Events, practical cyber support, skills development and stronger connections between businesses and specialists are helping build regional cyber capability. We look at the programmes designed to support organisations across the West Midlands.
Contents
- Contents
- Building Regional Cyber Capability: The West Midlands Cyber Hub Programme in 2026
- Key Takeaways
- The First Challenge Was Turning a Place into a Programme
- SMEs Needed Practical Access to Cyber Support
- Cyber Resilience Required More Than Awareness Events
- Regularity Was Part of the Infrastructure
- Different Communities Needed Different Forms of Space
- Professional Networks Were Part of Regional Capability
- Skills Activity Needed a Route into Employment
- Entrepreneurship Required More Than Generic Startup Support
- Universities Contributed More Than a Talent Pipeline
- Cyber Innovation Needed Real Problems
- The Hub’s Value Depended on Partnerships
- A Programme Calendar Was Not the Same as an Outcome Framework
- The First Quarter Established an Operating Philosophy
- What the Early Programme Demonstrated
Building Regional Cyber Capability: The West Midlands Cyber Hub Programme in 2026
At the beginning of 2026, the West Midlands Cyber Hub was moving from establishment into delivery. The physical Hub had been created, an initial community had begun to form around it, and the immediate question was changing from whether the region needed shared cyber infrastructure to what that infrastructure should actually do. Some of this was captured in “Merry Christmas and Happy New Year 2026 from the West Midlands Cyber Hub“.
The programme developed for January to March 2026 provides a useful record of that transition. It combined business support, cyber resilience, skills, entrepreneurship, innovation and community activity rather than treating the Hub primarily as an events venue. That distinction matters because regional cyber capability is not created by convening alone. Businesses need practical routes into expertise, people need pathways into employment, emerging companies need access to customers and support, and specialist communities need opportunities to develop relationships that persist between individual events.
The contemporary source material, including the January 2026 programme described through the West Midlands Cyber Hub, captures this early delivery phase. Viewed retrospectively, its significance lies not in the individual dates on the calendar but in the operating model being tested: could a regional Hub become useful infrastructure through which different parts of the West Midlands cyber community accessed capability and one another?
The first quarter of 2026 was therefore an important implementation period. It moved the Hub beyond the question of establishing a home for cyber and towards the more practical challenge of building programmes around the needs of businesses, practitioners, students, founders and regional partners.
Read the Hub perspective. The West Midlands Cyber Hub looks at how the opening 2026 programme brought together business support, skills, innovation, cyber resilience and community activity, in the companion article “Building Regional Cyber Capability: The West Midlands Cyber Hub Programme in 2026”.
Key Takeaways
- The January–March 2026 programme marked a transition from establishing the West Midlands Cyber Hub towards testing what practical regional cyber infrastructure should provide.
- The programme combined SME support, resilience activity, skills, entrepreneurship, professional communities and innovation rather than concentrating on a single audience or type of intervention.
- Regular activity was important because regional capability depends on repeated interaction and accessible support, not occasional flagship events alone.
- The Hub’s role was primarily connective: bringing existing expertise, organisations and communities within easier reach rather than attempting to become the sole provider of regional cyber services.
- The early programme demonstrated the importance of designing different routes for businesses, practitioners, students and founders instead of treating the cyber community as a homogeneous audience.
- Viewed retrospectively, the first quarter of 2026 helped establish principles that would inform the subsequent development of wider regional cyber coordination.
The First Challenge Was Turning a Place into a Programme
Establishing a physical Hub solved only one part of the regional coordination problem.
A building can provide visibility and somewhere for people to meet, but its value depends on what happens inside it and through the relationships that develop around it. Without useful programming, even an attractive facility risks becoming little more than occasional event space.
The early 2026 programme therefore represented a change in emphasis.
During the Hub’s formation, much of the work necessarily concerned partnerships, premises, community engagement and the practical task of establishing the initiative. Once that infrastructure existed, attention could move towards the needs of different groups using it.
Businesses required practical cyber support. Practitioners wanted opportunities to exchange experience with peers. Students and people entering the profession needed access to employers and realistic career pathways. Founders required support appropriate to building cyber businesses. Universities and regional organisations needed mechanisms through which their existing expertise could become more accessible.
These were not variations of the same requirement.
A useful regional Hub consequently needed a portfolio of activity rather than a single standard programme repeated for every audience.
The January–March schedule began testing what that portfolio might look like.
SMEs Needed Practical Access to Cyber Support
One of the clearest requirements concerned smaller businesses.
