Building Regional Cyber Capability

Practical support, cyber clinics, skills activities, events and stronger connections between businesses and specialists formed the core of the West Midlands Cyber Hub programme in 2026. We look at how these activities helped strengthen cyber capability across the region.

Contents

Building Regional Cyber Capability: The West Midlands Cyber Hub Programme in 2026

At the beginning of 2026, the West Midlands Cyber Hub was moving from launch into delivery. Having opened at Millennium Point in Birmingham in November 2025, the immediate challenge was no longer to make the case for a regional cyber focal point, but to demonstrate what such a platform could do in practice.

The programme developed for the opening months of 2026 reflected that transition. It combined business engagement, cyber resilience, skills, innovation and community activity, while continuing to build relationships between organisations already working across the regional ecosystem.

The originating New Year update, Merry Christmas and Happy New Year 2026 from the West Midlands Cyber Hub, set out the programme as it stood in January. Looking back later in 2026, it provides a useful record of the Hub’s first operational phase and of the priorities that were emerging as the initiative moved beyond its pre-launch period.

The significance of that programme was not simply the number of activities planned. It was the attempt to translate the idea of a regional cyber ecosystem into something organisations could actually participate in.

Read the wider regional perspective. The West Midlands Cyber Cluster examines how the programme contributes to the development of sustained cyber capability across the West Midlands, in the companion article “Building Regional Cyber Capability: The West Midlands Cyber Hub Programme in 2026”.

Key Takeaways

• The opening 2026 programme marked the transition from establishing the West Midlands Cyber Hub to testing how it could support businesses, practitioners, students, researchers and the wider community.
• Business resilience, skills, innovation and community-building were treated as connected elements of regional cyber capability rather than as independent programmes.
• A regional Hub can add value by creating accessible routes into existing expertise and support, rather than attempting to deliver every cyber service itself.
• The programme provided an early test of the hub-and-spoke principle, in which Millennium Point acts as a focal point while regional partnerships extend activity across the West Midlands.
• The longer-term measure of success is progression: whether participation leads to stronger businesses, better cyber resilience, new collaborations, skills opportunities and more effective connections across the regional economy.

From Launch to Delivery

Opening a physical Hub creates visibility. Building useful regional capability requires considerably more.

Once the West Midlands Cyber Hub opened on 24 November 2025, attention shifted towards what businesses and communities would encounter after walking through the door.

This distinction matters because regional initiatives can become overly focused on launch milestones. A new facility, partnership or programme can attract substantial attention during its creation, but its value ultimately depends on whether organisations continue to use it and whether participation produces useful outcomes.

The opening months of 2026 were therefore an important test.

The Hub needed to begin turning the priorities identified during consultation and pre-launch activity into practical opportunities for engagement.

Those priorities included better collaboration and coordination, stronger links between education and employment, support for SMEs and business growth, greater visibility for regional cyber capability, and easier access for organisations that did not already know how to navigate the cyber ecosystem.

The programme provided the first opportunity to address those priorities through regular delivery rather than planning.

Business Engagement Had to Begin with Business Problems

One of the principles underpinning the Hub was that organisations should not need to become cyber specialists before they can ask for help.

For many SMEs, cyber security appears through another business requirement.

A customer asks for Cyber Essentials. An insurer wants evidence of security controls. A member of staff falls victim to phishing. A manufacturer becomes concerned about remote access to equipment. A company adopts a new cloud service or begins experimenting with artificial intelligence and discovers that existing policies no longer answer all of its questions.

These are business problems before they are cyber programmes.

An accessible regional Hub can provide a route through which organisations begin with the issue they are facing and are then connected with appropriate support.

That support might come from authoritative national guidance, a public-sector programme, a university, the Cyber Resilience Centre for the West Midlands, a commercial provider or another specialist organisation.

The Hub’s role is not weakened when somebody else provides the eventual solution. Effective referral is part of the infrastructure.

For SMEs in particular, reducing the effort required to identify appropriate support can be almost as important as increasing the amount of support available.

Cyber Resilience Is Broader Than Incident Prevention

The early programme also reflected a wider change in the way cyber resilience was being discussed.

Security cannot be reduced to preventing every attack.

Organisations need to reduce the probability of compromise, but they also need to understand critical systems, detect problems, respond effectively and recover when disruption occurs.

That broader approach is particularly relevant to the West Midlands economy.

Manufacturing and engineering businesses may face operational consequences when digital systems fail. Professional-services organisations depend heavily on access to information and cloud platforms. SMEs can have limited internal technical capacity and may depend substantially on external IT providers.

The practical resilience question is therefore not simply whether a business has security software.

It is whether the organisation understands its dependencies and can continue or recover when something important goes wrong.

Regional activity around resilience can help businesses move from general awareness towards that operational understanding.

For some organisations, the next step may be relatively straightforward: introducing multi-factor authentication, testing backups or obtaining Cyber Essentials. Others may need to examine supply-chain dependencies, privileged access, industrial systems or formal incident-response arrangements.

