Cyber in the West Midlands is no longer just a business activity, it’s a cluster. With the right action, it can become a strategic economic engine. This review critiques the Midlands Engine Cyber & Defence Report (April 2025) and sets out a ten-point plan to make that transformation real. The opportunity is clear. The data is in. Now we must deliver.

Executive Summary

This article offers a critical analysis of the Midlands Engine Cyber & Defence Cluster Report (April 2025) and proposes a focused, actionable response: a regional cyber strategy grounded in delivery, not just diagnosis.

While the report recognises the Midlands as the UK’s largest cyber cluster outside the South East, with over 600 firms and £12bn in turnover, it stops short of treating cyber as a standalone economic cluster. This review argues that the time for that recognition is now.

To catalyse the region’s potential, I propose the following ten-point plan, grounded in three enabling principles: coherence (strategic alignment and joined-up delivery), visibility (regional signalling, storytelling, and asset promotion), and standards (benchmarking, credibility, and national interoperability).

1. Formally recognise cyber as a standalone economic cluster in regional strategy, investment plans, and language, distinct from but complementary to defence and digital sectors.
2. Establish a unified cluster governance model, with a regional lead body and steering board to coordinate Midlands Cyber, WM CWG, TCRDSC, EMCSC, and WMCRC.
3. Foster the regional cyber community through regular networking, innovation sprints, and inclusive peer collaboration.
4. Increase inbound investment by developing a regional cyber investment proposition and aligning with innovation zones and investor roadshows.
5. Create a dedicated home for cyber, modelled on Hub8 Cheltenham and DiSH Manchester, to convene academia, industry, and the public sector in one visible, physical hub.
6. Launch a two-day cyber festival as a flagship moment for national and international promotion, innovation showcases, and ecosystem connection.
7. Rebuild the regional narrative, reframing cyber as a commercial, sovereign, and ESG-enabling force, not merely a technical subdomain.
8. Reform funding access and SME engagement, including a regional funding concierge and better visibility of defence and dual-use innovation pathways.
9. Enhance talent strategy, with expanded apprenticeships, mid-career support, graduate retention, and practical onboarding programmes developed with universities.
10. Develop a West Midlands Cyber Resilience Benchmarking Index, working with NCSC and UK Cyber Security Council to drive maturity, visibility, and recognition.

The Midlands does not need more frameworks, it needs coordination, coherence, and delivery. Cyber is already a business cluster. With the right interventions, it will become an economic one. The data supports this. The institutions are in place. The leadership must now follow.

Contents

Summary of the Report

The Cyber & Defence in the Midlands report (available in PDF), commissioned by Midlands Engine, outlines the strengths, challenges, and strategic potential of the Midlands as a national hub for cyber and defence innovation. With over 600 cyber and defence firms, a GVA exceeding £5bn, and a workforce of 54,000, the Midlands is identified as the UK’s largest cyber cluster outside the South East. The report is a comprehensive mapping of the regional ecosystem, from business parks and supply chains to talent pipelines and investment bottlenecks.

The work builds upon contributions from over 50 stakeholders across academia, industry, and government, and aims to inform future policy and investment aligned with national priorities in cyber resilience, sovereign capability, and defence innovation.

Key Data Points and Findings

• Economic Value: £12bn turnover in the cyber and defence sector; £5bn+ GVA; 112 new cyber firms formed in 2024.
• Employment: 13,000 cybersecurity professionals and 34,850 defence personnel in the region.
• Workforce Growth: The UK cyber workforce grew by 11% in the past year; the Midlands contributes 12% of the national defence/security workforce.
• Innovation Assets: 59 research centres and programmes across universities; major centres like MIRA Technology Park, Malvern Hills Science Park, and the UK Telecoms Lab.
• International Attractiveness: Over 100 foreign-owned businesses in the region employ 19,000 people.
• Cyber Incidents: 4 million UK cyber-attacks in 2024, of which 400,000 were successful.