For many SMEs, the problem is not an absence of information about cyber security. Government guidance, certification schemes and commercial advice are widely available. The difficulty is often determining which information applies, what should be prioritised and where proportionate help can be obtained.
That creates a navigation problem.
A small business may know that it should improve security without knowing whether its immediate priority is authentication, backups, Cyber Essentials, staff awareness, an incident-response plan, supplier requirements or specialist technical advice. The answer depends on its systems, customers and risk.
Generic awareness cannot resolve that decision.
Practical support mechanisms are valuable because they allow businesses to begin with their circumstances rather than with a predefined product or programme. A conversation can establish what the organisation is trying to protect, what customers require and where obvious gaps exist before directing it towards appropriate expertise.
This was an important principle behind the Hub’s early business-facing activity.
The objective was not to create a regional replacement for national guidance or existing providers. It was to reduce the distance between businesses and the support already available.
For SMEs operating within larger supply chains, that function becomes increasingly important because cyber maturity can affect commercial relationships as well as security.
Cyber Resilience Required More Than Awareness Events
The early programme also reflected a wider shift in the cyber conversation from awareness towards resilience.
Awareness remains necessary. Employees need to recognise suspicious activity, leaders need to understand cyber risk and businesses need access to clear information about common threats.
The limitation is that awareness does not establish whether an organisation can withstand or recover from an incident.
Resilience requires operational capability.
Businesses need to understand which systems and suppliers are critical, maintain appropriate controls, prepare for disruption and know how decisions will be made when normal operations are unavailable.
National evidence demonstrates why this distinction matters. In the 2025/26 Cyber Security Breaches Survey, 72% of businesses described cyber security as a high priority for senior management, while only 30% had conducted a cyber risk assessment during the previous year and 25% had a formal incident-response plan.
Leadership attention is considerably more widespread than formal preparedness.
A regional programme therefore needs opportunities for organisations to move beyond general awareness. Workshops, clinics, exercises and access to practitioners can help businesses understand what implementation looks like in practice.
The Hub could contribute by providing an environment in which that progression occurred more easily.
Regularity Was Part of the Infrastructure
The cadence of the programme was itself significant.
Regional technology activity can become concentrated around large conferences and occasional high-profile events. These create visibility and can bring together substantial audiences, but they do not necessarily create the repeated relationships through which communities mature.
Regular programming performs a different function.
A practitioner who encounters the same professional community several times can develop relationships that would be unlikely to emerge from a single conference. A business can return for different forms of support as its requirements develop. Students can become familiar with employers before recruitment decisions arise. Founders can build relationships with advisers, peers and potential customers over time.
This repeated interaction creates social and professional infrastructure.
The value is difficult to capture through attendance figures alone because the important outcome may occur months later: a commercial introduction, a placement, a collaboration or simply the ability to contact somebody with relevant expertise when a problem arises.
The first-quarter programme therefore helped test whether the Hub could become somewhere people returned to rather than somewhere they visited once.
That distinction is fundamental to the idea of a regional home for cyber.
Different Communities Needed Different Forms of Space
Cyber security is often discussed as though it contains a single professional community.
In practice, it contains overlapping groups with different requirements.
Senior security leaders may need confidential peer discussion about organisational challenges. Technical practitioners may value detailed knowledge exchange. Founders need conversations about customers, product development and company building. Students need accessible opportunities to meet people already working in the profession. SMEs seeking support may be uncomfortable entering an environment dominated by specialist terminology.
A Hub serving all of these audiences cannot assume that one type of event will work equally well for each.
This makes community architecture important.
Some activity benefits from being open and highly visible. Other conversations require smaller groups and trusted relationships. Some programmes should be technical; others should deliberately avoid unnecessary technical language. Certain communities need formal structure, while others develop more effectively through informal interaction.
The early Hub programme began to accommodate this diversity.
That approach also helped establish an important principle for subsequent regional coordination: successful specialist communities should not necessarily be merged into a single general network.
A healthy ecosystem can contain many communities while still benefiting from a shared point of connection.
Professional Networks Were Part of Regional Capability
Professional communities contribute something that formal training and organisational structures cannot provide easily.
Cyber practitioners routinely encounter problems shaped by incomplete information, changing threats and organisational constraints. Much of the knowledge required to deal with those situations is experiential.
Peer networks provide mechanisms through which that knowledge can circulate.
