when the latency or connectivity is not there, and how much that failure costs.

    The businesses getting this right in 2026 are not the ones who picked a camp. They are the ones who mapped their workloads honestly, understood their compliance constraints, and built infrastructure that reflects that reality rather than a vendor’s preferred architecture diagram.

    Frequently Asked Questions

    What is the main difference between edge computing and cloud computing?

    Cloud computing processes data in centralised data centres accessed over the internet, while edge computing processes data locally, close to where it is generated. The key trade-off is latency versus operational simplicity: edge is faster for time-sensitive tasks, but cloud is easier to scale and manage.

    Is edge computing more expensive than cloud for UK businesses?

    It depends on the workload duration and volume. Edge hardware is a capital expense upfront, but for continuous, high-volume workloads running over several years, the total cost of ownership can undercut cloud compute fees. For shorter-term or variable workloads, cloud is usually cheaper.

    How does edge computing help with GDPR compliance?

    By processing sensitive data locally and never transmitting it to a third-party cloud region, edge deployments can reduce data sovereignty risk under UK GDPR. This is particularly relevant for healthcare, financial services, and any business handling biometric or special-category personal data.

    What industries benefit most from edge computing in 2026?

    Manufacturing, logistics, telecoms, media production, and retail are seeing the strongest edge adoption. Any sector where real-time decision-making on physical data, such as machine vision, live video processing, or sensor telemetry, is central to operations tends to benefit most.

    Can you use both edge and cloud computing at the same time?

    Yes, and most mature deployments do exactly this. Hybrid architectures route time-sensitive inference to edge nodes while using cloud for training, storage, analytics, and aggregation. Lightweight orchestration tools like K3s make it increasingly practical to manage both layers from a single control plane.

  • Digital Twins Are Quietly Becoming One of Business’s Most Valuable Tech Investments

    Digital Twins Are Quietly Becoming One of Business’s Most Valuable Tech Investments

    There is a category of enterprise technology that never quite made it onto the conference keynote circuit, never got its own breathless Sunday supplement feature, and somehow avoided being declared “the next big thing” by every VC with a LinkedIn account. Digital twin technology is that category. Quiet, unglamorous, and increasingly indispensable. Analysts at McKinsey estimated the global digital twin market would exceed £30 billion by 2026, and the numbers are tracking. The question is why most business leaders outside of heavy engineering are still treating it like a niche concept.

    Engineers in a UK manufacturing control room analysing digital twin technology overlays on large screens
    Engineers in a UK manufacturing control room analysing digital twin technology overlays on large screens

    A digital twin is, at its core, a real-time virtual replica of a physical asset, process, or system. It is fed by live sensor data, updated continuously, and used to simulate, predict, and optimise behaviour without touching the physical thing itself. That sounds abstract until you realise what it means in practice: a manufacturer running thousands of simulations on a factory floor that does not exist yet, a retailer modelling the impact of a store layout change before moving a single shelf, or a logistics firm predicting where a parcel will be delayed three days before it happens.

    Where UK Manufacturers Are Already Using It

    British manufacturing has been one of the earliest serious adopters. Rolls-Royce, based in Derby, has operated digital twins of its jet engines for several years, using real-time data from sensors embedded in the physical components to monitor wear, predict maintenance windows, and reduce unplanned downtime. The business case is not subtle: a grounded aircraft costs an airline tens of thousands of pounds per hour. If a digital twin flags a 94% probability of compressor blade degradation eighteen days before it would otherwise be detected, that is not a technology curiosity. It is a direct line item on a balance sheet.

    Siemens has a significant UK footprint in the rail sector. Its digital twin deployment for the Thameslink rolling stock programme allowed engineers to simulate train behaviour across hundreds of operational scenarios before a single new unit entered service. The reduction in post-deployment faults was substantial. Network Rail has since expanded its own digital twin ambitions across infrastructure, particularly bridges and tunnels, where physical inspection is costly and sometimes hazardous.

