The UK has strong cyber research, national institutions, startups and established security companies. The challenge is connecting those assets into sustainable routes from innovation to commercial scale.
Contents
- Contents
- The UK Cyber Growth Flywheel: What the West Midlands Needs to Make It Turn
- Key Takeaways
- The Flywheel Is a Model of Reinforcement, Not a List of Assets
- UK Cyber Growth Is Increasingly About Productivity as Well as Employment
- The UK Has Become Better at Producing Larger Cyber Businesses
- Dedicated Firms and Diversified Firms Play Different Roles
- The Missing Middle Is Commercial, Not Merely Financial
- Investment Is Necessary but Cannot Turn the Flywheel Alone
- Customers Are the Most Underestimated Part of the Ecosystem
- The West Midlands Has an Industrial Demand Advantage
- Research Needs a Stronger Route into Demand
- Skills Need to Follow the Shape of Demand
- Successful Firms Need to Recycle Experience into the Ecosystem
- The Regional Flywheel Needs Connections Rather Than More Layers
- Measure Movement Through the System
- The West Midlands Opportunity Is to Make Existing Strengths Compound
The UK Cyber Growth Flywheel: What the West Midlands Needs to Make It Turn
The UK’s cyber security sector has many of the components normally associated with a successful technology economy. It has a substantial commercial market, internationally recognised technical capability, strong universities, government-backed innovation programmes, specialist investors, established cyber companies and a continuing stream of new businesses. The latest sector evidence also shows meaningful economic growth.
Yet possessing the components of an ecosystem is not the same as having a system in which those components reinforce one another.
That distinction sits at the centre of the originating analysis, The UK Flywheel and the Missing Middle: Why Cyber Growth Still Doesn’t Compound. The argument is that sustainable cyber-sector growth should operate as a flywheel: research generates technology; technology creates companies; companies acquire customers; customer evidence attracts investment; investment supports scaling; successful firms generate experienced founders, employees and capital; and those resources are recycled into the next generation of businesses.
Where those connections work, capability compounds. Where they are weak, the ecosystem can remain active without becoming proportionately stronger.
The 2026 Cyber Security Sectoral Analysis makes this question more important. The UK now has 2,603 cyber security firms generating approximately £14.7 billion in annual revenue and £9.1 billion in gross value added. Revenue increased by 11% and GVA by 17%, while employment grew by around 3% to approximately 69,600 full-time-equivalent roles. At the same time, investment in dedicated cyber firms fell to £184 million across 47 deals in 2025, from £206 million across 59 deals the previous year.
This is not evidence of a sector in decline. It is evidence of a sector whose growth dynamics are becoming more complex.
For the West Midlands, the strategic question is therefore not simply how to create more cyber activity. It is how to build stronger connections between industrial demand, cyber companies, research, skills, procurement and capital so that progress at one point creates momentum elsewhere.
Key Takeaways
- The UK cyber sector is growing strongly in revenue and GVA, but employment is growing more slowly and private investment has declined, indicating that sector growth cannot be understood through a single measure.
- A functioning cyber growth flywheel requires connections between research, company formation, customers, commercial validation, investment, skills and subsequent reinvestment; strength in individual components is insufficient if businesses cannot progress between them.
- The UK’s principal regional opportunity is not simply to increase startup formation but to strengthen the “missing middle” in which promising firms acquire repeat customers, professionalise, access growth capital and become substantial businesses.
- The West Midlands has a structural advantage because advanced manufacturing, engineering and complex supply chains can provide real demand for industrial cyber security, operational technology, assurance and resilience services.
- Regional cyber policy should measure progression and economic relationships rather than relying predominantly on counts of companies, programmes, events or funding awards.
The Flywheel Is a Model of Reinforcement, Not a List of Assets
The attraction of the flywheel model is that it changes how an ecosystem is assessed.
A conventional inventory might count universities, startups, investors, accelerators, established technology companies, skills programmes and public-sector initiatives. A region containing many of these assets can reasonably describe itself as possessing a technology ecosystem.
The flywheel asks a harder question: what passes between them?