A regional support model needs to accommodate that variation rather than assuming every organisation begins from the same point.

Skills Were Part of the Economic Programme

Cyber skills were another important strand of the Hub’s early activity.

The skills challenge is sometimes described as a simple shortage of people, but regional labour markets are more complicated.

Employers need different forms of capability. A security operations team requires different expertise from a governance function. A cyber product company needs software engineering and commercial skills alongside security specialists. Industrial organisations may need people capable of understanding both cyber risk and operational technology.

At the same time, students and people considering cyber careers need clearer routes into the organisations employing those skills.

This makes employer engagement essential.

Training programmes are more valuable when participants can see how their learning relates to actual roles. Employers benefit when they can engage with potential recruits and explain where capability is difficult to find.

Smaller companies have particular reason to participate.

They rarely possess the recruitment budgets or graduate programmes of major employers and can therefore be much less visible to students, even when they offer substantial responsibility and valuable technical experience.

The Hub can help create the relationships through which those employers and prospective employees encounter one another.

Young People Need Visible Routes into Cyber

Building regional capability also requires looking further ahead than immediate vacancies.

Young people frequently encounter cyber security through stories about hacking, online crime or highly technical specialist roles. That can create interest, but it can also produce an unnecessarily narrow picture of the profession.

The sector includes technical operations, software development, governance, risk, assurance, research, consulting, sales, product development, policy and education.

There are also cyber-related roles inside organisations that would never describe themselves as cyber companies.

Regional programmes can help make this variety visible.

Engagement with schools, colleges, universities and community organisations provides opportunities to show how cyber skills relate to different industries and career paths.

The objective should not be to persuade every young person to become a cyber-security specialist.

It is to make the routes sufficiently visible that those with relevant interests and abilities can understand the opportunities available and how to reach them.

For the West Midlands, there is an additional economic benefit when people can see credible careers within the region rather than assuming that the most interesting technology opportunities exist elsewhere.

Innovation Needed Routes into the Regional Economy

The West Midlands contains substantial research and innovation capability, but the existence of that capability does not guarantee that it will connect with regional businesses.

Universities may possess expertise relevant to cyber security, artificial intelligence, connected systems and online safety. Cyber SMEs may be developing products that address emerging security problems. Established organisations may have operational challenges that could provide valuable environments for testing and applying new approaches.

Regional infrastructure can bring those elements together.

A company developing industrial cyber technology benefits from understanding how manufacturers actually operate. A university researcher can gain from engagement with organisations experiencing the problem being studied. A business adopting AI may discover specialist security expertise through a network it initially approached for a different reason.

These connections do not always require a formal innovation programme at the outset.

Often the first requirement is simply a place or network through which the relevant people can discover one another.

The early Hub programme created opportunities for those conversations to happen.

The longer-term challenge is ensuring that promising conversations have routes towards pilots, research collaboration, commercial relationships or investment where appropriate.

A Cyber Hub Should Connect Supply with Demand

Regional cyber initiatives can become inward-looking if most participants already work within the sector.

Professional networking has value, but cyber businesses ultimately need organisations that will buy and use their services.

The West Midlands provides a substantial demand environment.

Its manufacturing and engineering base creates requirements around industrial resilience, connected systems and supply chains. Professional-services firms need to protect information and digital workflows. Technology companies need secure products and infrastructure, while organisations across the economy are beginning to confront security and governance questions associated with AI.

A regional Hub can help connect this demand with local and regional capability.

For cyber SMEs, that creates opportunities to understand customer problems and build commercial relationships.

For the wider business community, it makes specialist expertise more visible.

The strongest regional cyber economy is therefore not one in which cyber companies form an isolated cluster. It is one in which cyber capability becomes integrated with the industries and organisations that need it.

Community Activity Provided the Connective Layer

Events and community activity formed a visible part of the Hub’s first operational period.

Their role went beyond filling an events calendar.

Regional ecosystems depend on repeated interaction. People need opportunities to encounter organisations outside their immediate professional networks and to build enough familiarity that collaboration becomes easier.

A single meeting may lead to very little. Repeated participation can create something more durable.

Practitioners begin to understand where expertise exists. Founders discover who can advise on a particular commercial problem. Universities build relationships with businesses. Students become familiar with employers. Organisations seeking cyber support learn which parts of the regional network they can approach.

This accumulated knowledge is difficult to represent in a conventional programme metric, but it reduces friction across the ecosystem.

The important qualification is that community activity must lead somewhere.

Attendance is evidence of engagement, not evidence of impact. The stronger outcomes are referrals, partnerships, customer relationships, investment conversations, research collaboration and career opportunities that emerge afterwards.

As the Hub moved through 2026, those progression measures became increasingly important.

Millennium Point Was a Base for a Regional Model

The Hub’s location at Millennium Point gave the West Midlands cyber community a visible home in Birmingham.

That visibility was useful during the transition from concept to delivery. Organisations could identify a physical location with the initiative, events had a focal point, and informal interactions could take place alongside programmed activity.

The Hub was nevertheless intended to serve a region considerably larger than central Birmingham.

