From the diary of Tom Heritage-Barker

How a Sheffield agency founder came to build and run websites for defence, aerospace, maritime and advanced manufacturing, and what he says a buyer in those sectors should ask for.

“You would not buy a machine, run it continuously and assume that because you had paid for it once you never needed to service it.” That is the comparison Tom Heritage-Barker would put to a managing director who still thinks of a website as a brochure. A website, he says, needs “the same mindset” as the people, premises and systems a business already looks after.

The evidence he offers comes from sites he monitors. Across them, Tom says, his team blocked more than a million malicious login attempts in three months this year. “Most of those businesses had no idea it was happening, because none of it is visible from the outside.”

Tom is the founder of Grade Studio, which since July 2026 builds websites for defence, aerospace, maritime and advanced manufacturing organisations and stays responsible for them afterwards. He started it thirteen years into running TEST Creative, the Sheffield brand and web consultancy, and he is also a partner at Yorkshire AI Labs.

A website is not a brochure

When Tom started developing websites, the brochure comparison fitted. “You designed it, built it, launched it and generally expected it to sit there doing its job.” Imperva’s 2025 Bad Bot Report found that automated traffic made up 51% of all web traffic in 2024 and that bad bots alone accounted for over a third of it, at 37%.

The attacks are changing too, Tom says. They are “increasingly designed to look like legitimate activity rather than an obvious brute force attempt.”

“What I have learned after years of developing and maintaining websites is that the real value is not somebody installing updates once a month. It is familiarity and accountability.”

Tom Heritage-Barker, founder, Grade Studio

He means having somebody who knows what normal looks like on your website because they have looked after it for a year. “When something changes, they notice. When something fails, they know the environment well enough to diagnose it.” In the sectors Grade Studio works in, he no longer treats building a website and maintaining it as two jobs.

What a defence buyer asks for

The biggest difference from a brand client is evidence, Tom says. A brand client might ask whether the site is working, and a reassurance about backups and updates was usually enough. In defence, maritime and advanced manufacturing the questions are sharper: “Who has access? What happens when something fails? What is being monitored? How quickly are vulnerabilities addressed? Can you evidence it?”

“A backup existing is not the same as knowing it can be restored,” he says. “I would not want to give the impression that evidence is what makes us good.” Evidence is what a buyer needs, and “most suppliers cannot produce it.” What makes the work better is “fewer problems in the first place,” from accurate monitoring and updates that “follow from that analysis rather than from a calendar.”

The harder difference, he says, is a capability these businesses often lack. Translating hard engineering for a customer, an investor or a prime contractor “is a different skill, and it is rarely the one the people running the business have had to develop.” That work costs more, which he calls awkward, because those who need it most are often “the least comfortable carrying a large fee for it.”

The obvious objection is that all of this is the same craft under a new name.

The case against Grade Studio

The strongest version of that objection is that Grade Studio is positioning rather than capability, and that a defence buyer would rather hire a certified security specialist than a consultancy from Sheffield. Tom’s answer starts by agreeing.

“It is a repositioning, and I would not pretend otherwise. But the premise that it is positioning rather than capability is the part I would push back on, because we have built the capability and it is the reason the repositioning works at all.”

Tom, founder, Grade Studio

The capability has names. Grade Vision is “the software behind every site we deliver, and it is deliberately not a product on a price list.” Alongside it, Grade Builder is “our own WordPress stack, written from scratch and hardened, with none of the third party page builder code where most WordPress sites pick up both their weight and their vulnerabilities.” Grade Connect is “the monitoring and the change record.” Grade SEO handles structured data and review scheduling, so that a page going out of date “is something the system raises rather than something somebody has to remember.”

“A marketing team can log in and change a page, add a product or update a case study without a developer and without raising a ticket, while the engineering underneath stays locked down and accounted for.” Most suppliers, he says, offer “a hardened bespoke build nobody inside the business can edit, or an editable site sitting on a stack nobody is governing.”

On the specialist objection, he doesn’t claim to replace one. “I would not expect a defence buyer to choose Grade Studio instead of a specialist cybersecurity company,” he says. “Our responsibility is much more specific: the website.” In many organisations, he says, it is “quite an oddly governed system,” built by one supplier, hosted by another, edited by marketing and maintained by “whoever happens to notice something needs updating.” Across the websites he monitors, Tom says, uptime has been 99.98 per cent, measured cumulatively over six months, with the downtime coming from hosting environments his team doesn’t manage.