Key Recommendations and Strategic Asks

1. Professionalisation of Cyber Roles:
   • Promote uptake of UK Cyber Security Council certifications.
   • Expand use of Cyber Essentials and related schemes across supply chains.
2. Secure and Expand Funding:
   • Streamline access to public and private funding (e.g., DASA, DIANA).
   • Provide clearer routes for SME engagement in defence markets.
3. Talent Pipeline and Workforce Development:
   • Introduce flexible apprenticeship models and mid-career transition pathways.
   • Address gaps in engineering-focused cyber education and retention issues.
4. Raise the Region’s Global Profile:
   • Connect clusters (Midlands Cyber, WMCRC, TCRDSC) under a unified concierge service.
   • Promote dual-use potential in automotive, aerospace, and medical sectors.
5. Address Perception and ESG Barriers:
   • Combat negative narratives around defence innovation.
   • Engage with the ethical investment community to reframe the defence sector’s role in national resilience.

Critical Analysis

Strengths of the Report

• Holistic Scope: The report successfully merges economic data, technological trends, education pipelines, and policy frameworks into a single coherent narrative.
• Asset Mapping: It identifies and contextualises key players, from SCC, BAE, and Rolls Royce to newer entrants like Goldilock, with detailed descriptions of their roles.
• Dual Use Emphasis: By stressing crossover potential with automotive, healthcare, and AI sectors, the report aligns with global trends in defence commercialisation.
• Policy Awareness: It integrates recent legislative shifts like the Cyber Security and Resilience Bill (2024) and funding schemes such as DIANA (€1bn) and MOD innovation loans.

Gaps and Critique

1. Limited Economic Detail:
   • GVA and turnover are reported, but without disaggregated metrics (e.g., by sub-sector or growth trajectory), it’s hard to benchmark progress or model ROI.
2. Lack of Comparative Analysis:
   • There’s no rigorous comparison with competing UK clusters (e.g. South West, Scotland) or EU/NATO peer regions. This weakens arguments for inward investment prioritisation.
3. ESG and Investor Reluctance:
   • While it highlights ESG-related barriers to defence funding, the report stops short of offering actionable mitigations or stakeholder engagement models to resolve this.
4. Fragmented Cluster Strategy:
   • The report calls for “a connected ecosystem” but doesn’t propose a governance model or delivery framework to unify disparate cluster organisations.
5. Overlooked Metrics:
   • Little is said about:
     • Exit routes for cyber scale-ups (e.g. IPOs, trade sales),
     • Internal cyber risk benchmarking across SMEs,
     • Real-time cyber threat data or resilience benchmarks by sector.
6. Graduate Retention Challenge Underexplored:
   • The Midlands’ difficulty in retaining computing graduates is noted, but not contextualised against cost of living, lifestyle incentives, or emerging digital hubs outside London.

Strategic Implications

The West Midlands is well-positioned to lead the UK’s sovereign cyber and defence innovation strategy, but success will require clarity of governance, proactive perception management, and a rebalanced investment narrative. It is not enough to boast strong assets; what’s needed is a joined-up execution framework, one that unites supply chain readiness, standards compliance, and global investor confidence under a clearly branded West Midlands cyber-defence identity.

Future reports should also consider developing:

• A Cyber Resilience Maturity Index for West Midlands-based SMBs/SMEs and beyond.
• A Heatmap of Dual Use Opportunities, broken down by TRL (Technology Readiness Level).
• A Governance Blueprint for unified cluster management and investor engagement.

Taken together, these gaps illustrate the difference between recognising cyber’s potential and activating it through coherent execution.

From Strategy to Action: Elevating Cyber to Cluster Status in the West Midlands

In February 2025, I wrote a piece titled Cyber, Digital, and Tech: Understanding the West Midlands Perspective, arguing that the West Midlands continues to frame cyber as a subcategory of digital, itself a subset of tech. This nested framing has constrained how regional policy and investment treat cyber, limiting its scope, voice, and resources. But the Midlands Engine report reviewed here adds new momentum to the call for a shift in thinking. The evidence is no longer anecdotal or speculative; the data now supports what many of us have observed on the ground: Cyber in the Midlands is already a business cluster and is rapidly maturing into a full economic cluster.

Reframing Cyber: From Technology to Cluster

This distinction matters. A technology is a tool or enabler (AI, quantum, 5G). A sector is a classification (manufacturing, finance, creative). A cluster, however, is an ecosystem: a geographically anchored network of companies, research institutions, skills providers, and investors that drive mutual growth and competitive advantage. Clusters generate disproportionate economic value, not simply because of what they do, but because of how interconnected and self-reinforcing they are.

