Top 50 Cybersecurity Service Providers: 2026 Edition

Orange Cyberdefense is the cybersecurity services subsidiary of the French telecoms group Orange. The parent describes it as the European leader in cybersecurity services and states that it generated revenue of €1.3 billion in 2025 from managed security services, consulting and integration. Orange's full-year results put the unit's 2025 growth at 6.8%, or about €80 million, in a year when the wider Orange Business segment shrank. The unit lists more than 3,300 experts, 36 detection centres across 23 countries and what it calls Europe's first private CERT. In May 2026 it entered Spain with MasOrange, placing teams in Madrid and Barcelona, as part of a plan to reach €2 billion of revenue by 2030.

Cyber & Security Solutions is one of the sectors that the Italian aerospace and defence group Leonardo reports on its own. In 2025 the sector recorded revenues of €798 million, up 23.1% from €648 million, with new orders of €1,052 million, an order backlog of €1,326 million and EBITA of €80 million, a 10.0% return on sales. Its offer is organised into Cyber & Resilience, Secure Digital & Cloud and Mission Critical Comms, and its Global Cybersec Centre monitors client environments on a continuing basis. The revenue figure is wider than pure security services: 2025 orders included TETRA radio networks for Italian police forces and cloud work under the Polo Strategico Nazionale programme. Its main entities are Leonardo SpA and Leonardo UK.

Atos Group reports in two strategic business units, Atos and Eviden. In its fiscal 2025 results it restated 2024 figures to reflect the transfer of the Cybersecurity Services business from Eviden to Atos, a move that shifted €450 million of fiscal 2024 revenue between the two units. That restatement is the most recent separately disclosed figure for the business and is used here. Group revenue in fiscal 2025 was €8,001 million, and Eviden, which keeps cybersecurity products and mission-critical systems, recorded €1,039 million. Atos named a cybersecurity contract with the European Commission among its main 2025 signatures and describes cybersecurity as one of three strategic pillars alongside agentic AI and digital sovereignty. The Austrian consultancy SEC Consult is part of Atos.

ReliaQuest is a privately held security operations company headquartered in Tampa, Florida, which sells an AI-assisted security operations platform together with the people who operate it. Executive biographies on its website state that the company grew to more than US$400 million in revenue in 2025 and is valued at over US$3.4 billion, with investors including KKR, EQT and FTV Capital. The same page gives slightly different scale figures in different biographies: more than 1,000 employees and over 1,500 customers in one, and over 1,200 teammates and more than 1,000 customers in another. The revenue figure is company-stated rather than audited, which should be borne in mind when comparing it with the filed figures of listed peers.

NCC Group describes itself as a people-powered, tech-enabled cyber security and software escrow business with about 2,200 colleagues across Europe, North America and Asia Pacific. In the year to 30 September 2025 its Cyber Security division generated revenue of £238.9 million, including £11.5 million from the non-core Crypto and DetACT businesses; excluding them, the division's revenue was £227.4 million, down 4.0% at constant currency. Group revenue was £305.4 million, of which £66.5 million came from the Escode software escrow business, now classed as discontinued while the board considers a sale. North American cyber revenue fell 12.9% at constant currency, and finance and IT have been centralised in hubs in Manchester and Manila.

CrowdStrike is ranked in this list only on its professional services line, which covers incident response, forensic investigation, breach recovery, technical assessments, strategic advisory and SIEM consulting. In the fiscal year ended 31 January 2026 that line produced US$247.3 million of revenue, up from US$192.1 million, against total company revenue of US$4,812.0 million. The figure understates CrowdStrike's service activity, because its Falcon Complete managed detection and response offering is sold as a subscription and counted in subscription revenue. The company had 10,698 full-time employees at the fiscal year end. CrowdStrike also appears in this site's ranking of cybersecurity product companies, which uses total revenue.

