"Software house" gets 480 searches a month in the UK. "System integrator" 1,000, "managed service provider" 1,300, "managed it services" 2,400. In the same month "Odoo" gets 12,100, "Cyber Essentials" 9,900, "SIEM" 5,400 and "penetration testing" 6,600, at £95.64 per click (DataForSEO data, Google Ads United Kingdom, October 2026).
People don't search for an IT company by what it is, but by the technology it installs and the problem the customer has to solve by a deadline. A site organised by category ("about us", "services", "solutions") competes for the 1,300 searches for "managed service provider". A site with a page for every technology and every compliance requirement competes for the other tens of thousands.
This piece is about software developers, system integrators and MSPs that sell to other businesses. If you sell your own software product, see the article on SEO for startups and SaaS; the general method for business-to-business is in the guide to B2B SEO strategy. Below: the volumes that matter, what the first page of "software company manchester" looks like, where vendors win, and why Cyber Essentials and the new cyber bill are the keywords of the year for managed security.
Hardly anyone searches for a system integrator
The words the sector uses to describe itself have small volumes. The words customers use to describe what they need have volumes ten to a hundred times bigger. The table lines them up.
| Keyword | Monthly searches | CPC (£) | August 2026 |
|---|---|---|---|
| cyber security | 49,500 | 12.52 | 33,100 |
| crm | 33,100 | 42.15 | 27,100 |
| erp | 18,100 | 34.14 | 12,100 |
| odoo | 12,100 | 7.78 | 9,900 |
| it support | 9,900 | 33.33 | 3,600 |
| cyber essentials | 9,900 | 21.12 | 8,100 |
| ransomware | 8,100 | 34.03 | 3,600 |
| penetration testing | 6,600 | 95.64 | 3,600 |
| siem | 5,400 | 54.66 | 4,400 |
| managed it services | 2,400 | 50.84 | 1,000 |
| nis2 | 1,900 | 7.20 | 1,600 |
| software development company | 1,600 | 47.00 | 720 |
| managed service provider | 1,300 | 31.96 | 720 |
| system integrator | 1,000 | 30.49 | 590 |
| sap business one | 1,000 | 16.36 | 590 |
| disaster recovery | 880 | 4.99 | 320 |
| microsoft partner | 720 | 17.31 | 480 |
| software house | 480 | 8.96 | 210 |
| vulnerability assessment | 260 | 35.51 | 110 |
| odoo partner | 140 | 24.76 | 90 |
Two things stand out. First, the highest costs per click aren't on the category words but on security and managed IT: £95.64 for "penetration testing", £54.66 for "siem", £50.84 for "managed it services". Anyone buying "penetration testing" on Google Ads pays almost £100 for each visit. A page that ranks organically gets the same traffic without paying per click (the maths is in our guide to cost per click). "IT support" is the exception that proves the rule: it's a category, but it's the customer's word, not the sector's, and it gets 9,900 searches.
The second is the last column. In August many of these searches fall to between half and a third of their average: "it support" from 9,900 to 3,600, "penetration testing" from 6,600 to 3,600, "system integrator" from 1,000 to 590. September is the strongest month: "it support" reached 22,200 in September 2025, "penetration testing" 12,100. New pages should be ready before September, and the busy months run from September to March.
For an IT company, keyword research therefore starts from the list of vendors it partners with and the requirements its customers have to meet. "Odoo partner" gets 140 searches a month, "odoo pricing" 260, "odoo uk" 90: three different pages for an Odoo integrator, each with a clear intent.
The first page of "software company manchester" takes a handful of reviews
"Software company manchester" gets 170 searches a month at £7.37 per click. At the top, searched from Manchester on 10 October 2026, there's a local pack with three listings: Epos System Software rated 5.0 with 21 reviews, VTS Software Ltd with 4.2 and 5, Digiryte with 4.8 and 25. Five reviews are enough. In the same city, for "builders", the three firms in the map have 17, 54 and 101.
Below the pack come the organic results: Software Development UK with a Manchester page, then a run of lists and directories. Edvido with "Software Development Companies in Manchester (2026)", Growth Business with "12 of the most exciting tech companies in Manchester" (from 2023), RevenueBase with a ranking of 59 custom software firms, Built In Manchester twice, and Clutch. Only two IT firms have their own page there: Greystone, an IT consultancy with a software solutions page, and BCN, a managed IT provider. Google's related searches ("jobs", "hiring", "careers") show that many people searching this phrase are looking for work, not for a supplier.
The interesting detail is the weight of the lists. Six of the nine organic results are directories or rankings, and the Clutch snippet names local firms directly: Nimble Approach, PlutoSec Cybersecurity, Indiespring, ACS, WireApps. "Best software companies in Manchester" lists carry weight, and getting included in the ones that already rank is far more targeted link building than any guest post campaign.
The practical lesson: local search in IT is thinly contested. A well-kept Google profile (category "Software company" or "Computer support and services", services listed, a few genuine client reviews) and a home page with the city and the service in the title are enough to get in. We explain how to set up the profile in our guide to Google Business Profile.