A security leader can learn how another organisation approached board engagement. An incident-response practitioner can compare operational experience. People implementing Cyber Essentials or supplier assurance can understand where others encountered difficulty. Practitioners moving into new roles can gain access to people who have already dealt with similar challenges.
These exchanges are rarely reducible to a formal curriculum.
They constitute part of the tacit knowledge of a regional professional community.
The Hub’s ability to host and connect specialist groups therefore contributed to capability even where the Hub itself was not producing the expertise being exchanged.
This illustrates the difference between providing capability and enabling capability.
Regional infrastructure does not need to employ every specialist. It can create conditions under which specialists become easier to find and their knowledge moves more effectively through the ecosystem.
Skills Activity Needed a Route into Employment
The Hub’s early programming also reflected the persistent gap between cyber education and employment.
The West Midlands contains several universities and colleges producing people with relevant technical knowledge. Nationally, however, employers increasingly seek candidates with prior experience.
The UK’s 2025 cyber skills research showed how pronounced that shift had become. The proportion of core cyber job postings seeking candidates with less than one year’s experience fell from 25% in 2022 to 22% in 2023 and 17% in 2024. Around 63% sought between two and six years of experience.
That creates a structural problem for new entrants.
Training can provide knowledge, but employers often want evidence that candidates can apply that knowledge in real environments. Candidates cannot acquire such evidence without somebody providing an initial opportunity.
Regional skills activity therefore needs to connect education with experience.
Employer engagement, mentoring, placements, realistic projects and practitioner-led activity can help students understand how cyber work differs from classroom exercises. Employers gain opportunities to encounter potential recruits before formal hiring processes.
The Hub was well placed to support these connections because it sat between education and industry rather than belonging exclusively to either.
Its skills role was consequently not to replace universities or training providers. It was to make the transition between learning and work more navigable.
Entrepreneurship Required More Than Generic Startup Support
Cyber founders represent another audience with distinctive requirements.
Many of the fundamentals of company building are common across technology sectors: identifying customers, validating demand, developing a proposition, managing cash and building a team.
Cyber businesses also encounter particular market conditions.
Customers may require substantial assurance before allowing a new supplier access to sensitive systems. Enterprise sales cycles can be long. Security buyers are exposed to large numbers of vendors making similar claims. Technical credibility is essential, but technical quality alone does not establish a repeatable commercial model.
A regional cyber entrepreneurship programme therefore needs to connect founders with both general business capability and sector-specific market understanding.
This is especially important in the West Midlands because the region can provide access to potential customers facing industrial and operational cyber problems.
Founders able to engage with manufacturers, engineering companies, technology users and other organisations confronting genuine security requirements gain something more valuable than abstract market feedback.
They gain evidence about what customers will actually prioritise and purchase.
The early Hub programme created a context in which entrepreneurship could sit alongside practitioners, businesses and universities rather than being isolated within a startup-only environment.
That proximity can improve the quality of company development.
Universities Contributed More Than a Talent Pipeline
Universities were central to the Hub’s formation and early programme, but their role extended beyond producing graduates.
Academic institutions contribute research, technical expertise, facilities, entrepreneurship and relationships with students across multiple disciplines. They can also provide neutral environments for investigating problems whose solution requires collaboration between organisations.
Cyber security increasingly benefits from that breadth.
Industrial cyber requires interaction with engineering. AI security draws on computer science, data, governance and risk. Online harms involve digital forensics, behavioural research and safeguarding. Cyber policy intersects with economics, regulation and public administration.
A regional Hub can make these capabilities more accessible to organisations that might otherwise have limited engagement with universities.
The relationship should also work in the opposite direction.
Businesses expose researchers and students to operational problems, commercial constraints and emerging technology requirements. Those signals can inform research questions, teaching and collaborative projects.
The early 2026 programme therefore provided another interface between academic capability and regional demand.
The value lay in exchange rather than simply institutional participation.
Cyber Innovation Needed Real Problems
Innovation programmes can easily become supply-led.
Researchers and companies develop technology and subsequently search for organisations willing to adopt it. This can produce technically sophisticated solutions to problems that customers do not consider sufficiently important to justify procurement.
A stronger regional model begins with demand as well as supply.
Manufacturers, public bodies, SMEs and larger technology users encounter practical security problems. Some can be addressed using established products and services. Others expose gaps where new approaches may be valuable.
Connecting innovators with these environments helps distinguish between novelty and useful innovation.