Kudelski Security was created in 2012 when the Swiss Kudelski Group entered the cybersecurity market. The group reports it as a separate Cybersecurity segment, whose net revenues were US$98.5 million in 2025, a 9.2% decline that the annual report attributes partly to a deliberate shift towards managed detection and response and advisory work. The segment posted an EBITDA loss of US$13.9 million, and management expects it to reach EBITDA break-even in 2027. Kudelski Security lists four Cyber Fusion Centers in Europe and the US, two R&D centres in Switzerland and India and more than 400 dedicated consultants, engineers and specialists, with its headquarters at Cheseaux-sur-Lausanne.

CISO Global is a US cybersecurity and compliance services company with its principal executive offices in Scottsdale, Arizona. Its 2025 Form 10-K reports total revenue of US$26.6 million, down from US$30.8 million, of which security managed services contributed US$23.8 million, professional services US$2.2 million and software US$0.6 million. The company says its staff work as dedicated partners on recurring monthly contracts rather than as project consultants. It is the smallest firm in the revenue-ranked group and is included because it clears the list's US$20 million revenue threshold for this tier; other listed micro-caps with cyber service lines were left out because they fell below it.

Deloitte is a global network of professional services member firms whose cyber practice spans strategy, risk, engineering and managed services. Deloitte US states that the practice has more than 35,000 cybersecurity practitioners and more than 2,700 cyber clients across major industries, and operates in more than 150 countries and territories with over 30 years of experience. The same page cites a Gartner market share report ranking Deloitte the number one security services provider worldwide by revenue; Gartner's underlying revenue figures are not public, so Deloitte is ranked here by headcount. Deloitte does not report cyber revenue separately in its global results.

Accenture's cybersecurity business stated in March 2026 that it has more than 30,000 cybersecurity professionals, in an announcement of its Cyber.AI offering built with Anthropic. The company has bought security firms steadily: by August 2025 it had completed 20 security acquisitions since 2015, including Morphus, MNEMO Mexico and Innotec Security. Its largest, CyberCX of Australia and New Zealand, brought about 1,400 cybersecurity professionals and closed on 27 February 2026. Accenture does not disclose security revenue separately; the company as a whole had approximately 786,000 people at the time of the March 2026 announcement.

HCLTech, the Noida-based IT services company, runs a cybersecurity practice that it says has 29 years of history. Its cybersecurity services page lists more than 8,500 cybersecurity professionals, ten Cybersecurity Fusion Centers, more than 50 global delivery centres and over 800 active client engagements. The fusion centres deliver what the company calls universal managed threat detection and response, built on its SecIntAI framework. An older section of the same page still gives 8,000-plus professionals, an example of how vendor-published headcounts drift between page updates.

Wipro's cybersecurity practice describes its staff as 'cybersecurists' and states that it has more than 8,000 of them, serving more than 600 clients in over 60 countries from eight global cyber defence centres. The practice covers consulting, managed security operations, identity, cloud security and risk services. Wipro does not report cybersecurity revenue separately, so its position here rests on the published headcount. With eight cyber defence centres for 600-plus clients, it runs fewer, larger delivery hubs than NTT DATA or Orange Cyberdefense. Its headcount is close to HCLTech's, the nearest comparable Indian IT services peer in this list.

Kyndryl, the New York-listed infrastructure services company, sells security under a cyber resilience banner that combines protection, detection and recovery. Its service page states that the offering is backed by more than 7,500 cyber resilience professionals, technology from over 40 partners and more than 30 years of IT security and infrastructure work. It cites a 2025 NelsonHall NEAT leader rating for attack surface management and an AWS Resilience Competency. The headcount covers resilience and recovery staff as well as security specialists, so it is broader than a pure SOC count.

NTT DATA Group, the Tokyo-headquartered IT services company, states that it has more than 7,500 cybersecurity professionals, more than 80 cybersecurity delivery centres and 49 security operations centres. That SOC count is the highest published by any firm in this list. Its security business sells consulting, managed security, identity and OT security across the group's operating companies. NTT DATA does not publish cybersecurity revenue, so it is ranked by headcount; on SOC count alone it would sit higher.