Vendors win on definitions, not on costs
The first page for "penetration testing" is almost all multinationals and training sites: CrowdStrike, SentinelOne, TryHackMe twice, EC-Council, VikingCloud, GeeksforGeeks and a UK Government Security page. The only UK managed services firm is Six Degrees, with a blog post. At the top an AI Overview answers the definition and cites Trend Micro, Arctic Wolf, Evalian and Akamai, with a pointer to the National Cyber Security Centre.
Writing yet another "what is penetration testing" is wasted time: Google already gives the answer, and below it sit CrowdStrike and SentinelOne. The cost question is a different story. "Penetration testing cost" gets 170 searches a month at £97.87 a click, and its first page belongs to UK specialists who put a number in the snippet: SECFORCE (a fair day rate of £1,200), Jumpsec (£3,000 to £10,000 for small and medium businesses), Evalian (£600 to over £3,000 a day), Precursor Security ("From £2500" in the title). None of them is a multinational. A security firm that publishes price ranges by type of test (external, application, internal), days of work and what the report contains has a page that CrowdStrike can't write.
The same goes for development. "App development cost" gets 480 searches a month at £16.28 a click, "how much does it cost to build an app" another 170. A software developer that puts three typical projects online with cost ranges and timelines is more useful than any "bespoke app development" page built on adjectives. It's also the content AI Overviews are most willing to cite, because it contains numbers that aren't available elsewhere: the AI Overview for "penetration testing cost" quotes SECFORCE, Jumpsec and Precursor almost word for word.
Recommended reading: our article on SEO for manufacturing companies applies the same reasoning to firms that sell machinery: pages by application and by technical problem, not by product category.
Cyber Essentials and the new cyber bill are the keywords of the year for managed security
"Cyber Essentials" gets 9,900 searches a month, "cyber essentials certification" 3,600 and "cyber essentials plus" another 3,600. "Cyber security and resilience bill" gets 1,900, with a peak of 4,400 in November 2025, the month it was introduced. "NIS2" still gets 1,900 searches in the UK, but it's an EU directive and doesn't apply here directly. The UK equivalent is the Cyber Security and Resilience (Network and Information Systems) Bill, which amends the NIS Regulations 2018 and was at report stage in the House of Lords in October 2026. According to the government factsheet on managed service providers, medium and large MSPs come into scope directly, with the Information Commission as regulator, while small and micro firms are excluded but can still be designated as critical suppliers. An MSP can therefore be caught by the law twice: as a regulated provider and as a supplier to regulated customers.
The first page for "cyber security and resilience bill" belongs to official sources and large firms: the Parliament bill page, PwC, GOV.UK, the ICO, Taylor Wessing, Travers Smith, CGI and the NCSC. No MSP is there yet. On "cyber essentials", though, the fourth organic result, after the NCSC, IASME and GOV.UK, is ID Cyber Solutions, a small certification body, with its Cyber Essentials Plus page. The domain cyberessentials.online ranks for just 58 UK keywords with about 2,070 estimated organic visits a month: small-firm numbers, not a multinational's.
That means even on a 9,900-search keyword a small UK firm in the sector can be on page one, if it writes the practical page that official sources don't. Google lines up the questions to cover: "What are the 5 Cyber Essentials?", "Is Cyber Essentials any good?", "Who runs Cyber Essentials?" and, for the bill, "What is the current status of the Cyber Security and Resilience Bill in Parliament?". For the bill there's an open gap: no MSP has yet written the guide on who's in scope. One condition: on legislation with penalties, every claim must link to the text of the bill or to the government and NCSC pages. An error on who is in scope costs more than a lost ranking.
From those information pages the step to an enquiry is short: a downloadable checklist, a 30-minute readiness call, a "check whether you're in scope" form. That's where SEO becomes lead generation, and where you measure whether the content has worked.
Frequently asked questions
Yes, as long as you work on your customers' words rather than the sector's. "Managed service provider" gets 1,300 searches a month in the UK, "Cyber Essentials" 9,900 and "Odoo" 12,100. Pages by technology, vendor and compliance requirement bring in enquiries; category pages rarely do.
Few. On "software company manchester" the three listings in the local pack had 21, 5 and 25 reviews, rated between 4.2 and 5.0. A complete profile with the right category and services listed matters more.
Usually not. On "penetration testing" the definition comes from the AI Overview, CrowdStrike and SentinelOne. Pages on costs, timings and real cases do better: on "penetration testing cost" the first page belongs to UK specialists that publish prices.
Before September. In August B2B IT searches drop to between half and a third of their average: "it support" falls from 9,900 to 3,600 a month, "penetration testing" from 6,600 to 3,600. September is the peak, and the busy months run from September to March.
Yes. According to the government factsheet, the bill brings medium and large managed service providers into the scope of the NIS Regulations, and "cyber security and resilience bill" gets 1,900 searches a month. Precision is essential: every claim should link to the bill or to the GOV.UK and NCSC pages, and the bill was still going through Parliament in October 2026.
Where to start
Open the "partners" or "technologies" page on your site and write down the vendors listed: Microsoft, Odoo, SAP, Fortinet, the ones you really work with. Then, for each one, search Google for "[vendor] partner" followed by your city and see whether a page of yours dedicated to that vendor comes up. If only the home page comes up, or nothing at all, you have the list of the first pages to write.
If you'd like to turn the list into a plan with priorities and a calendar, get in touch: we'll start from there. Or see how we work on SEO.
