West Midlands Cyber
Join the Cluster

The West Midlands Cyber Economy Is Changing

The UK’s cyber sector is evolving beyond traditional security services towards a broader role in economic and industrial resilience. We examine the latest sector data and what regionalisation, productivity, and changing technology dependencies mean for the West Midlands.

Contents

Table of Contents

The UK Cyber Economy Is Changing Shape — What It Means for the West Midlands

The UK cyber security sector continues to expand, but the pattern of growth is changing. The Department for Science, Innovation and Technology’s Cyber Security Sectoral Analysis 2026 estimates that the sector now comprises 2,603 firms generating £14.7 billion in annual cyber revenue and approximately £9.1 billion in Gross Value Added (GVA). Employment has reached almost 69,600 full-time-equivalent roles, yet workforce growth of 3% is the slowest recorded since the current series began in 2018. Revenue, by comparison, increased by 11% and GVA by 17%.

Those differences are more informative than the headline growth figures alone. They point towards a sector generating more value without expanding employment at the same rate, while product companies take a larger share of employment growth, and a substantial middle market develops beneath the largest providers. At the same time, cyber capability is becoming more geographically distributed and increasingly embedded within diversified technology, telecommunications, consultancy, defence, and engineering businesses, rather than residing exclusively in specialist cyber firms.

This article develops the regional implications first explored in an earlier analysis of the 2026 sectoral data. For the West Midlands, the central issue is not whether the region can reproduce another established UK cyber cluster. It is whether a region with substantial industrial, engineering and supply-chain activity can convert the growing dependence of those industries on secure digital systems into a distinctive cyber capability of its own.

What does this mean for your business? The West Midlands Cyber Hub looks at what the changing UK cyber economy means in practice for West Midlands businesses, including SMEs, technology companies and organisations looking to strengthen their cyber capability in the companion article “The Changing Cyber Economy for West Midlands Businesses“.

Key Takeaways

  • UK cyber revenue grew by 11% and GVA by 17%, while employment increased by only 3%, indicating that productivity and scalable delivery are becoming more important to sector growth.
  • Product-led cyber firms now account for 39% of sector employment and have driven most of the latest employment increase, although services and managed security remain the larger share of the market.
  • The West Midlands accounts for 6% of identified UK cyber offices but an estimated 8% of cyber employment, suggesting a larger regional workforce than registered location data alone would indicate.
  • The number of cyber firms generating more than £10 million annually has risen from 105 in 2024 to 241 in the 2026 analysis, creating a more substantial middle market alongside large providers and startups.
  • The West Midlands case is strongest where cyber capability intersects with industrial digitisation, operational technology, supply-chain assurance and the region’s existing economic base.

Revenue and GVA Are Growing Faster Than Employment

The 2026 figures show an unusual combination of continued commercial expansion and much slower workforce growth. Annual cyber revenue increased from approximately £13.2 billion to £14.7 billion, while sector GVA reached £9.1 billion. Consequently, GVA per employee rose from £116,200 to £131,200, an increase of 13%, while the GVA-to-turnover ratio improved from 0.59 to 0.62. DSIT interprets these measures as evidence of increasing productivity within the sector.

The data does not establish a single cause for that increase in productivity. It would therefore be premature to attribute the change wholly to automation, artificial intelligence or any particular business model. The employment breakdown, however, does provide some indication of where the sector is changing. Product-based firms now employ an estimated 27,164 cyber professionals, representing 39% of sector employment, compared with 23,952 in the previous report. Employment in services and managed security has remained broadly stable at around 42,400. Average cyber team size has also fallen from 31 to 27 employees, with the average among large enterprises declining from 204 to 180.

Taken together, these measures suggest that future growth may increasingly depend on the ability to generate more value from specialist teams, reusable technology, and scalable delivery models, rather than on headcount expansion. Services remain economically dominant, generating approximately £8.4 billion compared with £6.4 billion from product companies, so this is not evidence of a wholesale transition from services to software. It is better understood as a change in the balance of growth within a market that continues to require both.

For regional economic development, that distinction affects what success looks like. Counting cyber jobs remains useful, but it does not capture whether companies are increasing productivity, developing intellectual property, creating products that can be sold repeatedly, or building delivery models capable of reaching markets beyond their immediate geography.