This is particularly important for cyber security because customers are understandably cautious about unproven technology. A product designed to protect important systems needs credible evidence that it works and can be operated safely.
Universities, established organisations and specialist practitioners can all contribute to that validation process.
The Hub’s early programme placed innovation within a wider community containing potential users rather than treating it as an independent activity.
That principle has considerable regional value. Innovation becomes economically meaningful when it connects with adoption.
The Hub’s Value Depended on Partnerships
No single regional organisation possessed all the capabilities required by the programme.
That was not a weakness in the model. It was one of the reasons the Hub existed.
Universities could contribute education and research. Cyber resilience organisations could provide practical support. Commercial providers possessed specialist expertise. Professional communities brought practitioner knowledge. Technology organisations could connect the initiative with the wider regional digital economy. Government programmes provided national frameworks and resources.
The Hub’s role was to create a more accessible interface across those capabilities.
This required partnership rather than institutional expansion.
If an existing organisation already provided an effective service, there was little value in creating a Hub-branded duplicate. The stronger intervention was to make that service easier for the relevant audience to discover and access.
The same principle applied to communities.
The Hub did not need to own every professional network in order to support a stronger regional community. Providing space, introductions and shared infrastructure could be more valuable than attempting to centralise activity.
This partnership model also imposed a useful discipline: success depended partly on whether other organisations found the Hub worth using.
A Programme Calendar Was Not the Same as an Outcome Framework
The density of activity during the first quarter of 2026 demonstrated that the Hub could convene a substantial programme.
That was an important operational achievement, but it was not sufficient evidence of regional impact.
Events are outputs.
The more meaningful questions concern what participants were subsequently able to do.
Did an SME improve its security posture after receiving support? Did a student obtain useful experience or employment? Did a founder acquire a customer? Did a university establish a productive industry collaboration? Did practitioners form relationships that improved how organisations responded to later problems?
These outcomes take longer to observe and are more difficult to attribute.
They are nevertheless the measures that determine whether regional cyber infrastructure creates lasting value.
The early programme should therefore be understood as the beginning of an evidence base rather than proof that every intervention was successful.
Its purpose was partly to discover which forms of activity generated useful progression and which attracted participation without producing comparable downstream value.
That learning would become increasingly important as the regional model matured.
The First Quarter Established an Operating Philosophy
Viewed retrospectively, the January–March 2026 programme is most useful because it reveals the operating philosophy emerging around the Hub.
The first principle was accessibility. Businesses and individuals needed routes into cyber capability that did not depend on already understanding the institutional landscape.
The second was practicality. Awareness and networking had value, but activity needed to connect with identifiable problems: business resilience, employment, company building, innovation and professional development.
The third was partnership. Regional infrastructure should make existing expertise easier to use rather than reproduce it unnecessarily.
The fourth was specialisation within community. Different audiences required different forms of support and trusted spaces, even while benefiting from connection with the wider ecosystem.
The fifth was progression. Training should lead towards experience, business support towards improved capability, entrepreneurship towards customers and community activity towards durable professional relationships.
These principles were more significant than any individual event on the programme.
They provided a basis for determining what a regional cyber Hub could reasonably contribute.
What the Early Programme Demonstrated
The West Midlands Cyber Hub entered 2026 with a physical presence and an emerging community. The first-quarter programme began answering the more difficult question of whether that infrastructure could become practically useful.
The answer was not contained in the number of events alone.
Its significance lay in the breadth of problems the programme attempted to connect: SME resilience, practitioner development, education, employment, entrepreneurship, innovation and collaboration between organisations that normally operate in different parts of the regional economy.
That breadth also revealed the limits of the Hub.
A single organisation could not become the region’s cyber training provider, consultancy, accelerator, professional association, university interface and innovation agency simultaneously. Nor should it try.
The more credible role was connective.
The Hub could provide a recognisable entry point, convene communities, make expertise easier to discover, create practical programmes with specialist partners and identify where people or businesses were struggling to move from one stage to another.
The January–March 2026 programme should therefore be read as an early implementation chapter in the development of West Midlands cyber capability. It showed how a physical home could begin operating as shared infrastructure rather than simply as a venue.
Later developments would extend the regional model further. The significance of this period lies in the foundations it established: regular activity rather than occasional convening, practical support rather than awareness alone, different pathways for different communities, and a partnership model in which the Hub’s purpose was to connect regional capability rather than attempt to contain it.
Those principles provided an important bridge between establishing a home for the West Midlands cyber community and developing the more extensive regional relationships that would follow.