The UK has no shortage of cyber strategies, guidance and support initiatives. The harder task is helping organisations understand what they mean, decide what matters and put proportionate measures into practice.

This challenge is at the centre of Beyond Policy to Place: Building the Delivery Infrastructure for Cyber Resilient Growth, a new report produced by East Midlands Cyber Security Cluster founder Dr Ismini Vasileiou in conjunction with the Research Institute for Sociotechnical Cyber Security (RISCS).

The report examines how national cyber, digital and industrial policy can translate into practical support for businesses, sectors and regions. It focuses particularly on SMEs, which may lack specialist teams and can find the current mix of advice, standards, funding and support difficult to navigate.

Strengthening cyber resilience

The report draws on a strategic roundtable convened by De Montfort University and EMCSC at the UK Global R&D and Science Investment Summit, held at The Royal Society during London Tech Week in June 2026. The invitation-only discussion brought together representatives from government, industry, higher education, professional bodies and regional organisations.

Participants explored the gap between national policy and practical implementation. They considered how place-based delivery could help organisations strengthen cyber resilience, build workforce capability and adopt digital technologies with greater confidence.

The report also incorporates feedback gathered after the roundtable and wider policy evidence. Its aim is to turn the issues raised into a practical agenda for discussion and action across government, industry, academia, professional bodies and regional partners.

The missing middle

A central theme is the “missing middle” between national ambition and organisational capability.

National guidance may be available, but many organisations still need help to interpret it, identify priorities and apply it to their circumstances. For smaller businesses, responsibility for digital security may sit with a managing director, finance lead, general IT provider or another colleague without dedicated cyber expertise.

The report argues for a stronger translation layer which would give organisations access to plain-English information, board-level prompts, sector-relevant examples, implementation tools and trusted routes to specialist support. Regional cyber clusters, universities, professional bodies and business networks could help provide this connection between policy and practice.

This reflects EMCSC’s wider role as a regional convenor, bringing together businesses, education, cyber professionals and policymakers to turn UK cyber strategy into regional action.

Resilience supports growth

Beyond Policy to Place positions cyber resilience as part of the infrastructure needed for economic growth.

Cyber resilience includes prevention, but it also covers an organisation’s ability to respond, recover, adapt and continue operating when disruption occurs. Stronger capability can support business continuity, supply-chain confidence and the safe adoption of new technology.

This is increasingly important as artificial intelligence becomes embedded in business operations. The report considers AI-enabled threats and defensive tools, alongside questions about supplier assurance, data flows and the protection of organisational knowledge. It calls for secure AI adoption to form part of the UK’s wider cyber resilience and industrial growth agenda.

The report also highlights the need for a broader approach to cyber skills. Technical expertise remains essential, while future leaders will also need to understand governance, organisational risk, communication, supplier relationships and business continuity.

Five recommendations

The report sets out five areas for further action:

• Establish a coordinated national-to-regional cyber resilience delivery model that builds on existing UK capability.
• Develop sustained regional capacity through shared funding and ownership.
• Create a practical translation layer that helps SMEs act on national cyber and AI guidance.
• Update the cyber resilience agenda to address the risks and opportunities arising from AI.
• Develop leadership, skills and professional pathways that span technology, governance and organisational decision-making.

The emphasis is on connecting and strengthening existing expertise rather than creating another separate initiative. This means clarifying routes to support, reducing duplication and giving regional and sector-based organisations the continuity needed to build trusted relationships.

Call for practical action

The report proposes a staged approach. Initial work would map existing guidance, programmes, regional support and professional pathways to identify duplication and gaps. The next phase would develop regional and sector-based communities of practice, prioritising SMEs, supply chains, secure AI adoption and board-level governance.

Over the longer term, the report calls for a sustainable governance and funding model supported by evidence about organisational capability, workforce development and economic impact. Learning from regional delivery could then inform national policy, guidance and future investment.

Dr Ismini Vasileiou said: “The UK does not lack cyber policy, guidance or expertise. The challenge is turning that national capability into practical and proportionate action for organisations on the ground.

“This report sets out how government, industry, universities, professional bodies and regional cyber clusters can work together more effectively to close that gap. It recognises cyber resilience as an essential business capability that supports secure AI adoption, stronger supply chains and sustainable economic growth.

“Our aim is to start a focused conversation about delivery and build a clearer, trusted route from national policy to the SMEs, sectors and regions it is intended to support.”

Prof Genevieve Liveley, RISCS Director, said: “RISCS is delighted to see the publication of this report by RISCS Honorary Fellow, Dr Vasileiou, highlighting the ‘missing middle’ between policy and action, and culminating in robust recommendations and a pathway to delivery that recognises collective cyber resilience.”

Beyond Policy to Place is intended to provide a basis for continued engagement with policymakers and delivery partners. Its goal is a more coherent system in which national policy is easier to navigate and organisations can access practical, proportionate support through trusted regional and sector networks.

Read the full report: https://riscs.org.uk/2026/10/20/new-report-beyond-policy-to-place-building-the-delivery-infrastructure-for-cyber-resilient-growth/