The Midlands Engine report explicitly positions cyber not just as an adjunct to defence or an offshoot of digital infrastructure, but as a domain with its own innovation networks, skills base, SME ecosystem, international investment, and economic output. The presence of multiple innovation assets (UK Telecoms Lab, Malvern Hills Science Park, MIRA, et cetera), world-class research institutions, and leading employers supports this. So too does the economic data: over £12bn turnover, 600+ cyber-linked companies, and significant inward investment, including high-profile defence applications and dual-use technologies.

Operationalising the Opportunity: WM CWG’s Four-Point Plan

To accelerate this momentum, we must move from strategic insight to operational delivery. That means delivering against the four founding goals of the West Midlands Cyber Working Group (WM CWG):

1. Fostering the Cyber Community – The region is rich in talent, institutions, and passion, but this energy must be connected. We need safe, regular, and neutral spaces, both physical and digital, for collaboration, trust-building, and peer support. This includes better visibility of opportunities and shared resources between clusters.
2. Increasing Inbound Investment – For cyber in the Midlands to grow, it must be seen by investors as more than just an add-on to tech or manufacturing. A dedicated regional investment narrative, backed by data and articulated by industry leaders, is essential. Investment zones, scale-up support, and international delegations should be aligned with this ambition.
3. Creating a Home for Cyber – Like Hub8 in Cheltenham and DiSH in Manchester, the West Midlands needs its own dedicated cyber hub: a place where startups, corporates, academia, and government co-locate, share insights, and build momentum. This is more than real estate, it’s about identity and visibility.
4. Launching a Two-Day Cyber Festival – Asserting our voice nationally and internationally requires moments that cut through. A dedicated cyber festival in the Midlands would attract investors, showcase innovation, connect clusters, and reposition the region as a serious contender in the national cyber landscape.

These are not vanity projects. They are essential infrastructural steps toward repositioning the Midlands not just as a participant in the UK’s cyber economy, but as a strategic engine of its growth. The Midlands Engine report gives us the strongest justification yet that cyber is not merely a subset of defence or advanced manufacturing, it is a standalone cluster. Today, perhaps a business cluster; tomorrow, with the right support, a fully-fledged economic cluster.

We now have the data, the opportunity, and the imperative. What we need next is simple: action. The WM CWG’s strategic aims now offer a practical foundation on which to build. Here’s how that could be delivered regionally.

Recommendations for Strengthening Cyber as a West Midlands Growth Engine

This ten-point plan is underpinned by three enabling principles coherence, visibility, and standards, each of which surfaces repeatedly across governance, talent, funding, and community initiatives.

• Coherence refers to aligning regional efforts under a unified strategy and governance structure to reduce fragmentation and duplication.
• Visibility is about showcasing the region’s strengths, assets, and progress, both to internal stakeholders and external investors or policy bodies.
• Standards ensure that regional efforts are credible, benchmarked, and interoperable with national frameworks such as those from NCSC, DSIT, and the UK Cyber Security Council.

Building on the Midlands Engine’s April 2025 report, the plan draws together three critical inputs:

• The report’s strategic recommendations.
• A critical analysis of the gaps and challenges within the report.
• The four operational goals defined by the West Midlands Cyber Working Group (WM CWG).

Together, these inputs form a practical blueprint to elevate cyber in the region, from a business activity to a fully recognised and supported economic cluster.

1. Formally Recognise Cyber as a Standalone Economic Cluster

• Move beyond framing cyber as a subset of digital or defence.
• Embed this in regional strategy documents (e.g. Combined Authority growth plans, investment zones).
• Use terminology consistently, cyber is a business cluster with clear potential to evolve into an economic cluster with the right investment and coordination.

2. Establish a Unified Cluster Governance Model

• Appoint a regional Cyber Cluster Lead Body to coordinate delivery, investment, and strategic alignment, and to act as regional convener.
• Ensure it is led by a practitioner with credible industry, start-up, and cyber expertise to anchor the strategy in lived experience, operational realism, and technical legitimacy.
• Create a formal structure to link the various clusters (Midlands Cyber, WM CWG, TCRDSC, EMCSC, WMCRC) into one ecosystem with defined roles.
• Include industry, academia, government, and investment partners in a regional steering board.
• Work with DSIT to align regional cyber strategy with national policy frameworks and funding opportunities, ensuring West Midlands initiatives are plugged into UK-wide infrastructure, innovation missions, and resilience goals.