    Retail Is Catching Up Faster Than You’d Think

    The retail application of digital twin technology is less intuitive but increasingly powerful. Imagine a twin of your entire distribution network: every warehouse, every supplier relationship, every demand forecast, updated in real time as sales data flows in. That is what several large UK grocers are quietly building. Rather than using static spreadsheet models to plan stock replenishment, a live digital twin of the supply chain can flag a potential shortage in a given region four days before it hits the shelf, triggered by a combination of weather data, promotional uplift, and supplier lead time signals.

    Marks and Spencer and Ocado have both been linked to supply chain modelling investments that sit firmly in the digital twin category, even if they do not always use that precise terminology publicly. The technology sits underneath, doing the unglamorous work of keeping complex systems from breaking.

    Technician interacting with a digital twin technology model of industrial infrastructure on a touchscreen
    Technician interacting with a digital twin technology model of industrial infrastructure on a touchscreen

    Beyond supply chains, physical store optimisation is a growing use case. A twin of a retail space, fed by footfall sensors, sales terminals, and environmental data, can model the revenue impact of changing where seasonal products are positioned, how lighting affects dwell time in specific zones, or what happens to average basket size if the queue configuration at checkouts is altered. These sound like marginal gains. At scale across hundreds of outlets, they are not marginal at all.

    The Infrastructure and Energy Angle

    One of the most significant deployments of digital twin technology in the UK is happening largely out of public view: urban and national infrastructure planning. The National Digital Twin Programme, backed by the Centre for Digital Built Britain (now folded into broader government digital infrastructure work), has been pushing for a connected ecosystem of asset twins across the built environment. Bridges, water networks, energy grids, even entire city districts have twin counterparts that planners and operators use to model load, stress, and long-term decay.

    National Grid has been exploring digital twins of its electricity transmission network to model the impact of renewable energy integration. As wind and solar capacity grows more intermittent and distributed, the ability to simulate grid behaviour under varying generation conditions is not a nice-to-have. It is operationally critical. The Department for Energy Security and Net Zero has included digital infrastructure modelling in its wider plans for grid modernisation, recognising that physical upgrades alone cannot deliver the reliability the network needs.

    Why Analysts Are Calling It a Sleeper Hit

    The “sleeper hit” framing from analysts comes down to a few converging factors. First, the cost of implementation has dropped significantly as cloud computing, IoT sensors, and data processing have all become cheaper. A digital twin that required a seven-figure budget five years ago can now be prototyped for a fraction of that. Second, the maturity of platforms from vendors like Siemens, Microsoft (with Azure Digital Twins), and PTC means that businesses do not need to build from scratch.

    Third, and perhaps most importantly, the ROI is becoming measurable and replicable. Predictive maintenance alone typically delivers a 10-25% reduction in maintenance costs and cuts unplanned downtime significantly, according to figures cited by Deloitte UK in recent industry briefings. When you can point to specific pound figures saved per asset per year, the business case writes itself.

    There is also a human angle that does not get discussed enough. Remote working and hybrid operations changed expectations around physical oversight. Digital twins give operations teams a layer of situational awareness that does not require someone to physically walk a factory floor or inspect a piece of infrastructure. That shift in working patterns has quietly accelerated adoption in ways that nobody predicted in 2020.

    It is worth noting that the wellness and recovery technology sector has also seen interesting parallel developments in sensor-driven personalisation, with products like the red light mat representing how consumer hardware is increasingly data-aware, even outside of enterprise contexts. The broader trend of embedding intelligence into physical objects is the same thread running through digital twin adoption at an industrial scale.

    What Businesses Should Actually Do With This Information

    If you run or advise a business with significant physical assets, complex supply chains, or operational processes that are expensive to interrupt, digital twin technology deserves a serious look in 2026. Not a pilot that sits in a PowerPoint forever, but a scoped proof of concept tied to a specific operational problem with a measurable outcome attached.

