West Midlands Cyber
Join the Cluster

Cyber as Industrial Infrastructure

Advanced manufacturing increasingly depends on connected operational systems, digital supply chains and AI-enabled processes. That makes cyber resilience an issue of productivity, continuity and competitiveness — not simply IT security.

Contents

Table of Contents

Cyber Resilience Is Industrial Infrastructure for the West Midlands

The West Midlands is increasingly being described as a region whose next phase of growth will be shaped by applied technology rather than technology adoption in the abstract. TechWM’s West Midlands Tech Review 2026 frames artificial intelligence, cyber security and other frontier technologies as capabilities that influence productivity and competitiveness across advanced manufacturing, mobility, energy, health and the wider regional economy.

That framing is important, but it also exposes a structural issue. As industrial production becomes more dependent on connected operational technology, software, cloud services, remote access, data exchange and digitally coordinated supply chains, the resilience of those systems becomes inseparable from the resilience of the industrial activity they support. The originating analysis, The Missing Layer in the West Midlands Tech Narrative: Cyber as Industrial Resilience Infrastructure, argued that this resilience layer was being underweighted in regional technology narratives. The underlying proposition remains sound: a more digitised industrial economy carries more operational cyber dependency, and those dependencies increasingly affect continuity, assurance and competitiveness rather than remaining confined to the IT function.

For the West Midlands, this is not a generic argument about cyber security becoming more important. The regional significance comes from the composition of the economy itself. A region with substantial manufacturing, engineering and supply-chain activity is exposed to cyber risk through production systems, industrial control environments, connected equipment and supplier relationships that can have direct operational consequences. That creates the basis for a regional cyber proposition centred less on generic security services and more on industrial resilience, operational technology, supply-chain assurance and the secure adoption of new technologies.

What does this mean for manufacturers? The West Midlands Cyber Hub looks at the practical cyber risks facing manufacturers across the region, including operational technology, connected equipment, remote access, supply chains and recovery, in the companion article “Five Cyber Risks Facing West Midlands Manufacturers”.

Key Takeaways

  • Increasing industrial digitisation turns cyber disruption into a production and continuity risk, particularly where operational technology and digitally coordinated supply chains are involved.
  • Industrial and OT security remain relatively specialised parts of the UK cyber market, with DSIT identifying industrial and OT security in 10% of provider web offerings and SCADA/ICS capability among 7% of firms.
  • The West Midlands has a plausible basis for industrial cyber specialisation because regional demand is linked to manufacturing, engineering and operational systems rather than to a purely digital economy.
  • AI and wider technology adoption increase cyber dependency by adding new software, data, infrastructure and supplier relationships into already complex operational environments.
  • A mature industrial cyber ecosystem requires more than demand: it also depends on procurement access, commercial progression, workforce capability and stronger connections between cyber suppliers and industrial customers.

Industrial Digitisation Changes the Nature of Cyber Risk

The effect of digitisation on manufacturing is often discussed in terms of productivity, automation and flexibility. The same transformation also changes the failure modes of industrial systems. Production environments that once relied on relatively isolated machinery increasingly depend on combinations of operational technology, industrial control systems, enterprise software, cloud platforms, remote support tools, sensors, data services and supplier connectivity.

The cyber consequence is not simply a larger number of devices to secure. The more important change is that digital systems increasingly participate directly in physical production. An incident affecting identity systems, remote maintenance, industrial networks or supporting software can therefore interrupt manufacturing output, affect product quality, delay logistics or restrict the availability of critical equipment. In an industrial context, the boundary between information security and operational resilience becomes progressively less useful.

This is one reason why industrial cyber security differs from conventional enterprise security. Availability and safety often carry greater weight, equipment lifecycles can extend over decades, maintenance windows may be limited, and systems cannot always be patched or replaced at the pace expected in conventional IT environments. Older technology may remain operational because replacing it would involve significant capital expenditure or production disruption. At the same time, increased connectivity means that systems originally designed for controlled environments can become dependent on networks and services well beyond the factory floor.