Thales combines cybersecurity products, such as data protection and application security, with consulting, integration and managed detection services. Its cybersecurity marketing page gives 6,000 cybersecurity professionals, 30,000 cybersecurity customers and more than US$2 billion of cybersecurity revenue, alongside 80,000 group employees. Because the revenue figure is undated and mixes product licences with services, it is not used for ranking; Thales is placed by headcount instead. The services side includes security operations centres and incident response for critical infrastructure and government clients.

LTIMindtree, which now brands itself LTM, publishes a snapshot of its cybersecurity practice: a headcount of 4,042-plus, more than 260 clients including 26 Fortune 500 companies, nine Cyber Defense Resiliency Centers, over 30 intellectual-property assets and accelerators and more than 35 strategic alliances. The practice sells cybersecurity as a service, covering detection and response, identity, cloud security and DevSecOps. As a unit of a broad IT services firm, it does not report its own revenue. Its client count is the smallest among the large Indian practices listed here.

DXC Technology, the US IT services company, publishes the scale of its security business on its cybersecurity page: more than 3,200 cybersecurity services professionals worldwide, 12 security operations centres, 4.5 million threats processed daily and more than 450 customers. DXC packages detection and response, identity, data protection and advisory into a single managed offering. Security revenue is not broken out in its filings. The ratio of staff to customers, roughly seven professionals per customer on the published figures, points to a business built around large outsourcing accounts rather than standardised mid-market MDR. DXC's SOC count matches IBM's published location count.

BT Group sells managed security through its business division, combining network-based protection with managed detection, consulting and incident response. Its cybersecurity page states that BT has 3,000 security professionals and describes the company as one of the largest security and network providers. The headcount includes staff who protect BT's own networks, which differ from client-facing service teams. BT does not report security revenue separately. BT's position in this list rests on that single figure; it does not publish a SOC count or a customer number for its security business. Its services are aimed mainly at organisations that already buy network connectivity from BT, in the UK and internationally.

CGI, founded in 1976, offers cybersecurity as part of its IT and business consulting services. Its cybersecurity page lists more than 1,700 experienced and credentialed security specialists and eight security operations centres that run around-the-clock detection and prevention, and notes that it supports access control for more than ten million industrial IoT assets for an industry-wide service. The firm is strongest in public-sector, energy and utilities work. CGI's figure of eight SOCs is the same as Wipro's and Integrity360's.

Inspira Enterprise is a cybersecurity services company that says it has worked for more than 18 years with over 600 organisations in more than 20 countries across the Americas, the Middle East and Africa, India and ASEAN. It states that its services, covering advisory, intelligence, detection, response and OT/IoT security, are run by more than 1,500 professionals and 50 domain specialists from five AI-powered Cyber Fusion Centers. It is one of the few specialist providers in this list based in India rather than a division of a larger IT group.

Coalfire is a US cybersecurity firm best known for compliance assessments, which it combines with penetration testing, security engineering and managed services. Its company page lists more than 1,000 expert team members, more than 1,000 clients across major industries, more than 900 employee licences and certifications and over 20 years in cybersecurity. It states that it has been named to Consulting Magazine's list of fastest-growing firms four years in a row. Unlike most firms in this tier, Coalfire is primarily an assessor rather than a SOC operator.

I-TRACING is a French cybersecurity services company with 21 years of operation. Its home page lists more than 1,000 cyber experts, more than 600 enterprise customers, more than 50 technology partners, annual growth above 30% and revenue of more than €230 million. The site does not state the fiscal year of the revenue figure, so the company is ranked here by headcount rather than in the revenue group. It runs a 24/7 CERT for incident response alongside managed detection, identity and consulting services.

LevelBlue, headquartered in Dallas, describes itself as the world's largest pure-play managed security services provider, a position it built through acquisitions in 2025. It completed the purchase of Trustwave on 19 August 2025 and of Cybereason on 25 November 2025, after earlier deals for Stroz Friedberg and Elysium Digital; the Cybereason transaction also brought SoftBank Corp., SoftBank Vision Fund 2 and Liberty Strategic Capital in as investors. LevelBlue does not publish a total headcount; its SpiderLabs unit alone is described as a global team of more than 1,000 consultants, threat hunters and incident responders, the figure used for ranking.