University research has greater economic effect when it contributes to technologies that organisations adopt. Startup programmes become more valuable when companies emerging from them acquire customers. Customers contribute to company development when their procurement creates revenue and reference deployments. Investment is more productive when it helps validated companies expand rather than simply extending experimentation. Successful firms strengthen the next generation when experienced employees become founders, investors, advisers or customers.
The system compounds when outputs from one stage become inputs to another.
This is why ecosystem density and ecosystem effectiveness are not identical. A region can contain many institutions without having efficient pathways between them. Businesses can move repeatedly through support programmes without becoming commercially stronger, while research can remain disconnected from customer demand and investors can struggle to identify sufficiently mature opportunities.
The objective of regional cyber policy should therefore be to reduce friction between stages rather than continually adding new components to an already complicated landscape.
UK Cyber Growth Is Increasingly About Productivity as Well as Employment
The latest sector data provides evidence that the UK’s cyber economy is changing shape.
Revenue increased by 11% to £14.7 billion, while GVA rose by 17% to £9.1 billion. Employment increased by only around 3%, the lowest rate of employment growth since the sectoral analysis series began in 2018.
The divergence produced a substantial increase in productivity. GVA per employee reached approximately £131,200, compared with £116,200 in the previous year, an increase of around 13%. The ratio of GVA to turnover also increased to 0.62, from 0.59 a year earlier and 0.54 the year before that.
These figures complicate a common assumption that technology-sector growth should be judged principally through job creation.
Employment remains economically important, particularly for regional development. However, a sector capable of generating substantially more value without increasing headcount at the same rate may be improving productivity, shifting towards higher-value activities or using technology more effectively.
That has implications for the flywheel.
The goal should not be to maximise the number of cyber jobs irrespective of their economic character. A stronger ecosystem creates businesses capable of producing valuable intellectual property, specialised services and scalable products while supporting high-productivity employment.
For the West Midlands, this is particularly relevant because cyber sits within a wider regional productivity challenge. The economic value of cyber capability lies partly in the companies selling security products and services, but also in its ability to support productivity and continuity across other sectors.
The regional cyber flywheel therefore needs to connect sector growth with the performance of the wider economy.
The UK Has Become Better at Producing Larger Cyber Businesses
One encouraging feature of the latest evidence is the growth in companies moving beyond very small scale.
DSIT identifies 241 firms generating more than £10 million annually from cyber activity. That compares with 219 in the previous year and 105 two years earlier.
The increase is substantial.
It suggests that the UK cyber economy is not simply adding startups at the bottom of the market. A growing population of firms is reaching meaningful commercial scale.
Revenue remains concentrated, however. Large firms account for approximately £10.4 billion, or 70%, of total sector revenue. Medium-sized businesses generate around £2.9 billion, small companies £1.3 billion and micro businesses approximately £251 million.
This concentration needs careful interpretation.
Large companies naturally generate a significant share of revenue in a mature sector, and their presence can strengthen an ecosystem through employment, procurement and customer relationships. The important question is whether enough smaller firms possess credible pathways towards medium and larger scale.
That progression is where the flywheel either begins to compound or loses momentum.
A regional ecosystem that continually creates micro-businesses without producing a corresponding population of established SMEs can appear entrepreneurial while remaining economically shallow.
The West Midlands should therefore be interested not only in how many cyber companies it contains, but in their distribution by revenue, employment, customer base and stage of development.
Company formation is an input. Progression is the outcome.
Dedicated Firms and Diversified Firms Play Different Roles
The structure of the UK cyber sector also demonstrates why ecosystem analysis needs to distinguish between types of company.
Approximately 69% of UK cyber firms are dedicated businesses whose principal activity is cyber security, while 31% are diversified companies generating only part of their revenue from cyber.
The balance changes dramatically with size. Around 84% of micro firms are dedicated cyber companies, compared with 64% of small firms and 51% of medium-sized businesses. Among large firms, only 17% are dedicated, while 83% are diversified.
Large diversified organisations consequently play a major role in the sector’s economic scale.
For regional policy, this means the cyber economy cannot be understood solely by counting companies that describe themselves primarily as cyber businesses.
Engineering companies, technology consultancies, telecommunications providers, defence businesses and other diversified organisations can employ significant cyber teams and generate substantial cyber-related economic activity.