The consequence is a form of accumulated dependency. Digitisation can improve industrial performance while simultaneously increasing the number of components whose failure or compromise can affect operations. The resilience question therefore needs to be considered alongside the adoption case rather than treated as a later security exercise.

Industrial Cyber Remains a Specialist Part of the Market

The UK cyber market is broad, but industrial capability remains comparatively specialised. DSIT’s 2026 sectoral analysis identifies 2,603 firms active in cyber security, of which 80% offer information risk assessment and management and 80% provide professional services. By comparison, only 10% of firms are classified as offering Internet of Things capabilities, including automotive and connected devices, while 7% provide security associated with SCADA and industrial control systems.

A separate analysis of company web data reaches a similar conclusion. Industrial and OT security appears among the identified products and services of 10% of providers, compared with 63% for security consulting and advisory services, 62% for governance, risk and compliance, and 46% for both security operations and incident response. Those figures should be treated as indicative rather than exhaustive because they are based on web-content classification, but they are still useful in showing the relative weight of different capabilities within the market.

The imbalance is significant for an industrial region. General cyber capability is widely available, but experience of operational systems, industrial constraints and production environments is less common. That creates a potential mismatch between the structure of cyber supply and the requirements of organisations whose principal risks sit inside operational rather than purely corporate systems.

The issue is not that every manufacturer requires a highly specialised OT security provider. Many risks remain conventional: identity compromise, phishing, ransomware, vulnerable remote access, poor supplier controls and weak recovery arrangements can affect industrial organisations in much the same way as any other business. The distinction becomes important where those controls intersect with production environments, long-lived equipment, safety requirements or systems whose disruption carries immediate operational cost.

Supply-Chain Digitisation Extends the Resilience Boundary

Industrial organisations rarely operate as isolated enterprises. Production depends on suppliers, logistics providers, technology vendors, maintenance contractors, software platforms and customers exchanging information and accessing shared systems. As more of those relationships become digitally mediated, the effective cyber boundary of an organisation extends beyond the systems it directly owns.

This creates a particular problem for manufacturing-heavy economies because disruption can propagate through commercial dependencies. A supplier may have no access to core production technology and still create operational risk if it provides scheduling data, software updates, remote diagnostics or components that cannot be substituted quickly. Conversely, a manufacturer with strong internal controls may remain vulnerable to disruption originating elsewhere in the supply chain.

The relevant unit of analysis therefore becomes the operational system rather than the individual organisation. A supply chain can contain firms with very different levels of cyber capability, bargaining power and technical maturity, while still depending on continuous exchange between them. This is one reason assurance requirements have become more prominent in procurement: buyers increasingly need evidence that suppliers can manage risks that might otherwise be imported into their own operations.

For West Midlands SMEs, this dynamic has a commercial dimension as well as a resilience one. Businesses operating in automotive, aerospace, defence and advanced manufacturing supply chains may encounter cyber requirements because of their position within a wider assurance environment, even where they are not independently regulated. Security maturity can therefore influence qualification, contract renewal and access to larger customers.

AI Adds New Dependencies to Existing Industrial Systems

The adoption of AI is likely to intensify rather than replace these dependencies. DSIT identifies 111 firms in the UK explicitly providing cyber security for AI systems, a 68% increase from the previous baseline. The services offered include model security, AI security consulting, runtime and infrastructure protection, red-team testing and emerging work around agentic systems.

For industrial organisations, the more immediate issue is not the size of the AI security market but the way AI enters operational environments. AI can be incorporated into maintenance, quality control, demand forecasting, engineering, workforce support and production optimisation. Each use case can introduce additional relationships with data, cloud infrastructure, models, software libraries and external vendors.

The security implications therefore sit within existing operational architecture. An AI-enabled process may be new, but it still depends on familiar disciplines such as access control, software assurance, data protection, supplier management and monitoring. What changes is the number and complexity of components involved, together with the consequences of relying on outputs that may influence physical or commercial decisions.