Ensign InfoSecurity presents itself as Asia's premier cybersecurity provider and managed security services provider, with pure-play cybersecurity expertise. Its home page states that it has close to 1,000 professionals in cybersecurity. It sells managed detection, consulting, threat intelligence and engineering services, and is placed immediately below the firms reporting 1,000 or more because its own figure is given as 'close to' that number. It is one of two Asia-Pacific specialists in this list, alongside Inspira Enterprise, that are not divisions of larger groups. Its figure is the published total and is not split between managed services and consulting.

Cyderes is a managed cybersecurity services provider that sells managed detection and response, identity and access management and exposure management. Its home page lists more than 800 dedicated security professionals, over 250 security engineers, more than 100 unique cyber certifications and five global 24/7 security operations centres. It positions its services around unified visibility of assets, access and exposures. It does not publish a customer count or revenue, so its ranking rests on the professional headcount it reports.

Advens is a French cybersecurity services company that emphasises its independence and its certification as a B Corp. Its home page states that it has 600 experts across France and Europe, who deliver managed detection and response, consulting and security integration. The company presents its independence as a guarantee of European control over client data, a theme it shares with other French providers in this list. It does not publish revenue. Advens is one of three France-headquartered specialists in this ranking, with I-TRACING and Orange Cyberdefense.

CPX is a cyber and physical security company based in the United Arab Emirates that serves governments, enterprises and critical infrastructure. Its home page lists more than 600 professionals in consulting, services and solutions, more than 200 government and enterprise clients, more than 14 nation-wide transformation programmes, over 50 services and more than 100,000 end-users protected. Its portfolio runs from security architecture and OT security to AI security and incident response. The headcount includes staff working on physical-security and products as well as cyber services.

Help AG was co-founded in Germany in 1995 and has since become a Middle East cybersecurity provider. Its website lists more than 600 cybersecurity practitioners, more than 500 clients among leading enterprise and government entities and two cyber SOCs in the UAE and Saudi Arabia, and says the company is entirely focused on cybersecurity. The firm's history page records its first independent SOC and its SOC-CMM Level 3 certification, and notes that Dr Aleksandar Valjarevic became acting chief executive on 10 September 2025.

Integrity360 is a cybersecurity specialist that operates from Dublin to Cape Town. Its home page lists eight global SOCs, more than 600 security experts and 21 years of experience. It combines vendor-agnostic consulting, testing and integration with 24/7 managed detection, and its site announces managed OT security services and a completed SOC 2 certification. It does not publish revenue. Its staff and SOC figures are on the same scale as Help AG's and CPX's, the two Gulf providers with similar headcounts.

Kroll is a risk and financial advisory firm whose Cyber and Data Resilience practice combines incident response, forensics, managed detection and breach notification. The London-based Redscan, described as a Kroll business, lists more than 550 experts in the cyber team and more than 3,000 incidents managed per year. A 2026 Kroll incident response brochure gives more than 300 DFIR experts worldwide, more than 1,000 IR cases a year and a place on the panels of more than 85 insurance carriers. The two caseload figures differ in scope and are reported as Kroll gives them.

Truesec was founded in 2005 and is headquartered in Stockholm. Its company history records about 80 employees in the 2010s, about 180 in 2021 when it partnered with IK Partners, about 250 after expanding into Finland, and more than 440 dedicated cybersecurity experts and specialists in 2026, when it also acquired Subset. It operates seven offices and sells incident response, managed detection, offensive testing and technical training. The history shows the firm roughly doubling in size between 2021 and 2026.

SecurityHQ is a managed security services provider offering detection and response, threat and adversary intelligence, exposure management and advisory services. Its company page states that it has more than 400 analysts and engineers working across six global security operations centres, with a timeline that includes SOC openings in Pune, Dubai, London and Riyadh. The company also sells its own incident management and analytics platform to clients. It publishes no revenue or customer figure, so it is ranked by the analyst and engineer headcount it reports.

