NCC Group
NCC Group is a United Kingdom-based information assurance and cyber security company providing consulting, testing, managed security, and related digital-risk services.
Last updated August 26, 2026
AI crawler reads
No AI crawler has read this profile since Oct 28, 2026.
Overview
NCC Group is an information assurance and cyber security company headquartered in Manchester, United Kingdom. Its business has historically combined professional cyber security services with managed security capabilities and digital trust services. The group works with organizations that need to identify vulnerabilities, protect critical systems, respond to cyber incidents, meet regulatory or assurance requirements, and manage risks associated with software, infrastructure, data, and online operations. The company originated in 1999 when the National Computing Centre sold its commercial divisions to the existing management team with backing from private equity firm ECI Ventures. The resulting business was initially called NCC Services Ltd and adopted the NCC Group name in May 2000. Its early development included an escrow division, alongside the broader information-assurance activities that later became central to the group. Rob Cotton joined as finance director in 2000, assumed responsibility for the escrow operation, and in 2003 led a secondary management buyout that valued the company at £30 million and was backed by Barclays Private Equity. NCC Group became a publicly traded company when it was admitted to the London Stock Exchange's AIM market in July 2004. The flotation raised £38.1 million before expenses. Following further expansion, the company transferred to the London Stock Exchange's main market in July 2007. Its growth strategy combined internal development with acquisitions and international expansion, helping it build a portfolio spanning cyber security consulting, penetration testing, software and hardware assurance, managed security, incident response, and digital trust-related services. The group has also pursued initiatives beyond conventional consulting. In 2012 it announced a planned investment in Artemis Internet to apply for and develop the .secure generic top-level domain. That application was later abandoned, while in 2014 NCC Group acquired the right to operate the .trust generic top-level domain from Deutsche Post. These activities reflected the company's interest in online identity, trust, and internet infrastructure, although they were distinct from its core cyber security consulting operations. NCC Group has claimed a client base of more than 15,000 organizations worldwide. Its customers have included businesses and institutions with substantial requirements for security testing, compliance, resilience, and technology assurance. The company has also been associated with CREST, the cyber security certification body, as a founding member. In 2020, leaked NCC Group training materials relating to CREST practical examinations led to the suspension of those examinations and an independent investigation announced by CREST. The episode raised concerns about examination integrity and the handling of sensitive training content. The business has historically included the Escode software escrow and digital continuity operation. According to the supplied reference material, NCC Group completed the sale of Escode to TDR Capital in May 2026. The transaction represents a strategic separation of that business from the group's cyber security-focused activities, although the precise post-transaction corporate structure and operating scope require confirmation from current company disclosures. NCC Group remains best understood as a specialist cyber security and information assurance brand rather than a mass-market technology company.
History
NCC Group was formed in June 1999 after the National Computing Centre sold its commercial divisions to the existing management team with support from private equity firm ECI Ventures. The new company was incorporated as NCC Services Ltd. It was renamed NCC Group Ltd in May 2000, establishing the corporate identity under which the business would develop its information assurance and technology-risk activities. In 2000, Rob Cotton joined the company as finance director. He subsequently took responsibility for the group's escrow division, an operation concerned with protecting customers' access to software source code and other critical materials if a supplier could no longer support them. Cotton led a secondary management buyout in 2003. The transaction valued NCC Group at £30 million and received backing from Barclays Private Equity. His leadership coincided with a period in which the company expanded its service portfolio and pursued a more ambitious growth strategy. NCC Group entered the public markets on 12 July 2004, when its shares were admitted to trading on the London Stock Exchange's AIM market. The flotation raised £38.1 million before expenses. The listing provided capital and a public profile that supported subsequent expansion. In July 2007, after rapid growth, NCC Group moved from AIM to the London Stock Exchange's main market. The company later became associated with the FTSE 250 Index. The group's development combined organic growth with acquisitions. Its activities broadened from escrow and traditional information assurance into cyber security consulting, penetration testing, security assessment, managed security, incident response, software and hardware assurance, and digital trust. This combination enabled NCC Group to address both preventative security needs and the operational consequences of cyber incidents. The company positioned itself as an independent specialist serving enterprises and other organizations with complex technology environments. NCC Group also explored the relationship between cyber security and internet infrastructure. In 2012 it announced that its wholly owned subsidiary Artemis Internet would invest £6 million over 15 months in an application for the .secure generic top-level domain and in the development of a related security program. The application was subsequently abandoned, and the .secure domain was assigned to another applicant. In 2014, NCC Group acquired the right to operate the .trust generic top-level domain from Deutsche Post. These initiatives extended the group's interests into domain governance and online trust, although they did not replace its main consulting and managed-security businesses. The company has been connected with CREST, a cyber security certification body, as a founding member. In August 2020, training materials from NCC Group relating to the CREST CCT INF and CCT APP practical examinations were leaked to GitHub and Dropbox. The materials reportedly included descriptions of internal training procedures, cloned examination environments, and detailed examination walkthroughs. Because the leak threatened the integrity of the certification process, CREST suspended practical examinations and said it would appoint an independent investigative panel. The incident became a significant reputational and governance issue associated with NCC Group's role in the cyber security professional ecosystem. The group's portfolio has also included Escode, a software escrow and digital continuity business. The supplied reference material states that NCC Group completed the sale of Escode to TDR Capital in May 2026. This divestment indicates a move toward a more concentrated cyber security and information assurance profile, but the precise implications for the remaining group require confirmation from current corporate disclosures. Overall, NCC Group's history is characterized by private-equity-backed formation, public-market expansion, acquisition-led broadening of services, participation in internet trust infrastructure, and increasing concentration on enterprise cyber security.