The West Midlands Tech Review 2026 places strong emphasis on applied frontier technology and identifies adoption, rather than access to innovation, as a central regional challenge. It also highlights persistent barriers among mid-sized businesses, including legacy systems and gaps in digital, data and cyber skills. Those constraints are directly relevant to industrial cyber resilience because organisations are being asked to integrate new technologies into environments that may already contain ageing infrastructure and uneven security maturity.

Regional Demand Does Not Automatically Create a Cyber Cluster

A manufacturing-heavy economy creates demand for industrial cyber capability, but demand alone does not produce a mature regional sector. The original analysis identified a progression problem: firms may be able to form and establish early capability without necessarily gaining the procurement access, commercial validation, growth capital or customer relationships required to become durable mid-sized providers.

The national data gives some context to that problem. The UK cyber market now contains 241 firms generating more than £10 million in annual revenue, compared with 105 two years earlier, showing that a more substantial middle tier is emerging nationally. At the same time, investment into dedicated cyber firms fell to £184 million across 47 deals in 2025, from £206 million across 59 deals in 2024.

For a regional industrial cyber ecosystem, the route to scale may therefore depend heavily on customer access. A specialist provider that can validate technology or services with regional manufacturers, engineering businesses or infrastructure operators gains more than a sale; it gains evidence that its proposition works in demanding operational environments. Those reference relationships can support entry into larger procurement channels and markets outside the region.

This is where cluster infrastructure can perform an economic function rather than simply a networking one. Connections between industrial buyers, cyber providers, universities and specialist skills can reduce some of the friction involved in identifying problems, testing solutions and building trusted commercial relationships. The value lies in improving progression between capability and market adoption rather than merely increasing the number of organisations associated with a regional cyber community.

Industrial Resilience Requires Better Regional Evidence

There is a credible case for treating industrial cyber resilience as a West Midlands specialism, but the available evidence remains incomplete. National market data shows that industrial and OT security is a recognisable but relatively specialised part of the UK cyber sector. Regional technology analysis confirms that the West Midlands is pursuing greater adoption of AI, cyber and other advanced technologies across an industrial economy. Neither dataset, however, provides a sufficiently detailed picture of industrial cyber demand within the region.

A stronger evidence base would need to examine several connected questions: which operational cyber risks are creating the greatest cost or constraint for regional firms; how much industrial cyber expenditure is currently captured by West Midlands suppliers; where manufacturers struggle to source specialist capability; which assurance requirements are shaping supply-chain participation; and whether regional cyber firms are building defensible expertise around operational environments.

Those questions are important because regional specialisation should follow demonstrated capability and demand rather than branding. The existence of a large manufacturing economy is a necessary condition for an industrial cyber proposition, but it is not sufficient evidence that the region already possesses a mature industrial cyber cluster.

Cyber Resilience Should Be Treated as Part of Industrial Capability

The most useful consequence of viewing cyber through an industrial lens is that it changes where responsibility for resilience sits. If operational technology, digital supply chains, AI-enabled systems and connected infrastructure contribute directly to production, then their security cannot be treated solely as an internal technology issue. It becomes relevant to investment decisions, supplier management, operational governance and industrial strategy.

For the West Midlands, this creates a more specific proposition than attempting to compete on the breadth of the cyber market. The region has a plausible route to differentiation at the intersection of cyber capability, industrial systems, and operational dependency, particularly if specialist providers can work closely with organisations adopting new technologies in production environments.

The unresolved issue is whether that demand can be converted into durable regional economic value. Doing so requires evidence of where capability already exists, stronger pathways between cyber suppliers and industrial buyers, and mechanisms that allow successful providers to progress beyond early-stage growth. Without those elements, the region may continue to generate substantial demand for cyber resilience while much of the associated commercial value is captured elsewhere.

Treating cyber resilience as industrial infrastructure therefore leads to a demanding but testable regional objective: the West Midlands should be able to demonstrate not merely that its industries depend on secure digital systems, but that the region is developing the specialist firms, skills, assurance mechanisms and commercial relationships required to secure those systems effectively.