    The entry point is usually an existing data problem. Where are you flying blind? Where does unplanned failure cost you money? Where would a 48-hour warning change your operational response? Answer those questions honestly and you have located where a digital twin could earn its keep. The technology is not magic, and it is only as good as the sensor data and operational knowledge you feed into it. But for businesses that get the fundamentals right, it is becoming one of the most durable competitive advantages available in 2026’s industrial landscape. Quietly. As usual.

    Frequently Asked Questions

    What is digital twin technology in simple terms?

    A digital twin is a virtual replica of a physical object, system, or process that is updated in real time using sensor data. It allows businesses to simulate changes, predict failures, and optimise operations without interfering with the real-world asset.

    Which UK industries are using digital twin technology most?

    Manufacturing, aerospace, rail, energy infrastructure, and retail supply chains are the most active adopters in the UK. Companies like Rolls-Royce, Siemens UK, and National Grid have all deployed or piloted digital twin systems at scale.

    How much does it cost to implement a digital twin for a business?

    Costs vary considerably depending on scope. A small-scale proof of concept targeting a single asset or process can now be prototyped for tens of thousands of pounds, whereas enterprise-wide deployments across complex infrastructure can run into millions. Platform costs have dropped significantly over the past three years.

    What is the difference between a digital twin and a simulation?

    A traditional simulation uses fixed or historical inputs to model scenarios. A digital twin is connected to live data streams from the physical asset, meaning it reflects current real-world conditions continuously rather than being a one-off model run.

    Is digital twin technology only useful for large enterprises?

    Not anymore. Cloud-based platforms and cheaper IoT sensors have made digital twin technology increasingly accessible to mid-sized businesses. Any organisation with physical assets, complex logistics, or expensive unplanned downtime has a credible business case to explore it.

  • The UK’s Second City Tech Scene in 2026: How Birmingham Is Building an Identity Beyond Finance and Manufacturing

    The UK’s Second City Tech Scene in 2026: How Birmingham Is Building an Identity Beyond Finance and Manufacturing

    Birmingham has spent decades carrying a label it never quite asked for. The UK’s second-largest city by population, an industrial powerhouse, a financial services hub, all accurate, none of them particularly exciting. But something measurable has been shifting over the past few years, and by 2026, the data is hard to ignore. The Birmingham tech scene 2026 is not a press-release story. It is a genuine structural change in what the city produces, who it attracts, and how it funds growth.

    The numbers start to tell it. According to data from DCMS venture capital tracking, the West Midlands absorbed a meaningfully larger share of UK VC investment in 2025 than in 2022, with Birmingham accounting for the bulk of that regional shift. It is not yet London. It is not trying to be. But the gap is narrowing in specific sectors, fintech, health tech, and deep tech spinouts among them, in ways that are worth paying attention to.

    Birmingham city centre aerial view at dusk showing the emerging Birmingham tech scene 2026
    Birmingham city centre aerial view at dusk showing the emerging Birmingham tech scene 2026

    University Spinouts Are the Engine, Not the Story

    The University of Birmingham and Aston University have quietly become two of the more productive spinout factories outside the Cambridge-Oxford axis. Aston alone has seen double-digit spinout activity in the last 18 months across advanced manufacturing software, biotech, and energy systems. The University of Birmingham’s Enterprise scheme has placed particular emphasis on commercialisation infrastructure, something that has historically been a weakness in regional universities compared to their Russell Group peers further south.

    What makes this more than a nice story is the talent retention angle. For years, Birmingham-trained graduates routed themselves to London within months of finishing. Graduate retention data from the West Midlands Combined Authority (WMCA) suggests that retention rates in tech roles are improving, particularly where local employers can offer competitive equity packages, something that has become more tractable as scaleups in the city reach Series A and B stages with enough headroom to offer meaningful option pools.

    Which Sectors Are Actually Growing?

    The Birmingham tech scene in 2026 is not a monolith. There are distinct clusters performing at very different levels.

