Public innovation funding can help companies cross difficult early-stage gaps, but funding mechanisms can also distort incentives. Could outcome-based commissioning provide a stronger route to cyber-sector growth?
Contents
- Contents
- Beyond Grants: Building a Stronger Investment Market for West Midlands Cyber
- Key Takeaways
- Public Funding Solves a Real Problem
- The UK Cyber Sector Is Growing While Investment Is Tightening
- The Sector’s Structure Shows Why Different Companies Need Different Capital
- A Grant Can Validate Technology Without Validating a Market
- Procurement Is Part of the Investment Infrastructure
- Industrial Cyber Creates a Particularly Strong Validation Opportunity
- The Missing Middle Is a Progression Problem
- Investor Networks Need to Understand Cyber Business Models
- Public Funding Can Crowd In Private Capital When Designed Well
- Better Metrics Would Change Regional Behaviour
- The West Midlands Needs a Connected Capital Market
- Grants Should Start Journeys Rather Than Sustain Loops
Beyond Grants: Building a Stronger Investment Market for West Midlands Cyber
Public funding has played an important role in the development of the UK’s technology economy. Grants can support research that is too early for conventional investment, reduce the cost of experimentation, encourage collaboration between universities and businesses, and help promising companies develop technology before a commercial market is fully established. For cyber security, where technical innovation can require specialist expertise, testing and access to difficult markets, those interventions can be particularly useful.
The problem begins when grant funding is mistaken for a growth model.
A company can become highly capable at identifying competitions, assembling consortiums and satisfying the requirements of publicly funded programmes without becoming equally capable at acquiring customers, generating recurring revenue or attracting investment. At ecosystem level, substantial programme activity can consequently coexist with relatively weak commercial progression.
The originating analysis, The Grant Delusion: Why Public Funding Won’t Build the UK’s Cybersecurity Future, made that argument deliberately provocatively. Its central proposition was not that grants have no place in cyber innovation, but that public funding cannot substitute for the market mechanisms through which companies ultimately scale: customers, procurement, commercial validation and appropriately matched growth capital.
Subsequent evidence strengthens the case for examining that distinction carefully. The UK’s cyber sector continues to grow economically, yet private investment has weakened. The 2026 Cyber Security Sectoral Analysis estimates sector revenue at £14.7 billion and gross value added at £9.1 billion, increases of 11% and 17% respectively. Employment grew more slowly, by around 3% to approximately 69,600 full-time-equivalent roles. Dedicated cyber firms raised £184 million across 47 investment deals during 2025, down from £206 million across 59 deals in 2024 and continuing the decline from the investment peak recorded in 2022.
For the West Midlands, the implication is not that public funding should disappear. It is that regional cyber policy needs to distinguish more clearly between financing innovation and building companies. Grants can help create technology and capability; they cannot, on their own, create the customers, investment relationships and commercial progression required for a durable regional cyber economy.
What does this mean for cyber SMEs? The West Midlands Cyber Hub looks at the practical choices facing West Midlands cyber companies seeking finance, customers, commercial support and routes to growth, in the companion article “Funding and Support for West Midlands Cyber SMEs: What Businesses Should Know”.
Key Takeaways
- UK cyber-sector revenue and GVA continued to grow strongly in the latest sector analysis, while private investment in dedicated cyber firms declined from £206 million across 59 deals in 2024 to £184 million across 47 deals in 2025.
- Grants are most economically useful when they address a specific market failure, such as early research risk, technical validation or collaborative innovation, rather than becoming a recurring substitute for commercial revenue.
- The principal scale-up problem is not simply access to money. Cyber companies need customers, reference deployments, procurement pathways, commercial capability and investors appropriate to their stage of development.
- Regional ecosystems should measure progression between stages — from research to product, product to customer, customer to repeatable revenue and revenue to scale — rather than counting funded projects as though they were equivalent to business growth.
- The West Midlands’ industrial economy creates an opportunity to connect cyber innovation with real demand in manufacturing, operational technology and supply-chain resilience, giving regional firms commercial validation that grant funding alone cannot provide.
Public Funding Solves a Real Problem
Any serious critique of grant-led innovation needs to begin by acknowledging why grants exist.
Private investors do not finance every socially or economically valuable activity. Early-stage research may have uncertain commercial applications. Collaborative projects can produce knowledge whose benefits extend beyond the organisations funding them. Technologies relevant to national resilience may require development before a large private market exists. Universities and smaller businesses may possess complementary capabilities but lack the financial incentive to work together without intervention.
These are legitimate circumstances for public funding.
Cyber security contains several examples. Research into emerging threats, new assurance methodologies, artificial intelligence security, operational technology and other technically demanding areas can create benefits that are difficult for an individual company to capture entirely through subsequent sales.