- 2026
Sale of Escode
[1]The supplied reference material states that NCC Group completed the sale of Escode to TDR Capital in May 2026.
- 2020
CREST examination-material leak
[1]Leaked NCC Group training materials contributed to the suspension of affected CREST practical examinations and an announced independent investigation.
- 2014
Acquisition of .trust operating rights
[1]NCC Group acquired the right to operate the .trust generic top-level domain from Deutsche Post.
- 2012
Planned .secure domain initiative
[1]NCC Group announced an investment by Artemis Internet to apply for and develop the .secure generic top-level domain.
- 2007
Move to the London Stock Exchange main market
[1]The company transferred from AIM to the main market following rapid expansion.
- 2004
AIM flotation
[1]NCC Group was admitted to trading on AIM and raised £38.1 million before expenses.
- 2003
Secondary management buyout
[1]Rob Cotton led a secondary management buyout valuing the group at £30 million, with support from Barclays Private Equity.
- 2000
The company adopted the NCC Group name
[1]NCC Services Ltd was renamed NCC Group Ltd.
- 1999
NCC Services Ltd was formed
[1]The National Computing Centre sold its commercial divisions to management backed by ECI Ventures, creating the company that became NCC Group.
Products and positioning
A specialist, enterprise-focused cyber security and information assurance provider serving organizations that require independent testing, managed protection, incident response, technology assurance, and digital trust services.
Professional services
Cyber security consulting
NCC Group's consulting activities help organizations assess cyber risk, design security strategies, improve governance, and address technical or regulatory requirements. The work is aimed primarily at enterprise and institutional customers with complex environments, rather than consumers seeking packaged security software.
Cyber security services
Penetration testing and security assessment
These services examine applications, networks, infrastructure, devices, and other technology assets for exploitable weaknesses. The resulting findings can be used to prioritize remediation, validate controls, and support assurance or compliance programs.
Managed services
Managed security services
Managed security offerings provide continuing operational support for monitoring, detection, response, and security management. They are intended for organizations that need external expertise and ongoing coverage in addition to one-off assessments.
Cyber security services
Incident response and cyber resilience
NCC Group supports organizations dealing with suspected or confirmed cyber incidents and with broader resilience planning. Such work can include investigation, containment, recovery support, preparedness, and exercises designed to improve organizational response.
Technology assurance
Software and hardware assurance
Assurance services assess the security and reliability of software, hardware, and technology products. They can support product development, procurement, certification, and confidence in systems used in sensitive or regulated environments.
Software escrow and digital continuity
Escode
Escode was the group's software escrow and digital continuity business, protecting customer access to software source code and related assets when a supplier becomes unable to maintain or provide them. The supplied reference material states that NCC Group sold the business to TDR Capital in May 2026.
Generic top-level domain · 2014
.trust
NCC Group acquired the right to operate the .trust generic top-level domain from Deutsche Post in 2014. The initiative connected the company with internet identity, domain governance, and online trust services.
Controversies
2020
Leak of CREST examination training materials
Training materials associated with NCC Group's preparation for CREST CCT INF and CCT APP practical examinations were leaked to GitHub and Dropbox. The materials reportedly described internal training procedures and provided detailed examination walkthroughs. CREST suspended practical examinations because the leak threatened examination integrity and announced plans for an independent investigative panel.
Brand decisions
2026
Sale of Escode to TDR CapitalM&ABackground
NCC Group historically operated both cyber security activities and the Escode software escrow and digital continuity business.
Action taken
The supplied reference material states that NCC Group completed the sale of Escode to TDR Capital in May 2026.
Aftermath
The sale appears to narrow the group's portfolio toward cyber security and information assurance, but the post-transaction structure requires confirmation from current company disclosures.
2014
Acquisition of .trust operating rightsM&ABackground
The group continued exploring online trust and domain infrastructure after its .secure application was abandoned.
Action taken
NCC Group acquired the right to operate the .trust generic top-level domain from Deutsche Post.
Aftermath
The transaction expanded NCC Group's activities into domain-based digital trust, although current operating status requires confirmation.
2012
Proposed .secure generic top-level domainProduct launchBackground
NCC Group sought to extend its cyber security and trust positioning into internet naming infrastructure.
Action taken
Through Artemis Internet, the group announced a planned £6 million investment over 15 months to apply for and develop .secure and an associated security program.
Aftermath
The application was later abandoned and .secure was assigned to another applicant.
2004
Public flotation on AIMStrategyBackground
NCC Group had expanded after its formation and management buyout and sought public-market capital.
Action taken
The company was admitted to trading on AIM and raised £38.1 million before expenses.
Aftermath
The flotation supported the company's subsequent expansion and preceded its move to the main market in 2007.
Funds raised before expenses. £38.1 million (12 July 2004)
Recent events
OpenAI launches GPT 5.6 Cyber model for security partners[2]
Reported:
OpenAI developed a new model called GPT 5.6 Cyber for vulnerability research, penetration testing and incident response, available only to selected companies and security vendors through the Daybreak Cyber Partner program.
NCC Group launches Partner Network[3]
Reported:
NCC Group launched a Partner Network in the UK for its software resilience offering. The network enables software vendor partners to recommend or resell NCC Group services alongside their existing offerings.
NCC Group partners with SBRC to support SME cyber helpline[4]
Reported:
NCC Group is supporting a cyber incident response helpline for Scottish SMEs and third-sector organisations in partnership with the Scottish Business Resilience Centre. NCC Group provides pro-bono incident-response support through the partnership.
Sources4 sources
Cite this profile: Cite the canonical profile. /brand-wiki/ncc-group · Editorial policy · How profiles are compiled