Quorum Cyber was founded in Edinburgh in 2016 and specialises in managed security built on Microsoft technology. Its company page lists more than 350 employees across the UK, US, Canada and the UAE, more than 400 customers and over 1,000 Microsoft certifications, and records its status as a Microsoft Solutions Partner for Security. The site announces that Quorum Cyber and Ontinue are combining their Microsoft-first MXDR businesses; the two are listed separately here because they still publish separate figures.

NVISO is a pure-play cybersecurity firm founded in 2013. Its website says that more than 300 specialised security experts work in Belgium, Germany, Austria and Greece, and lists offices in Brussels, Frankfurt, Munich, Vienna and Athens. It has delivered managed detection and response since 2021 to clients such as Bekaert, according to a customer statement on the site, and also provides offensive security, consulting and ISO 27001 support. NVISO and Swisscom both report about 300 security staff and are ordered alphabetically under the list's tie rule.

Swisscom, the Swiss telecoms operator, runs a cybersecurity services business for Swiss enterprise customers. Its security services page says customers can draw on the specialist knowledge of 300 cybersecurity professionals and that more than 1,000 Swiss enterprise customers use its cybersecurity solutions. The offer includes managed security operations, consulting and network-based protection delivered from Switzerland. It is ranked by the headcount figure, which ties with NVISO's 300 under the list's tie rule. Its customer figure of more than 1,000 Swiss enterprises is not used for ranking because the headcount takes precedence.

Ontinue was founded in 2023 in Zürich, spun out of a European MSSP, and delivers AI-assisted managed extended detection and response for organisations built on Microsoft security tools. Its company page lists more than 250 colleagues across Europe, North America and India, with headquarters in Zürich and Redwood City, California. Quorum Cyber's website announces that the two firms are combining. With 250-plus staff it ties with Sygnia, and the two are ordered alphabetically under the list's tie rule.

Sygnia is a cyber readiness and incident response firm with offices including New York, Singapore and London. Its about page lists more than 250 team members, among them security architects and adversarial and forensic experts, and more than 500 clients worldwide; its home page adds that it has led cyber engagements in 60 countries over 12 years. Gartner has included it in its market guide for digital forensics and incident response retainer services for four consecutive years, according to a 2025 company notice.

Cipher is the division of the Spanish security group Prosegur dedicated to digital protection. Its about page states that it has more than 200 cybersecurity professionals with a presence in five countries and more than 20 years of operation. Its services centre on extended managed detection and response, red-team testing, governance, risk and compliance and PCI-DSS work. Cipher and Unit 42 both report about 200 staff and are ordered alphabetically under the tie rule. Cipher is the only provider in this list that belongs to a physical-security group.

Unit 42 is the threat intelligence, incident response and security consulting arm of Palo Alto Networks. Its page lists more than 200 threat researchers and more than 1,000 engagements a year, and says it analyses 30 million malware samples a day. Palo Alto Networks does not report Unit 42 revenue separately. Its 200-plus figure counts researchers rather than the full consulting staff, so the unit's position here is conservative; the parent company appears in this site's product-vendor ranking.

Sophos is a security software and services company that has become one of the largest MDR providers by customer count. It states that its security operations portfolio is trusted by more than 75,000 organisations, including 35,000 Sophos MDR customers. Sophos completed its acquisition of Secureworks on 3 February 2025, when Secureworks merged into a Sophos subsidiary and left public markets, bringing Secureworks' managed detection and response business into the group. Sophos is ranked by customer count because it publishes neither services revenue nor a services headcount.

Arctic Wolf sells security operations as a service built around its Aurora platform. Its company page states that it delivers detection, response and remediation to more than 10,000 organisations worldwide and that its platform ingests and analyses more than 10 trillion security events each week. The company works with insurance and channel partners. It does not publish revenue or headcount, so it is ranked on customer count. Its customer count is the second highest published in this list, behind Sophos.