Government funding can also help overcome the cost of demonstrating whether an idea works.
For a small company, building a prototype or testing technology in a realistic environment can require resources that are difficult to finance from existing revenue. A well-designed grant can reduce that barrier and bring a potentially valuable technology closer to market.
The relevant policy question is therefore not whether grants are good or bad. It is what problem a particular grant is intended to solve and what should happen after that problem has been addressed.
Confusion arises when a mechanism designed to finance experimentation becomes an implicit substitute for the commercial system that should follow it.
The UK Cyber Sector Is Growing While Investment Is Tightening
The latest sector evidence reveals an important tension.
The UK cyber sector generated approximately £14.7 billion in revenue during the latest reporting period, up from £13.2 billion, while GVA increased from approximately £7.8 billion to £9.1 billion. GVA per employee rose to around £131,200, an increase of 13% from £116,200.
These are not indicators of an industry without economic momentum.
At the same time, investment into dedicated cyber security companies continued to decline. The £184 million raised across 47 deals in 2025 was below the £206 million raised across 59 deals during 2024, and DSIT identifies successive annual declines since 2022.
The combination is more informative than either statistic in isolation.
Cyber companies collectively are generating more economic value, but the financing environment for companies seeking equity investment has become more constrained. That makes commercial evidence increasingly important. When capital is abundant, investors may tolerate longer periods between technical development and proven market traction. When investment becomes more selective, customer evidence, revenue quality and credible routes to scale carry greater weight.
This strengthens the argument for regional ecosystems to concentrate on commercial progression rather than assuming that promising technology will naturally attract investment once it exists.
Investment readiness begins well before an investor meeting.
The Sector’s Structure Shows Why Different Companies Need Different Capital
The UK’s cyber economy is not composed of a single type of business.
DSIT identifies 2,603 cyber security firms, of which 69% are dedicated cyber businesses and 31% are diversified organisations generating part of their activity from cyber. The composition changes substantially with company size. Around 84% of micro cyber firms are dedicated businesses, compared with only 17% of large firms; among large organisations, diversified businesses dominate.
Revenue is similarly concentrated. Large companies account for approximately £10.4 billion, or 70%, of sector revenue. Medium-sized firms generate around £2.9 billion, small businesses £1.3 billion and micro businesses approximately £251 million.
The structure creates different financing requirements at different stages.
A research-intensive startup developing a novel security product may genuinely need equity investment because substantial product development precedes revenue. A consultancy or managed-service company may be able to grow primarily from customer income. A university spinout may require grants during research translation before becoming investable. A mature SME may need growth finance, working capital or strategic investment rather than venture capital.
Treating all of these businesses as though they need the same funding instrument creates poor policy.
The objective should be capital matching: identifying what type of finance corresponds to the company’s business model, technical risk, revenue profile and stage of development.
For the West Midlands, this is particularly important because a regional cyber economy connected closely with industrial customers is likely to contain both technology-product businesses and specialist service providers. Their routes to scale will differ.
A Grant Can Validate Technology Without Validating a Market
One of the most important distinctions in innovation policy is between technical validation and commercial validation.
A grant-funded project can demonstrate that technology performs as intended. It can support prototypes, trials, research findings and technical milestones. These are valuable outputs because they reduce uncertainty about whether something can be built.
They do not necessarily establish whether customers will buy it.
Commercial validation asks different questions. Does the problem matter sufficiently for an organisation to allocate budget? Who owns that budget? How long is the procurement process? What assurance does the customer require? Can the company deliver the product economically? Will customers renew or expand their use? Can the sales process be repeated without depending entirely on the founder’s personal relationships?
A funded pilot can sometimes contribute evidence towards those questions, but only if it resembles the conditions of a real market.
The distinction becomes especially important when the customer participating in a pilot has little financial commitment. A technology can attract positive feedback when the cost is largely borne by a public programme and still encounter resistance once the vendor asks the customer to pay the full commercial price.
Regional innovation programmes should therefore be designed to expose companies to market reality rather than shield them from it indefinitely.
The strongest public intervention is often one that helps a business reach the point where private customers can make a genuine purchasing decision.
Procurement Is Part of the Investment Infrastructure
The relationship between customers and investment is frequently underestimated.
For early cyber companies, a credible customer can provide more than revenue. It can demonstrate that the product solves a real problem, generate operational evidence, produce a reference deployment and expose weaknesses that are difficult to identify in a laboratory environment.
Those signals also matter to investors.
A company that can demonstrate repeated purchases from credible customers presents a different investment proposition from one whose principal evidence consists of prototypes and funded projects. Revenue does not eliminate technical or commercial risk, but it establishes that an external organisation has valued the product sufficiently to spend its own money.
Procurement is therefore part of the financing environment.
