By Uditha Atukorala, CEO of Felk

For scaling businesses chasing their next funding round, the pitch deck used to be all about growth metrics, market size and burn rate. Increasingly, though, investors are asking a different question before they sign the term sheet: how well protected is this company against a cyber attack? It’s a fair question. Government figures show that 43% of UK businesses identified a cyber security breach or attack in the past 12 months.

It’s a shift I see constantly in conversations with founders and funders alike. Cyber security has moved from being an IT afterthought to a core part of investment due diligence, and businesses that treat it as such stand out for the right reasons.

What investors are really looking for

At its heart, investors want tangible evidence of resilience rather than reassurances. That means recognised security certifications, a tested incident response plan, and clear compliance with data protection laws such as UK GDPR. They also want to see proper governance around security decisions and evidence of regular, independent testing rather than a policy document that hasn’t been touched since it was written. This isn’t a box-ticking preference: a European survey of 100 senior dealmakers found nearly seven in ten agree that a positive cyber due diligence appraisal leads directly to a higher valuation, and vice versa.

Yet many businesses aren’t there yet. Only around a quarter of UK businesses currently have a formal incident response plan in place, even though most that suffer a breach act without one. In other words, it’s not enough to say you take security seriously. You need a paper trail that proves it.

The basics every scaling business needs

Before founders worry about advanced frameworks, it’s worth getting the fundamentals right. Strong access control, disciplined patch management, ongoing employee training, regular penetration testing and a tested incident response plan form the backbone of effective cyber hygiene. These aren’t glamorous investments, but they are the ones due diligence teams check first. They also tend to be where UK businesses currently fall short: board-level ownership of cyber security sits at just 31%, even though it’s rising. Closing that gap is one of the simplest ways to prevent the kind of breach that can derail a raise entirely.

Showing, not telling, resilience

When it comes to proving resilience to potential investors, documentation is everything. Certifications, testing reports and written policies give investors something concrete to review rather than take on trust. This matters most after the deal closes: in the same European dealmaker survey, over half of respondents said a major undisclosed cyber risk only came to light during post-closing integration on their most recent transaction. Many scaling businesses find that undertaking a formal Cyber Maturity Assessment, or working towards ISO 27001 certification, gives them a structured way to demonstrate systematic risk management rather than a patchwork of good intentions, and to surface any gaps before an investor does.

Which certifications carry the most weight

Not all certifications are created equal in investors’ eyes, and the right choice depends on where your growth ambitions lie. In the UK, Cyber Essentials Plus and ISO 27001 remain the most widely recognised and trusted benchmarks, though adoption still has room to grow: government-backed research suggests roughly 23% of large UK businesses and 18% of medium-sized businesses currently hold ISO 27001, leaving plenty of headroom for scaling businesses to stand out by getting there early. For businesses with international investors or customers, SOC 2 and NIST-aligned frameworks tend to carry more weight. The smartest approach is to map your certification strategy to your sector and your fundraising trajectory, rather than chasing every badge available.

Beware the compliance shortcut

Speed matters when you’re scaling, but speed built on shortcuts can do more damage than having no certification at all. The cautionary tale here is Delve, a Y Combinator-backed compliance automation startup that marketed itself on making SOC 2, ISO 27001 and HIPAA compliance fast and cheap. In early 2026, an anonymous whistleblower accused the company of generating fabricated evidence of board meetings and internal processes, then routing it through audit firms that reportedly rubber-stamped reports without independent review. Delve disputed the characterisation, saying it provided templates rather than pre-filled evidence and that customers chose their own auditors.

Whatever the eventual resolution, the episode is a reminder to investors and founders alike: a certification is only as credible as the process behind it. A “fast and cheap” badge that hasn’t been through genuine independent testing can create more due diligence risk than having no badge at all, since it invites exactly the kind of scrutiny that surfaces gaps at the worst possible moment. When evaluating compliance partners or presenting your own credentials to investors, it’s worth asking not just “are we certified?” but “who audited this, and how rigorously?”

The insurance connection

One area founders often overlook is how good cyber hygiene feeds directly into the cost of cyber insurance. Insurers assess risk in much the same way investors do. If you can show documented controls such as multi-factor authentication, endpoint protection and a consistent patching schedule, you present as a lower-risk policyholder. Marsh’s own market data shows UK cyber insurance rates falling in recent quarters, with insurers increasingly asking for demonstrable cyber resilience, governance, tested incident response and board engagement before they price a policy. Businesses that can evidence those controls are simply better placed to negotiate lower premiums or broader coverage, which matters when every pound of overhead counts during a growth phase.

Treat your insurer’s questionnaire as a mirror of what a future investor will ask. If the answers are strong for one audience, they will be strong for the other.

The bottom line

Cyber security due diligence is no longer a box-ticking exercise tucked away in the appendix of a data room. Cybercrime already costs the UK economy an estimated £27 billion a year, with a single serious data breach costing a large organisation between £1.46 million and £3.14 million, so it’s little wonder investors treat it as a genuine signal of how well a business is run. Founders who get ahead of it, building strong hygiene, pursuing the right certifications and keeping documentation current, don’t just reduce their risk of a breach. They make themselves a more attractive, lower-risk investment, and that’s a competitive advantage worth building early.

Uditha Atukorala is the founder and CEO of Felk, a Cybersecurity as a Service (CSaaS) provider. With over a decade of experience as a CTO and open source contributor, Atukorala has led and grown cross-functional engineering teams across multiple startups. Acting as a dedicated cybersecurity function for growing businesses, Felk helps SMEs stay secure, compliant, and enterprise-ready – combining AI-powered security tools with hands-on expert guidance.