The tools came first

Much of that capability existed before the name. A lot of what is now Grade Vision, Tom says, “was being developed before we had even decided Grade Studio should exist.” The AI tools he has built are part of the same story. In a post this month he wrote that he had “trained Claude on my workflow, end to end,” so it “learns with every deployment, so each new client benefits from the lessons of the last.” Another tool texts him when a client’s site goes offline, and the fix goes into the next release of the security plugin, he wrote. Of the tools, he wrote: “None of it has replaced what clients actually come to me for.”

Why he formed the business

Tom places the decision in a run of meetings, not one conversation. He and his colleagues were looking at the companies they supported, invested time in or wanted to work with. “Increasingly, they were technical businesses operating around advanced manufacturing, engineering, defence and AI.” Since he became a partner at Yorkshire AI Labs in early 2024, he says, the conversations have moved from brand and marketing to “software, data, infrastructure, automation, commercialisation and resilience.”

Through The Digital Forge, where he is part of the founding team and CMO, the same market kept appearing. Capital at one event, defence at another, AI in manufacturing at the next, “but the conversations kept intersecting.” These were “exactly the kind of businesses I wanted to work with as an agency, not just as an investor or CMO.”

The last piece was a European maritime and defence project for Sentiq Defence, with a team that had “more than twenty five years of direct sector experience.” They recognised the standard of the work and the need for a supplier that could operate within an industry specific procurement environment. “That extra bit of confidence was probably the final validation I needed to push the button and form the business.”

Afterwards, he says, “the problem was not capability. It was that none of this made complete sense under the positioning of a general creative agency.” The weeks that followed went on giving what Grade was already doing “a much clearer identity, proposition and route into the procurement pipeline.”

Start with the customer

Asked what closes the gap between a good technical idea and a scaled business, Tom answers in one sentence.

“I think the judgement is knowing when to stop proving that something can be built and start proving that somebody will buy it.”

Tom, founder, Grade Studio

At Yorkshire AI Labs he meets founders whose maths or science is “truly world leading,” and who still describe the business “through the capability rather than the customer problem.” The advice they often get is to perfect the product, protect the IP, build more features, prepare the pitch deck and raise enough to take it to market. “I think that sequence can be dangerous.”

His alternative is to “understand who needs it, why they need it and what evidence will make them trust you, then let that knowledge influence what you build.” The question he asks is less technical: “who is your audience, and do they understand what you do?” At The Digital Forge, he says, the engineer might tell you whether it works, the investor whether it scales and the manufacturer whether they would procure it.

Where Tom Is Now

Grade Studio has launched its first public commercial project, the Italian maritime project for Sentiq Defence. Tom is also in conversation with a German company, a separate client. He has also opened Grade Partnerships: for selected companies, Grade contributes its expertise in exchange for an equity interest, “either on its own or alongside a reduced commercial fee.” “Sweat equity, effectively.” “It also keeps us honest, because our interest and theirs point in the same direction.”

He wants to hear from businesses in manufacturing and engineering, defence, aerospace and energy, and from start-ups looking for support through equity and potentially long-term VC investment. On 11 November, The Digital Forge holds “Start Here. Scale Here. Stay Here.” at Cutlers’ Hall in Sheffield. “We have the talent, we need to deploy the capital and our events play a key role in this.”

Sheffield, he says, is not a limit. What might look from the outside like humble beginnings “feels to me like an incredibly well positioned place to start.”

The Tom Heritage-Barker Playbook: Run the Website Like Infrastructure

1. Service it like a machine. Paying for a website once does not mean it never needs looking after.

2. Know what normal looks like. Tom says the value is someone who has watched the site for a year and notices when it changes.

3. Make the evidence a by-product. He says it should come from monitoring and analysis that drive the work, not the other way round.

4. Put one party in charge of the whole website. In his view, whoever runs it should be capable of taking full responsibility for it.

5. Bring the customer in early. Understand who needs it and what will make them trust you, then let that shape what you build.