Making Cybersecurity and AI Sustainable

### Overview At RSAC Conference 2025, hosts Jameson Kush and Jen English spoke with Sean John, Chief Technology Officer at NCC Group, regarding the critical intersection of cybersecurity, artificial intelligence, and environmental sustainability. While enterprise discussions often highlight AI's features and potential benefits, Sean emphasizes the urgency of elevating sustainability and resource consumption into mainstream technology planning. Training and running modern large language models (LLMs) demands immense computational power and cooling, creating urgent challenges around energy use and operational costs alongside traditional data protection concerns.

### Key Topics - **Evolution of AI and Machine Learning in Security:** Machine learning has protected endpoints and security systems for 15 to 20 years, coping with the surge from signature-based detection to millions of daily threat variants. Machine learning represents a mature field with extensive experience in adversarial techniques, whereas LLMs represent a newer, highly resource-intensive subset of AI. - **Avoiding the GenAI 'Trough of Despair':** An estimated 70% of enterprise generative AI and LLM projects fail due to vague executive mandates rather than specific, well-defined use cases. Sean argues that organizations should avoid building giant, monolithic models and instead focus on narrow use cases, tailored pre-existing models, and emerging agentic AI architectures. - **Securing AI and Utilizing AI within Security:** NCC Group approaches AI through three core pillars: providing security services for AI (including red teaming and risk management), leveraging AI capabilities internally for security services (such as Spanish-team research on deepfakes and multi-channel phishing simulations), and improving internal business operations (e.g., proposal generators to enhance consistency and productivity). - **The Double-Edged Nature of Green Infrastructure:** Transitioning to sustainable computing inherently relies on renewable energy and distributed systems like smart grids and operational technology (OT). Because renewable sectors feature numerous smaller entities requiring robust OT security, cybersecurity simultaneously acts as an energy consumer and an indispensable protector of green infrastructure.

### Technical Details & Optimization Strategies - **Compute Efficiency vs. Speed:** Enterprises often unnecessarily over-provision resources. For instance, the academic advanced computing facility at Edinburgh University demonstrated that lowering clock speeds on analytical models (e.g., extending a run from 72 to 96 hours) saved approximately 15 gigawatts of power. - **Heat Reuse Initiatives:** Data center cooling demands mirror legacy mainframe water cooling needs. Practical projects explore routing waste heat to heat university campuses or storing heat in flooded mines to warm nearby residential housing estates. - **Architectural and Operational Tactics:** - Prioritizing wide, shallow models over deep recursive models to reduce compute cycles. - Employing spatial shifting (moving workloads where grid demand is low) and time shifting (executing computations during off-peak hours). - Selecting task-appropriate models (e.g., utilizing simpler architectures like GPT-2 or traditional scripts rather than calling top-tier models like GPT-4 for basic queries). - Implementing cloud cost profiling, guardrails, and billing caps for consulting and engineering teams. - **Data Governance as the Root Problem:** Broad LLM rollouts often expose sensitive internal data because past data security relied on obscurity rather than genuine governance. Sean compares prompt firewalls to historical 'sticking plaster' solutions like legacy DLP, calling for generative AI to be applied toward classifying which enterprise data actually matters.

### Takeaways - **Adopt 'Secure by Design' and 'Green by Design':** Organizations must treat environmental sustainability with the same architectural importance as security controls. - **Challenge Unnecessary AI Usage:** Before deploying large models, teams must evaluate whether a task truly requires generative reasoning, a smaller machine learning model, or simply an automated deterministic script. - **Learn from Cloud and Data Precedents:** Rather than repeating past missteps—such as turning data lakes into unsearchable data swamps—security leaders must proactively integrate compute-saving, data-gravity, and sustainability lessons into their ongoing AI strategies.