The West Midlands is particularly exposed to this measurement problem because its potential cyber strengths overlap with existing industrial and technology sectors.
A manufacturer developing specialist security capability around connected products may contribute to the regional cyber economy without becoming a pure-play cyber company. An engineering consultancy can build an industrial-security practice. A technology business can incorporate security into a wider product proposition.
A regional flywheel should encourage these connections rather than creating an artificial boundary around a narrowly defined cyber industry.
The Missing Middle Is Commercial, Not Merely Financial
The phrase “missing middle” is sometimes used to describe a shortage of growth capital between startup funding and later-stage investment. Capital is part of the problem, but the underlying gap is broader.
Companies need to become investable before additional finance can accelerate them effectively.
That means developing products customers value, demonstrating repeatable demand, establishing credible pricing, building sales capability, satisfying procurement requirements and creating management systems capable of supporting growth.
These capabilities are difficult to acquire through startup programmes alone.
Early-stage support is often designed around company formation, product development, pitching and initial validation. Those are appropriate objectives for young businesses. A company with several customers and a growing team faces different problems: account management, sales forecasting, recruitment, operational processes, channel development, international expansion and working-capital requirements.
The ecosystem required at this stage consequently looks different.
Experienced operators become more valuable than introductory mentors. Customer introductions need to become commercial procurement opportunities. Finance needs to match established growth rather than speculative experimentation. Founders may need support professionalising management rather than refining another pitch deck.
If those capabilities are absent, companies can remain trapped between startup support and genuine scale.
That is the missing middle the West Midlands needs to address.
Investment Is Necessary but Cannot Turn the Flywheel Alone
The decline in private investment makes the progression problem more visible.
Dedicated UK cyber firms raised £184 million across 47 deals in 2025, compared with £206 million across 59 deals in 2024. Investment has now declined year on year since 2022.
It would be easy to interpret this simply as a shortage of capital. That conclusion would be incomplete.
Investment follows a combination of market conditions, expected returns and company quality. Increasing the number of investors or establishing another fund does not automatically create more investable cyber companies.
The stronger objective is to improve both sides of the market.
Companies need better commercial evidence, stronger management and credible growth propositions. Investors need access to regional deal flow and sufficient understanding of cyber business models to assess technical and commercial risk. Connections between the two need to occur before a company reaches the point of urgently seeking finance.
The West Midlands therefore needs investment infrastructure rather than investment activity alone.
That infrastructure includes experienced angel investors, sector-aware advisers, links to national venture funds, corporate investors, university commercialisation expertise and mechanisms through which founders can develop relationships with capital providers over time.
Capital becomes most powerful when it enters a flywheel already generating commercial momentum.
Customers Are the Most Underestimated Part of the Ecosystem
Technology ecosystems often devote disproportionate attention to founders and investors. Customers receive less attention even though they provide the revenue and validation on which sustainable businesses ultimately depend.
This is especially important in cyber security because enterprise procurement can be difficult for smaller companies.
Security products affect risk, sensitive systems and sometimes critical operations. Buyers therefore have legitimate reasons to require evidence about suppliers, technology performance, data handling, financial stability and support capability. Procurement processes can be lengthy, particularly within large organisations.
For a young cyber company, winning the first substantial customer can consequently be harder than developing the initial technology.
Regional ecosystems can reduce some of that friction without weakening procurement standards.
Large organisations can articulate genuine problems to the market. Innovation programmes can help identify credible suppliers. Universities and test facilities can contribute technical validation. Procurement teams can develop routes through which smaller companies demonstrate capability before competing for larger contracts.
The objective should not be preferential purchasing simply because a company is local. Customers need effective security solutions, and regional firms need the discipline of genuine competition.
The value lies in access to the contest.
A company that wins a demanding industrial customer gains revenue, product feedback and a reference deployment. Those assets strengthen subsequent sales and can improve the company’s investment proposition.
Customers therefore provide much of the torque that makes the flywheel turn.
The West Midlands Has an Industrial Demand Advantage
This is where the structure of the West Midlands economy becomes strategically important.