Optiv is a US cybersecurity firm that advises on, deploys and operates security programmes. Its about page says more than 6,000 clients use its services, and its home page states that it serves 73% of the Fortune 100 and that 95% of its clients are repeat clients. Its business mixes consulting and managed services with the resale and integration of security products, which distinguishes it from pure MDR providers. Optiv does not publish revenue or a services headcount.

GuidePoint Security was founded in 2011 and says it has become a trusted adviser and partner to more than 5,900 organisations of all sizes across every industry. It combines consulting, penetration testing, incident response and managed services, and runs a training programme, GuidePoint Security University, to bring new entrants into the profession. Its published customer count is close to Optiv's, and the two firms compete for similar large US accounts that buy both advice and technology. GuidePoint does not publish revenue, headcount or a SOC count, so it is ranked by organisations served.

Critical Start was founded in 2012 by three security experts who had led incident response and threat work. Its home page states that it protects more than 2,500 organisations, runs more than 600 analyst investigations a day with an average alert-to-verdict time of 13 minutes, and backs response times with contractual service levels. It supports more than 100 integrations across clients' security tools. Critical Start and Nomios both report more than 2,500 customers and are ordered alphabetically under the list's tie rule. Critical Start publishes no revenue or headcount.

Nomios Group is a European provider of security and networking services. Its about page lists 25 offices across Europe, with local experts in Belgium, France, Germany, Italy and the Netherlands among other countries, more than 2,500 customers, 24x7 global support and an average customer satisfaction score of 8.9. Its work is weighted towards integration and managed network security rather than pure MDR. It ties with Critical Start on the published customer figure and is placed second of the two alphabetically. It does not publish revenue or a security headcount.

eSentire was founded in 2001 and is based in Waterloo, Ontario. Its March 2026 release announcing the appointment of James C. Foster as chief executive states that it protects more than 2,000 organisations in over 80 countries across 35 industries, using its Atlas security operations platform. Its service combines 24/7 SOC coverage with threat hunting and incident handling. It does not publish revenue or headcount; its position rests on the customer figure in the March 2026 release. Its customer figure is the published total across all industries served.

Telefónica Tech is the digital services unit of the Spanish telecoms group Telefónica, covering cybersecurity, cloud and IT services. Its UK and Ireland managed security page cites 6,200 professionals across the whole unit, a global network of 11 security operations centres and more than 1,700 global cyber security customers, among them Santander, Lidl and Bosch. The unit does not report cybersecurity revenue separately from cloud and IT services, so it is ranked on the customer figure. Its 11 SOCs are among the larger published networks.

Avertium is a US managed security and compliance services provider. Its home page says more than 1,200 mid-market and enterprise organisations across 15 industries use its services, and lists two 24/7 Cyber Fusion Centers, more than 900,000 devices under management and more than 400 certifications. It sells assessments, security architecture and Microsoft-verified MXDR, and positions compliance and security as a single programme. It publishes no revenue or headcount, so its place depends on the customer figure, which is the second smallest in the customer tier.

Eye Security was founded in 2020 by three veterans of Dutch national security. It combines managed detection and response with incident response and cyber insurance under one operating model, and states that it is trusted by more than 1,000 European organisations. It presents its European ownership and independence as part of its offer to mid-sized businesses. Combining detection with insurance in one product is unusual among the firms in this ranking, most of which work alongside insurers rather than providing cover. It is the smallest provider by published customers that met the list's threshold of 1,000.

IBM sells cybersecurity services, including managed security services, X-Force incident response, threat intelligence and penetration testing. IBM publishes neither security services revenue nor a security headcount. Its list of security operations centre locations names four global delivery sites, in Bangalore, Wroclaw, Costa Rica and Hortolandia, and nine regional SOCs in Wroclaw, Budapest, Riyadh, Sydney, Tokyo, Madrid, Bogota, Hursley and Markham, or 12 distinct locations. That count places IBM in the final tier of this ranking, which is a consequence of its limited disclosure rather than a measure of its size.