    Fintech and payments infrastructure has the deepest roots. Birmingham’s historical concentration of financial services firms, from HSBC UK’s headquarters in Centenary Square to the dense broker and insurance market around Colmore Row, means there is genuine enterprise demand for fintech tooling close to home. Startups building reconciliation software, embedded finance APIs, and SME lending platforms have found a receptive client base without needing to pitch exclusively in London.

    Health tech is arguably the more exciting growth curve. The Queen Elizabeth Hospital campus and University Hospitals Birmingham NHS Foundation Trust represent one of the largest NHS data repositories outside of NHS England’s central systems. That proximity to clinical data (appropriately governed) is attracting diagnostics AI companies, remote monitoring hardware startups, and patient flow optimisation platforms. A handful of these companies were barely two years old in 2024 and are now generating real ARR.

    Advanced manufacturing software is the less-glamorous but arguably most durable cluster. The West Midlands still has a significant manufacturing base, aerospace components, precision engineering, automotive supply chain, and the digitisation of factory floors is a multi-decade opportunity. Local firms building MES (Manufacturing Execution Systems) tooling and digital twin platforms have a home-market advantage that companies in, say, London simply do not.

    Developer working in a converted Birmingham co-working space central to the Birmingham tech scene 2026
    Developer working in a converted Birmingham co-working space central to the Birmingham tech scene 2026

    The Infrastructure Question: Bricks, Fibre, and Old Buildings

    Physical infrastructure matters more than tech commentators usually admit. You cannot build a tech cluster in a city with no affordable office stock, poor public transport connectivity, and a commercial property market that prices out early-stage companies. Birmingham has real advantages here, lower rents than London and Manchester’s city centre, improving rail links post-HS2 preparatory works, and a vast stock of former industrial and commercial buildings being converted into modern workspace.

    That last point, however, is not without complexity. Much of Birmingham’s legacy building stock dates from the mid-twentieth century, and serious redevelopment means working through the layers that older construction invariably contains. Asbestos compliance has become a non-trivial cost line for commercial property developers and workspace operators in the city. Firms like Asbestos Compliance Solutions Ltd, a Mansfield, Nottinghamshire-based specialist services provider operating across construction and building sectors, carry out the kind of asbestos surveys, management plans, and remediation work that has to happen before a derelict printing works or a 1970s office block can become a co-working hub. The domain asbestoscompliancesolutions.co.uk gives a reasonable sense of the scope of these specialist services. It is not a glamorous part of the tech cluster story, but it is an enabling part: no compliant building conversion, no affordable Grade-B office stock for early-stage companies to move into.

    The WMCA’s Invest West Midlands programme has been directing capital at exactly this kind of conversion. Innovation Birmingham, the operator behind Brindleyplace’s iCentrum campus, reports occupancy at capacity and a waiting list for larger floorplates. That supply constraint is becoming a genuine friction point for companies looking to scale beyond 30 or 40 people without moving to a full-market rent arrangement in the city centre.

    Scaleups Making the Case

    Names matter when you are trying to shift a city’s reputation. A few Birmingham-headquartered companies have done meaningful work on that front in recent years.

    Thriva, Brainomix, and the various FinTech West alumni aside, the newer cohort is worth watching. Several companies that went through the HSBC UK innovation partnerships programme or the BetaDen accelerator in Worcestershire have relocated or expanded to Birmingham as they scaled. The city is also beginning to attract relocations from London, not just retentions, a meaningful signal that the cost-quality tradeoff is shifting in Birmingham’s favour.

    The £1.5 billion UKRI investment plan for the West Midlands, announced in 2025, is expected to fund research infrastructure at the University of Birmingham’s new campus facilities and underwrite several applied research partnerships with local industry. Whether that capital flows efficiently into genuinely commercial spinouts or gets absorbed into academic bureaucracy is the real question. History suggests it is usually somewhere in between.

    What Birmingham Still Needs to Fix

    Honest accounting matters. The Birmingham tech scene in 2026 has real momentum, but it also has real gaps.