A Larger Cyber Middle Market Is Emerging

Large companies still account for around 70% of UK cyber security revenue, with an estimated £10.36 billion in cyber revenue attributable to large firms. Their dominance should not obscure a significant change beneath them: DSIT now identifies 241 cyber providers generating more than £10 million annually, compared with 219 in the previous study and 105 two years earlier. Average cyber revenue among small firms has also increased by approximately 25%.

This expansion of the middle market is potentially more consequential for regional ecosystems than growth in the number of firms alone. The UK has become relatively effective at generating small technology companies, but regional economic value depends heavily on whether those businesses can progress beyond early-stage formation into sustainable employers and suppliers with repeatable revenues, established customers and the capacity to enter larger procurement environments.

Cyber companies attempting that transition face requirements that are only partly technical. They need commercial validation, reference customers, procurement readiness, access to specialist talent, sufficient capital, and relationships with larger organisations that can become customers or channel partners. Regions that can connect these elements create better conditions for firms to scale locally rather than reaching a point at which relocation, acquisition or dependence on customers elsewhere becomes the most viable route to growth.

Investment conditions make that progression question more significant. Dedicated UK cyber firms raised £184 million across 47 deals in 2025, down from £206 million across 59 deals in 2024. Investment has declined year-on-year since 2022, although DSIT notes that this is part of a wider reduction in UK private-company investment rather than being unique to cyber security.

The combination of a growing middle market and a more constrained investment environment places greater weight on revenues, customers and procurement access as mechanisms for scaling. For the West Midlands, industrial demand may therefore be as important to cyber-sector development as the availability of investment in conventional technology.

Regional Data Reveals a Different West Midlands Footprint

The geographical distribution of the sector also requires more careful interpretation than a simple count of company addresses. Just over half of identified UK cyber security office locations are now outside London and the South East. The West Midlands accounts for 6% of those offices, behind London, the South East, the North West, the South West, Scotland and the East of England. Viewed only through office locations, the region appears to occupy a respectable but relatively modest position in the national market.

Employment modelling produces a different result. DSIT estimates that the West Midlands accounts for 8% of UK cyber employment, compared with only 3% when employment is allocated by registered company location. With national cyber employment estimated at 69,589 FTEs, an 8% regional share would correspond to roughly 5,600 roles, although that figure is derived from the published national total and regional percentage rather than being reported by DSIT as a standalone West Midlands headcount.

The methodology helps explain the difference. Regional employment estimates incorporate major employers, multiple office locations, workforce estimates, vacancy data and broader labour-market evidence rather than assigning employment solely to a company’s registered address. The West Midlands is therefore one of the regions where registered-location data most clearly understates estimated employment: its modelled share is more than twice its registered share.

This does not prove that the West Midlands possesses an unusually mature cyber ecosystem, nor does it identify where those workers sit within the regional economy. It does indicate that assessments based primarily on cyber-company headquarters are likely to miss a material part of regional capability. That is particularly relevant because 31% of the firms in the national dataset are diversified businesses for which cyber is one activity among several, while 83% of large cyber providers fall into that diversified category. DSIT specifically identifies larger diversified providers developing cyber capabilities for markets including aerospace and defence, critical national infrastructure and professional services.

The practical implication is methodological as much as economic. A serious assessment of the West Midlands cyber economy needs to identify specialist cyber companies, but it also needs to understand cyber teams and capabilities embedded within larger employers whose primary industrial identity lies elsewhere.

Industrial Demand Changes the Regional Proposition

The West Midlands does not need to mirror the characteristics of London or other established cyber concentrations to build a stronger position in the sector. Its potential advantage lies in the relationship between cyber capability and an economy containing substantial manufacturing, engineering, transport and supply-chain activity.

That relationship becomes more significant as industrial operations become increasingly dependent on digital systems. Connected operational technology, remote maintenance, cloud-hosted production systems, industrial software, data exchange between suppliers and greater use of automation have expanded the number of digital dependencies involved in producing and moving physical goods. A cyber incident affecting those dependencies can therefore manifest as production interruption, delayed fulfilment, loss of engineering data or disruption across a supplier network rather than remaining confined to an organisation’s IT environment.

The national provider data shows that industrial cyber is already a defined, though comparatively specialised, part of the market. DSIT identifies 10% of cyber firms as offering IoT-related capabilities, including automotive and connected devices, while 7% offer SCADA and industrial control systems capabilities. These proportions are considerably smaller than those for professional services, risk management or network security, which may reflect the more specialised nature of operational environments and the expertise required to work within them.