The region contains substantial advanced-manufacturing, engineering, mobility, defence-related and technology-intensive activity. These sectors are becoming more digitally dependent through automation, connected production, cloud services, software, data and increasingly artificial intelligence.
That creates persistent demand for cyber capability.
Operational technology security, supply-chain assurance, secure remote access, identity management, incident preparation and connected-product security are not artificial markets that need to be created through regional branding. They emerge from the way industrial organisations increasingly operate.
The UK provider landscape suggests that some of these capabilities remain specialised. The 2026 sectoral analysis associates 7% of providers with SCADA or industrial-control-system security, while web analysis identifies industrial or OT security among around 10% of provider offerings.
For the West Midlands, this creates the possibility of specialising where local customer demand and national cyber capability intersect.
A regional cyber company that solves a difficult security problem for a manufacturer can use that experience elsewhere. An industrial customer gains resilience while the provider gains commercial validation. Universities can investigate problems exposed by deployment. Skills providers receive clearer signals about the expertise employers require.
This is the flywheel in practical form: one transaction generating capability that becomes useful elsewhere in the system.
Research Needs a Stronger Route into Demand
Universities are another important component of the regional model.
Academic cyber research can generate technical knowledge, intellectual property, specialist skills and new companies. The West Midlands benefits from universities with relevant research and educational capability, while collaborative programmes can connect academics with businesses and public-sector organisations.
The challenge is translation.
Research excellence does not automatically produce economic value, just as company formation does not automatically produce scale. The connection depends on whether research addresses problems that organisations need solved and whether appropriate routes exist for transferring the resulting capability.
Those routes vary.
Some research should produce publications and public knowledge rather than companies. Some can contribute to standards or policy. Some can be licensed to established businesses. Some can create spinouts. Some becomes most valuable when researchers collaborate directly with industrial partners.
A functioning flywheel should accommodate all of these pathways.
The mistake is assuming that spinout formation is the only meaningful measure of commercialisation. A research programme that substantially improves the cyber resilience of regional manufacturers can create economic value even without producing a standalone company.
Equally, where research does produce a spinout, the company needs to enter the same commercial progression system as any other business. Academic origin does not remove the need for customers, management capability and appropriate finance.
Skills Need to Follow the Shape of Demand
Skills are often described as another input to the flywheel, but the relationship is more dynamic than simply increasing supply.
The UK’s cyber labour market has already demonstrated this. The estimated annual workforce shortfall has narrowed considerably from earlier years, while employers continue to report technical skills gaps and demand for experienced practitioners remains strong.
The problem is increasingly one of matching.
A growing product company may need software engineers with security expertise. A manufacturer may need practitioners who understand operational technology. A consultancy may require people capable of combining technical knowledge with client-facing communication. An investor-backed scale-up may need experienced commercial leadership rather than another cohort of entry-level analysts.
Regional skills policy needs to respond to these different forms of demand.
This is another reason why the flywheel matters. Stronger relationships between employers, universities and training providers improve the information available to the skills system. Companies reveal what capabilities they need; educators adapt provision; graduates and experienced workers move into productive roles; growing firms create further demand.
Skills provision disconnected from company and customer progression can increase the number of trained people without solving the constraints experienced by employers.
The objective should therefore be labour-market responsiveness rather than training volume alone.
Successful Firms Need to Recycle Experience into the Ecosystem
The most mature technology ecosystems benefit from something that is difficult to manufacture directly through public policy: recycled experience.
Employees of successful firms become founders. Founders who achieve exits become angel investors. Senior operators become advisers and non-executive directors. Commercial leaders move into younger businesses. Established companies become customers for startups or acquire them.
This creates institutional memory outside formal institutions.
People who have already scaled a company understand problems that early-stage programmes can only describe theoretically: building sales teams, entering foreign markets, negotiating major contracts, raising growth capital, managing rapid recruitment and professionalising operations.
A region without enough scaled technology companies has a corresponding shortage of this experience.
That makes the growth of existing firms strategically important beyond their direct employment and revenue. A successful West Midlands cyber company can strengthen the next generation through people, capital, credibility and networks.
Regional policy should therefore be interested in retaining relationships with founders and senior employees as companies grow.
The ecosystem should not effectively graduate a company once it no longer qualifies for startup support. That is the point at which the business may become most valuable to the wider flywheel.