3. Foster the Regional Cyber Community

• Fund regular cross-cluster networking, innovation sprints, and collaborative forums.
• Encourage knowledge-sharing between academia, industry, and public-sector stakeholders.
• Support grassroots and underrepresented groups to ensure the community is inclusive and regionally representative.

4. Increase Inbound Investment into West Midlands Cyber

• Establish a West Midlands Cyber Investment Proposition, clearly articulating the region’s commercial and strategic strengths.
• Map cyber assets, clusters, and success stories to promote the region to investors and national programmes.
• Leverage innovation zones, scale-up support, and international delegations to attract and convert investment.

5. Create a Home for Cyber in the Region

• Back a physical cyber hub in the West Midlands, replicating the success of Hub8 (Cheltenham) and DiSH (Manchester).
• Ensure it provides co-working, event, and incubator space for startups, corporates, academia, and the public sector.
• Use it as a platform for convening talent, delivering training, and showcasing regional capability.

6. Launch a Two-Day Cyber Festival for the West Midlands

• Develop a flagship event to showcase regional talent, attract national attention, and foster collaboration.
• Include policy, skills, innovation, and commercial tracks to engage stakeholders across sectors.
• Use it to connect clusters, secure investment, and signal the region’s ambition on a national and international stage.

7. Rebuild the Regional Narrative and Perception

• Shift the regional identity from “digital with cyber inside” to “Cyber-led, digitally-enabled, and commercially grounded.”
• Counter ESG investment concerns through a reframed story: cyber enables safety, sovereignty, and innovation, core ESG values.
• Work with local media, education, and public bodies to champion cyber as a source of opportunity, not controversy.

8. Reform Funding Access and SME Engagement

• Create a regional funding concierge to support SMEs in navigating defence, DSIT, Innovate UK, DASA, and NATO DIANA opportunities.
• Advocate for defence-inclusive eligibility across innovation programmes like CyberASAP, especially for dual-use technologies.
• Promote open procurement pipelines from primes to Tier 3 suppliers, especially for cyber-related capabilities.

9. Enhance Talent Strategy with a Focus on Retention and Transitions

• Expand cyber apprenticeships and secure-by-design engineering pathways.
• Support mid-career transitions for professionals entering cyber from adjacent sectors.
• Improve graduate retention by promoting regional career pathways, cost-of-living advantages, and leadership opportunities.
• Tackle the experience gap by encouraging employers to take on early-career talent, backed by onboarding programmes co-developed with local universities.
• Use the West Midlands Cyber Hub to connect employers, graduates, and training providers, creating shared spaces for collaboration, onboarding, and real-world skills development.
• Embed UK Cyber Security Council certifications into local talent development, apprenticeships, and transition pathways to ensure national standards are upheld.
• Collaborate with DSIT and the UK Cyber Security Council to align regional programmes with evolving national standards for cybersecurity roles and professionalisation.

10. Develop a West Midlands Cyber Resilience Benchmarking Index

• Encourage supply chain visibility and improvement by publishing anonymous benchmarking (e.g., Cyber Essentials adoption, breach exposure, phishing vulnerability).
• Offer incentives or recognition schemes for SMEs achieving cyber maturity milestones.
• Collaborate with NCSC to ensure regional benchmarking, threat intelligence, and supply chain resilience efforts align with national cyber threat modelling and incident response frameworks.

Conclusion

The April 2025 Midlands Engine report offers a rich, multifaceted account of the region’s strengths and challenges in cyber and defence innovation. Crucially, it provides the clearest signal yet that cyber is not merely a subset of digital or defence, it is a business cluster in its own right, and rapidly maturing into an economic cluster. This reframing is not just semantic, it unlocks new strategic thinking, investment logic, and policy pathways for the region.

But this potential will not be realised by itself. The Midlands must move swiftly from analysis to action. A regional implementation plan, co-designed by industry, academia, and public-sector partners, is now essential. It must deliver against four clear aims: build community, attract funding, create a visible home for cyber, and amplify the region through a flagship festival.

With alignment, ambition, and agility, the West Midlands can become the UK’s definitive cyber cluster, a powerhouse of resilience, innovation, and economic value. The data is in. The groundwork is laid. Now it’s time to lead, to build something the region can own.