This is particularly relevant to the West Midlands because the region contains large organisations and extensive industrial supply chains capable of acting as sophisticated customers. Manufacturing, mobility, engineering and other technology-intensive sectors generate security problems around operational systems, remote access, connected products and supplier assurance.
Connecting regional cyber companies with those problems can provide something a grant programme cannot manufacture independently: demanding customers.
The regional objective should not be to encourage large organisations to buy local technology regardless of quality. That would weaken rather than strengthen the ecosystem. It should be to make credible regional suppliers visible, create proportionate routes into procurement and give emerging companies opportunities to compete against genuine requirements.
Winning that competition is commercial validation.
Industrial Cyber Creates a Particularly Strong Validation Opportunity
The West Midlands’ wider economy gives the region a potential advantage that is easy to overlook when cyber development is treated primarily as a technology-sector problem.
Industrial organisations provide environments in which specialist cyber capabilities can be developed and tested against difficult operational requirements.
Operational technology security is one example. DSIT’s 2026 sector analysis identifies industrial and OT security within only a minority of provider offerings: 7% of firms are associated with SCADA or industrial-control-system security in the principal taxonomy, while web-based analysis identifies industrial or OT security among around 10% of providers.
That relatively specialised supply sits alongside substantial national demand from manufacturing, infrastructure and other organisations operating physical processes.
The West Midlands therefore has the possibility of creating a feedback loop between industrial demand and cyber supply. Manufacturers articulate difficult security problems; cyber companies develop solutions; universities contribute research; providers validate capability in realistic environments; and successful companies use that evidence to pursue customers elsewhere.
This is cluster economics in a more substantive sense than co-locating technology firms.
The value lies in repeated exchange between specialised suppliers and demanding customers.
Public funding can accelerate parts of that process, particularly where companies need support to develop or test new technology. It should be structured to move businesses towards customer evidence rather than becoming the final destination.
The Missing Middle Is a Progression Problem
Regional technology ecosystems frequently devote substantial attention to company formation.
Startup programmes, accelerators, innovation competitions and university enterprise initiatives can increase the number of businesses entering the pipeline. Those interventions are visible and relatively easy to measure.
The more difficult question is what happens several years later.
The 2026 cyber sector analysis provides some encouraging national evidence. The number of firms generating more than £10 million annually from cyber activity reached 241, compared with 219 in the previous year and 105 two years earlier.
That increase suggests that a meaningful group of UK cyber businesses is progressing beyond the earliest stages.
Yet the wider structure remains highly concentrated. Large firms generate 70% of revenue, while micro and small businesses account for a much smaller proportion of sector turnover. This is not unusual in itself; mature industries frequently contain large revenue concentrations. The policy challenge is whether promising smaller companies possess viable routes through the intermediate stages.
This is the “missing middle” problem.
A startup ecosystem can produce many new firms while still struggling to produce enough businesses with substantial recurring revenue, professional management, established sales functions and the capability to enter new markets.
Grants alone cannot create those characteristics because they are produced through repeated commercial execution.
The relevant infrastructure includes experienced leadership, sales capability, procurement access, investment networks, customer references and support for internationalisation. Regional programmes need to understand how these elements connect rather than assuming that startup support and investment promotion will automatically meet in the middle.
Investor Networks Need to Understand Cyber Business Models
Increasing the supply of capital is only part of the investment problem. The quality of investor understanding also matters.
Cyber security contains businesses with substantially different economic characteristics.
A software product may offer high gross margins and recurring subscription revenue but require significant upfront development and international sales expenditure. A managed security provider can produce recurring revenue through people-intensive service delivery. A specialist consultancy may grow profitably without the economics normally sought by venture capital. A deep-technology company emerging from university research may require patient capital before a market can be established.
Investors who treat “cyber” as a single business model risk mispricing these differences.
The same applies to technical risk. Evaluating a security company requires some understanding of whether its technology creates a defensible advantage, whether a claimed innovation addresses a material customer problem and how quickly competitors or major platforms could reproduce the functionality.
Regional investor development should therefore involve more than introducing founders to generalist sources of capital.
A stronger market contains investors, angels and advisers capable of understanding the sector sufficiently well to distinguish a technically interesting company from an investable one, and a sustainable specialist business from a venture-scale proposition.
That distinction benefits founders as well as investors. Companies can pursue forms of finance appropriate to their actual economics rather than being encouraged towards venture investment simply because it is culturally associated with technology growth.
Public Funding Can Crowd In Private Capital When Designed Well
The critique of grant dependency should not be confused with an argument that public and private finance are mutually exclusive.
Well-designed public funding can make companies more investable.
A grant that enables technically risky research can reduce uncertainty before private investment. A programme that funds independent testing can generate evidence required by customers. Collaborative research can produce intellectual property around which a commercial company develops. Match-funding arrangements can encourage private investors to participate where risk would otherwise be excessive.