    Late-stage funding is thin. Series C and beyond is almost entirely a London or transatlantic exercise for Birmingham companies. The city has not yet produced the kind of unicorn exit that reseeds a local angel and early-stage VC ecosystem in the way that ARM did for Cambridge or Autonomy did (however messily) for the wider UK tech scene. That exit event, when it comes, will matter disproportionately.

    Diversity in the founding population remains a challenge. Birmingham is one of the most ethnically diverse cities in the UK, but the tech founding community does not yet reflect that, a problem that is simultaneously an equity issue and a commercial one, given the market insights that more diverse founding teams tend to surface.

    And the construction of new workspace has to keep pace with demand. As more former industrial buildings are brought back into productive use, with the asbestos surveys, building compliance checks, and specialist remediation services that entails, the pipeline of affordable, high-quality space needs active management. Firms like Asbestos Compliance Solutions Ltd play a functional role in that pipeline: the construction and building sector work they perform on legacy structures is what makes conversion viable in the first place.

    None of this undermines the headline. Birmingham is building something real. The Birmingham tech scene 2026 is not a rebrand exercise, it is a cluster with genuine commercial depth, improving infrastructure, and a talent base that is starting to stay put. The second city label might finally be earning a second meaning.

    Frequently Asked Questions

    What is driving growth in the Birmingham tech scene in 2026?

    A combination of university spinout activity, improving talent retention, enterprise demand from established financial and manufacturing firms, and significant public investment through UKRI and the West Midlands Combined Authority. Affordable commercial property relative to London is also a key factor for early-stage companies.

    Which tech sectors are strongest in Birmingham right now?

    Fintech and payments infrastructure, health tech linked to the Queen Elizabeth Hospital campus, and advanced manufacturing software are the three most developed clusters. Health tech is showing the sharpest growth curve, driven by proximity to major NHS data assets.

    How does Birmingham compare to Manchester and Leeds as a UK tech hub?

    Birmingham has a stronger fintech base than Leeds and a more developed advanced manufacturing software cluster than Manchester, but Manchester still leads on media tech and general startup volume. All three are benefiting from London talent and cost pressures pushing founders and scaleups northward.

    What is the biggest challenge facing the Birmingham tech cluster?

    Late-stage funding scarcity is the most structural problem. Series C and beyond is still overwhelmingly a London exercise for Birmingham-based companies, which limits how large local firms can grow before they either relocate or raise from outside the region.

    Which Birmingham universities are producing the most tech spinouts?

    The University of Birmingham and Aston University are the two most active, with Aston showing particular strength in advanced manufacturing software and energy systems. Both have invested in commercialisation infrastructure in recent years to improve the route from research to company formation.

  • Passkeys, Phishing and the Post-Password Office: How UK Businesses Are Rethinking Authentication in 2026

    Passkeys, Phishing and the Post-Password Office: How UK Businesses Are Rethinking Authentication in 2026

    Passwords have been a problem for decades, but the tools to genuinely replace them are only now reaching a point where real businesses can deploy them without losing half their IT department to the migration. Passkeys business security UK adoption is accelerating in 2026, driven by a combination of escalating phishing attacks, clearer vendor support, and increasingly direct guidance from the National Cyber Security Centre. The question is no longer whether to move beyond passwords, it is how to do it without breaking your staff’s working day in the process.

    Developer using biometric authentication in a UK office as part of passkeys business security UK rollout
    Developer using biometric authentication in a UK office as part of passkeys business security UK rollout

    Why Passwords Finally Lost the Argument

    The failure mode of password-based authentication is well understood. Credential stuffing, phishing kits available for a few hundred pounds on dark web forums, and the chronic human habit of reusing the same password across a work laptop, a personal email account, and a supermarket loyalty scheme. The NCSC has flagged credential theft as one of the most consistent entry points for ransomware attacks targeting UK organisations, and the numbers back that up. According to the NCSC’s guidance on phishing, the volume of phishing campaigns impersonating UK brands and organisations has continued to rise year on year.