The Regional Flywheel Needs Connections Rather Than More Layers
The West Midlands already contains many of the institutions required for a stronger cyber economy: universities, established technology businesses, manufacturers, startups, investors, business-support organisations, public-sector partners, the West Midlands Cyber Cluster and the West Midlands Cyber Hub.
The strategic temptation is to respond to any perceived weakness by creating another programme or institution.
A flywheel perspective suggests a different priority.
The first question should be whether existing assets are connected effectively enough.
Can a cyber company reach industrial customers? Can a manufacturer identify specialist cyber capability? Can university research find commercial or operational partners? Can a business with early customer traction reach investors appropriate to its stage? Can employers communicate emerging skills requirements to education providers? Can experienced founders contribute to younger companies?
Where the answer is no, another standalone initiative may increase the number of components without improving the system.
The Cluster’s role is particularly relevant here because clusters are fundamentally concerned with economic relationships. Their value lies in reducing the distance between firms, customers, knowledge institutions, capital and talent.
The Hub can complement that role by giving businesses and individuals practical access to the ecosystem, while the Cluster concentrates on strengthening the economic and institutional connections through which capability develops.
The distinction is useful because neither organisation needs to own every intervention for the regional system to become stronger.
Measure Movement Through the System
A flywheel strategy also requires different measures of success.
Firm counts remain useful, but they should be accompanied by evidence about progression. Investment totals matter, but so do the stages and types of companies receiving capital. Job creation matters, but so do productivity, skills intensity and the ability of businesses to retain experienced people.
For a regional cyber ecosystem, useful indicators would examine movement between stages.
How many companies secure their first substantial commercial customer? How many convert initial contracts into repeatable revenue? How many progress from micro to small and from small to medium scale? How many obtain investment after demonstrating commercial traction? How many sell outside the region or internationally? How many larger regional organisations procure from emerging cyber suppliers? How many experienced founders and operators reinvest time or capital into the next generation?
These measures are more difficult to collect than programme attendance, but they reveal whether economic capability is compounding.
They also expose where the flywheel is losing energy.
If the region creates many startups but few acquire major customers, procurement may be the constraint. If companies generate revenue but struggle to raise growth capital, investment connections may be weak. If businesses obtain funding but cannot recruit specialist staff, skills become the limiting factor.
Measurement therefore becomes diagnostic rather than promotional.
The West Midlands Opportunity Is to Make Existing Strengths Compound
The UK’s cyber sector is not short of activity. With 2,603 firms, £14.7 billion in revenue and £9.1 billion in GVA, it has reached substantial economic scale. The more interesting question is whether the mechanisms supporting that scale are becoming self-reinforcing.
The evidence is mixed in useful ways. Revenue and productivity are rising strongly. More companies are crossing the £10 million revenue threshold. Employment is still growing, but more slowly. Investment has declined for successive years. Large firms continue to dominate sector revenue, while many dedicated cyber businesses remain small.
Those tensions point towards progression rather than formation as the next economic challenge.
For the West Midlands, the answer should not be an attempt to reproduce every component of the national cyber ecosystem locally. The region already possesses something more strategically useful: a distinctive concentration of industrial demand alongside cyber providers, universities, technology companies and an emerging coordination infrastructure.
The task is to make those strengths compound.
Industrial customers can provide cyber companies with demanding problems and commercial validation. Providers can improve the resilience of the regional economy. Universities can supply research and specialist knowledge. Stronger companies can attract capital and experienced people. Successful founders and employees can recycle expertise into new ventures. Procurement and assurance can create incentives for smaller suppliers to improve cyber maturity.
Each connection strengthens another part of the system.
That is what distinguishes a functioning economic flywheel from a collection of programmes.
The West Midlands does not need to maximise the number of cyber initiatives it can display. It needs to increase the rate at which organisations move between research, innovation, customer adoption, commercial scale and reinvestment.
If those transitions become easier, the region can generate more than a larger cyber sector. It can build a cyber economy whose growth reinforces the resilience and competitiveness of the industrial economy around it — and whose accumulated customers, expertise, companies and capital make the next generation of growth easier than the last.