The key is additionality.
Public money should enable activity that is economically valuable but unlikely to occur at the required time or scale through the market alone. It should not simply replace expenditure that a viable company or customer would otherwise have funded privately.
That distinction is difficult to enforce perfectly, but it provides an important design principle.
A successful grant should also have an exit condition. At some point, a commercially oriented company should become increasingly dependent on customers and appropriately matched private finance rather than successive public competitions.
Where the same business model remains dependent on repeated grants over many years, policymakers should ask whether the funding is genuinely creating a market or merely sustaining activity.
There may be legitimate exceptions, particularly where companies undertake research with substantial public-good characteristics. Those cases should be recognised explicitly rather than used to blur the distinction between research funding and company growth.
Better Metrics Would Change Regional Behaviour
How an ecosystem measures success influences what organisations within it optimise.
If the principal metrics are grants awarded, programmes delivered, startups supported and events held, regional institutions have strong incentives to maximise those outputs. None is inherently undesirable, but none demonstrates that companies are becoming stronger.
A progression-based model would measure different outcomes.
It would examine how many companies moved from prototype to first paying customer; how many converted pilots into repeatable commercial contracts; how many increased recurring revenue; how many entered new supply chains; how many attracted appropriate private finance after achieving commercial milestones; and how many progressed into meaningful scale.
The same discipline should apply to university commercialisation.
The number of spinouts created matters less economically than whether those companies survive, attract customers, retain valuable intellectual property and develop sustainable operations. A smaller number of strong businesses can create more durable regional value than a larger population of companies that remain permanently dependent on programme support.
This does not make measurement simple. Commercial progression takes time, and regional organisations cannot claim sole credit for company success.
The objective is not attribution but direction. Metrics should reveal whether the ecosystem is helping businesses move towards economic independence rather than simply circulating through successive forms of support.
The West Midlands Needs a Connected Capital Market
The West Midlands does not need to reproduce London’s venture-capital market in miniature.
Its opportunity is to construct a financing and commercialisation system appropriate to the companies and customers already present in the regional economy.
That system could connect university research funding with commercialisation expertise; cyber startups with industrial customers; SMEs with growth finance; founders with experienced angels; later-stage businesses with national and international investors; and public programmes with clear routes into private demand.
The Cyber Growth Action Plan’s emphasis on places is relevant here because technology companies do not scale through finance in isolation. They develop within markets containing customers, talent, advisers, research capability and investors.
The regional task is therefore one of connectivity.
A company emerging from a university should not reach the end of a funded project without knowing what evidence commercial customers require. A startup completing an accelerator should have routes to potential buyers rather than another generic programme. A business demonstrating repeatable revenue should be visible to investors capable of funding the next stage.
Likewise, investors need routes into credible regional deal flow rather than encountering companies only during occasional pitch events.
This is financial infrastructure in the ecosystem sense: not a single fund, but a sequence through which different forms of capital and commercial evidence become available as companies progress.
Grants Should Start Journeys Rather Than Sustain Loops
The argument against grant dependency is ultimately an argument for a more demanding model of regional economic development.
Public funding can initiate valuable activity. It can reduce research risk, enable collaboration, support technical validation and help companies cross stages that markets would otherwise finance poorly. The UK cyber sector has benefited from such intervention, and abandoning it would remove a useful policy instrument.
The mistake is treating successful participation in that system as equivalent to successful company building.
The latest sector evidence makes the distinction increasingly important. UK cyber revenue and GVA are growing strongly while investment has become more selective. That environment rewards businesses capable of demonstrating customers, commercial discipline and credible routes to scale.
For the West Midlands, this creates a practical opportunity. The region does not need to choose between public support and private investment. It needs to connect them through real market demand.
Its industrial economy can provide precisely the customer environment required to validate cyber products and services around manufacturing, operational technology, connected systems and supply-chain resilience. Universities can contribute research. Public programmes can reduce early technical risk. Regional networks can improve access to customers and expertise. Investors can provide capital when businesses have reached the stage at which private finance is appropriate.
The success of that system should be visible in progression rather than activity.
A funded project that produces useful research has achieved a research objective. A funded company that subsequently wins customers has crossed into commercial validation. A company that turns those customers into repeatable revenue has developed a business model. A business that uses that evidence to attract appropriate capital and enter larger markets has begun to scale.
Those are different achievements, and regional cyber policy should measure them accordingly.
The strongest West Midlands cyber economy will not be the one that secures the greatest number of grants. It will be the one in which public funding is used selectively to create capability that can subsequently survive without it — because businesses have customers willing to pay, investors willing to commit capital on commercial terms, and a regional market capable of turning technical innovation into durable economic value.