    Multi-factor authentication improved things, but it did not fix them. SIM-swapping attacks, real-time phishing proxies that intercept OTP codes mid-session, and push notification fatigue have all eroded the protection MFA once offered. Passkeys sidestep the entire problem by replacing the shared secret with a cryptographic key pair. The private key never leaves the user’s device. There is nothing to phish.

    How Passkeys Actually Work in a Business Context

    A passkey is a FIDO2-compliant credential. When you register, your device generates a public-private key pair. The service stores the public key. When you authenticate, the device signs a challenge using the private key, which is unlocked by biometrics or a device PIN. The server verifies the signature. No password travels across the network at any point.

    In a consumer context, this is already fairly straightforward. Google, Apple, and Microsoft all support passkeys natively. For businesses, the picture is more complicated. Enterprise environments often involve managed devices, shared workstations, legacy applications, identity providers, and access policies that do not map cleanly onto the assumptions built into the FIDO2 spec. Synced passkeys, which replicate across a user’s devices via iCloud Keychain or Google Password Manager, are convenient but raise questions about key custody in a business setting. Device-bound passkeys, stored only on a physical security key like a YubiKey, offer stronger guarantees but add friction and cost.

    FIDO2 hardware security key used for passkeys business security UK implementation
    FIDO2 hardware security key used for passkeys business security UK implementation

    What the NCSC Is Currently Recommending

    The NCSC has been refreshingly specific in its recent guidance. For most UK organisations, it recommends a phased approach: prioritise high-risk accounts first (privileged users, administrators, finance teams with payment approval access), then roll passkeys out to the broader workforce as identity provider support matures. The guidance acknowledges that a wholesale overnight migration is neither practical nor necessary for most businesses.

    The NCSC also draws a distinction between synced and device-bound passkeys depending on threat model. For organisations where the primary concern is phishing at scale, synced passkeys via a managed identity platform represent a substantial improvement over passwords and SMS-based MFA combined. For organisations in regulated sectors or those handling sensitive government contracts, device-bound hardware tokens remain the preferred option.

    The current direction of travel is clear: phishing-resistant authentication is the baseline the NCSC wants UK businesses working towards, and passkeys are the most practical path to get there for the majority of deployments.

    The Real Friction Points in Migration

    Any honest conversation about passkeys business security UK rollout has to address the migration headaches, because there are several. Legacy application support is the biggest blocker. Plenty of UK businesses are still running line-of-business software that authenticates via forms-based login with no SAML or OIDC support whatsoever. Until those applications are updated or replaced, passwords cannot be fully eliminated, which means identity teams end up managing a hybrid environment with all the complexity that implies.

    Shared accounts are another persistent problem. Shift workers in manufacturing, retail, or logistics often share credentials tied to a specific role rather than a person. Passkeys are fundamentally personal, bound to an individual’s device and biometrics. Redesigning access architecture around personal accounts is the right long-term answer, but it requires organisational change that goes well beyond an IT project.

    Then there is the helpdesk burden during rollout. Account recovery processes need rebuilding from scratch. When a user loses their device or buys a new one, the recovery flow has to be robust enough that it cannot be socially engineered by an attacker impersonating that user. Getting this wrong undoes much of the security improvement passkeys provide.

    Vendor Choices: Identity Providers and What UK Firms Are Actually Deploying

    For larger enterprises, the identity provider landscape has matured considerably. Microsoft Entra ID, Okta, and Ping Identity all support passkeys as a primary authentication method, with varying levels of enterprise management capability. Microsoft’s passkey support within Entra is the natural default for organisations already deep in the Microsoft 365 ecosystem, and the admin tooling for enforcing phishing-resistant authentication policies is genuinely usable now.