For the West Midlands, the potential economic relationship runs in both directions. Regional industry creates demand for cyber capabilities that understand operational constraints, while cyber firms gain access to customers and use cases against which to validate products and services. If those relationships become sufficiently dense, the region can develop expertise that is difficult to reproduce through generic cyber provision alone.

That proposition should be tested rather than assumed. Existing national data does not quantify how much West Midlands cyber activity is directly attributable to manufacturing, automotive or other industrial demand, nor does it show how much regional expenditure on cyber products and services is captured by suppliers based within the region. Both are significant evidence gaps if industrial cyber resilience is to become a serious component of regional economic strategy.

AI Expands Both Supply and Dependency

Artificial intelligence provides another indication of how the market is broadening. DSIT identifies 111 UK firms explicitly offering cyber security for AI systems, up from 66 in the previous baseline, an increase of 68%. Thirty-two of those businesses are specialist AI-security providers, while the larger group offers capabilities including model security, advisory services, runtime and infrastructure security, and red-team testing.

The immediate commercial significance lies in the creation of a new security market around AI systems. The broader regional significance comes from the adoption side. As organisations incorporate AI into software development, analytics, engineering, customer service, and operational decision-making, they add dependencies on models, training and operational data, cloud infrastructure, software supply chains, and third-party platforms. Some of these risks fit established cyber disciplines; others require additional forms of assurance and governance.

There is not yet enough evidence in the sectoral analysis to conclude how large the AI-security market will become or how activity will be distributed regionally. DSIT itself cautions that the proportion of employment specifically attributable to AI security cannot be determined from the available data. The useful conclusion is therefore narrower: cyber provision is already adapting to AI adoption, and regions pursuing AI-enabled industrial transformation will need to consider the security of those systems as part of the adoption process rather than as a separate downstream activity.

Regional Strategy Should Measure Capability, Demand and Progression

The 2026 analysis exposes a measurement problem for regional cyber policy. Firm counts, registered addresses, employment estimates, revenues and investment each reveal something different about an ecosystem, but none provides a complete account of whether a region can develop and retain commercially valuable cyber capability.

For the West Midlands, three areas require better evidence. The first is the scale and composition of embedded cyber employment within diversified regional employers. The gap between the region’s registered and modelled employment shares suggests that this component is substantial enough to warrant direct investigation.

The second is demand. If industrial cyber resilience is a plausible regional specialism, the region needs evidence about what manufacturers and other operational businesses actually purchase, where capability gaps occur, which assurance requirements affect their supply chains and how much of that expenditure is captured regionally.

The third is progression. Nationally, the number of firms exceeding £10 million in cyber revenue has more than doubled in two years, while investment conditions have become more restrained. A useful regional measure would therefore examine how many West Midlands cyber businesses are progressing through revenue bands, gaining larger customers, exporting, participating in procurement frameworks and developing scalable products or services. That would reveal more about ecosystem maturity than startup counts alone.

The Strategic Question Is How the Regional Economy Uses Cyber Capability

The strongest conclusion from the 2026 sectoral data is that the West Midlands has not yet established a distinctive national cyber specialism. The available evidence does not support such a definitive claim. What it does show is that the region has a larger estimated share of UK cyber employment than its registered-company footprint suggests, at a time when the national sector is becoming more productive, more commercially substantial in its middle tier, and increasingly intertwined with diversified businesses.

That combination warrants a different approach to regional cyber development. Rather than treating cyber primarily as a standalone technology sector whose success can be judged through firm formation and employment growth, the West Midlands can examine how cyber capability interacts with the industries already responsible for a significant share of its economic activity. In that model, dedicated cyber firms remain important, but so do embedded teams, industrial customers, universities, procurement pathways and the ability of regional suppliers to progress into larger markets.

The principal evidence gap is now regional rather than national. DSIT provides a robust view of the direction of the UK sector, but it cannot show in sufficient detail how cyber demand, employment, expenditure, and commercial capability are connected within the West Midlands economy. Establishing that picture would allow the region to distinguish genuine comparative advantage from attractive narrative and to direct investment, business support and cluster activity towards areas where cyber capability can make a measurable economic contribution.

The case for a stronger West Midlands cyber economy should therefore rest on more than the proposition that cyber is growing nationally. It should be built on evidence of where regional demand originates, where specialist capability already exists, which firms have the potential to scale, and how effectively those elements can be connected. That is a more demanding test of regional strength, but it is also a considerably more useful one.