West Midlands cyber capability is distributed across different economic centres, universities, business communities and local networks.

The practical model therefore needs to remain hub-and-spoke.

Some activity can take place at Millennium Point. Other programmes and events should work through partners and communities elsewhere in the region.

This approach avoids the false choice between having a central focal point and maintaining genuine regional reach.

A strong Hub can do both.

Its physical location provides identity and accessibility, while its partnerships allow capability to extend beyond the building.

Partnership Was Essential to Delivery

The Hub’s early programme was built within a wider partnership environment.

Funded by the Department for Science, Innovation and Technology through Innovate UK and led by the regional Cyber Tzar, the initiative was supported by organisations including Aston University, TechWM, the Innovation Alliance for the West Midlands, the Cyber Resilience Centre for the West Midlands and Midlands Cyber.

The significance of that structure is functional rather than ceremonial.

Different partners bring different capabilities.

Universities contribute research, skills and facilities. Business and technology networks connect companies. Cyber-resilience organisations provide specialist support. Public bodies can connect activity with wider economic and policy objectives.

No single partner needs to become all of those things.

Indeed, attempting to consolidate every function inside the Hub would risk weakening the ecosystem by duplicating existing expertise.

The partnership model works when organisations retain their specialist roles while the regional platform makes collaboration and referral easier.

That principle is particularly important as the Hub develops beyond its initial funded phase.

Early Programmes Should Create Pathways, Not Dependency

Business-support initiatives are most effective when participants can progress beyond them.

A founder who attends an introductory programme may subsequently need customer discovery, a pilot, investment preparation or specialist commercial advice. An SME beginning with basic cyber guidance may later require certification or professional security support.

A student attending a community event may need work experience, mentoring or introductions to employers.

These needs cannot all be addressed by the same intervention.

The Hub’s role is therefore better understood as helping people move through an ecosystem than keeping them permanently within a single programme.

This requires good referral mechanisms and an understanding of what different organisations across the region provide.

It also changes how success should be assessed.

A business leaving a Hub programme because it has found the appropriate commercial provider or investor can represent success. A student moving from an event into employment is progression, not lost engagement.

Regional infrastructure should make those transitions easier.

The First Operational Phase Created Evidence for What Comes Next

Looking back at the January 2026 programme is useful because early delivery provided information that planning alone could not.

It showed which activities attracted participation, which issues generated business interest and where partnerships could be strengthened.

It also provided a basis for the Hub’s next phase.

By the middle of 2026, the Hub had supported more than 20 sector-led events and engaged more than 750 participants during its first six months. Those figures demonstrated substantial appetite for regional cyber activity, but they also raised the next set of questions.

What happened after participation?

Were businesses progressing towards stronger cyber resilience? Were cyber SMEs finding customers and support? Were founders becoming investment-ready? Were young people developing clearer pathways into employment? Were collaborations forming between businesses, universities and practitioners?

These questions mark the transition from community formation towards ecosystem development.

The first programme created activity. The next stage needs to turn more of that activity into measurable progression.

Building Capability Requires Continuity

One of the persistent challenges in regional innovation and business support is maintaining continuity beyond individual funding periods.

Short programmes can generate valuable relationships, but those relationships may weaken when the programme ends and the people involved move on to other priorities.

Cyber capability needs a longer horizon.

Businesses require support at different stages of development. Skills pipelines take years rather than months. Research partnerships develop over time, while trust between organisations grows through repeated interaction.

The Hub’s move towards an independent not-for-profit model is therefore important to the longer-term proposition.

It creates the possibility of maintaining the connective infrastructure beyond an individual public programme while developing new areas such as entrepreneur onboarding, lifecycle support for cyber SMEs and stronger investor relationships.

The objective is not simply organisational permanence.

It is continuity of function.

Regional businesses and communities need to know that the routes into cyber support, collaboration and opportunity will still exist after a particular event or funding round has concluded.

The 2026 Programme Was an Early Test of the Regional Model

The opening programme of the West Midlands Cyber Hub should be understood in the context in which it was created.

The Hub had only recently opened. The regional community had helped identify priorities, partnerships were being established, and the practical operating model was still developing.

The programme was therefore not a finished regional cyber system.

It was an early test of one.

Business engagement tested whether the Hub could provide a useful front door into support. Skills activity explored how education, practitioners and employers could connect more effectively. Innovation engagement created opportunities to bring research and commercial problems together, while community activity strengthened the relationships on which the wider ecosystem depends.

Those strands shared a common purpose.

They were intended to make existing West Midlands capability easier to access and more effective when connected.

That remains the relevant measure of regional cyber infrastructure.

The success of a Hub is not determined by how much activity it can absorb into itself. It is determined by whether the businesses, universities, practitioners, investors, students and public organisations around it become better connected and more capable as a result.

The early 2026 programme marked the point at which the West Midlands Cyber Hub began testing that proposition through delivery. The work that followed would determine how effectively those initial connections could be converted into stronger businesses, better resilience, new careers and a more coherent regional cyber economy.