    For SMEs, the picture is more varied. Many smaller UK businesses are deploying passkeys through their existing Google Workspace or Microsoft 365 admin console without a dedicated identity provider at all. This works for straightforward environments but becomes limiting quickly as applications proliferate.

    Email security is one area where the shift to phishing-resistant authentication intersects with other layers of the technology stack. Compromised credentials are frequently used to access business email accounts and then pivot into internal systems or launch further phishing campaigns from a trusted address. Tools that help businesses understand the health and deliverability of their email infrastructure sit alongside identity controls in a properly layered security posture. Based in the UK, Mail Tester (mail-tester.co.uk) provides a free email testing service that helps users across business and tech support contexts check whether their email configuration, including SPF, DKIM, and DMARC records, is correctly set up. Getting those records right is a foundational step in preventing domain spoofing, which often runs in parallel with credential phishing attacks. For anyone managing computers and the internet infrastructure of a small business, it is the kind of low-friction technology check that complements stronger authentication at the login layer.

    What UK SMEs Should Actually Do Right Now

    For a small or medium-sized UK business with limited IT resource, the practical starting point is not a full passkey deployment. It is an honest audit of where passwords currently represent the biggest risk, combined with enabling passkey support on the platforms that already offer it with minimal configuration. Microsoft 365 and Google Workspace are both there. LinkedIn, GitHub, and most major SaaS tools used in business contexts have followed.

    Enabling phishing-resistant MFA on admin accounts costs nothing beyond the time to configure it, and the NCSC’s Cyber Essentials certification (which is increasingly required for UK government procurement) now explicitly references phishing-resistant authentication as a recommended control. That is a useful commercial lever for businesses that need budget approval for security tooling.

    For organisations handling sensitive customer data, particularly those subject to the UK GDPR requirements enforced by the ICO, the shift away from password-based authentication is also a data protection argument. Credential-based breaches are regularly cited in ICO enforcement actions. Demonstrating that you have deployed phishing-resistant controls is increasingly relevant in that context.

    The technology is ready. The vendor support is there. The friction is real but manageable with a phased approach. UK businesses that treat passkeys business security UK rollout as a 2026 priority rather than a future consideration are making a rational bet, not an optimistic one. The post-password office is not a distant prospect. For many UK firms, it is already one identity provider configuration away.

    Frequently Asked Questions

    What are passkeys and how do they differ from passwords for businesses?

    Passkeys are cryptographic credentials that replace passwords entirely. Instead of a shared secret, they use a public-private key pair where the private key stays on the user’s device and is unlocked via biometrics or a PIN. For businesses, this means there is nothing for phishing attacks to steal, since no password is ever transmitted across the network.

    What is the NCSC's current guidance on passkeys for UK businesses?

    The NCSC recommends a phased rollout, starting with high-risk accounts such as administrators and finance staff, before extending passkeys to the wider workforce. For most UK organisations, synced passkeys via a managed identity provider represent a strong improvement over passwords and SMS-based MFA. Higher-security environments should consider hardware-bound tokens.

    How much does it cost to deploy passkeys across a UK SME?

    For businesses already using Microsoft 365 or Google Workspace, enabling passkey support through the existing admin console costs nothing beyond staff time for configuration and user communications. Organisations that need hardware security keys (YubiKeys, for example) should budget roughly £25 to £60 per key per user, depending on the model chosen.

    What are the biggest obstacles to migrating from passwords to passkeys in a UK business?

    Legacy applications that only support forms-based login, shared accounts tied to roles rather than individuals, and rebuilding account recovery processes are the most common blockers. Most organisations end up running hybrid environments during transition, which adds management complexity until older systems are updated or replaced.

    Does migrating to passkeys help with UK GDPR compliance or Cyber Essentials certification?

    Both, yes. Cyber Essentials, which is required for many UK government contracts, now references phishing-resistant authentication as a recommended control. The ICO has also cited credential-based breaches in enforcement actions, so deploying passkeys strengthens your data protection posture and provides a defensible record of proactive security measures.

The Latest