The hidden climate cost of insecure networks

AS SINGAPORE steps up to defend its status as a smart, sustainable city, a silent siege is unfolding in the critical infrastructure systems that power our everyday life.

In July this year, Coordinating Minister for National Security K Shanmugam announced that Singapore was under a live cyber-espionage attack by UNC3886, a highly sophisticated group targeting essential infrastructure sectors – from energy and water to healthcare and finance. 

The assault was active, striking at the very trust that underpins our societal and environmental progress. This incident underscores a critical yet often-overlooked connection: In this era of digital-physical convergence, safeguarding our foundational systems is both a national security issue and a sustainability imperative.

Cybersecurity is an integral component of a resilient, green future.

The carbon cost of an insecure Internet

Every compromised system carries a hidden environmental cost. For example, devices taken over by a botnet – a network of thousands of infected computers – are forced to churn through central processing unit (CPU) cycles and electricity.

While the energy usage of a single device may be modest, it scales into a significant environmental footprint when multiplied across the entire network.

Many compromised systems put malicious content on cloud platforms. Data centres already must contend with growing artificial intelligence demands. If they have to distribute malicious payloads or host command-and-control systems, the environmental impact grows.  

Fewer botnet attacks mean fewer wasted CPU cycles, leading to lower carbon emissions. There is, therefore, a case to frame cybersecurity as part of climate action. 

People power and digital trust

The resilience of critical infrastructure also depends on people. According to the 2024 ISC2 Cybersecurity Workforce Study, the cybersecurity workforce gap in the Asia-Pacific stands at over 3.3 million.

For Singapore, a nation that has pledged to become both a global financial hub and a green digital capital, this gap is a systemic vulnerability.

Cybersecurity practitioners are feeling this pressure, as 90 per cent of respondents indicated that they have one or more skills gaps on their cybersecurity teams. Budget was the No 1 cause for both talent and skills shortages, the respondents said.

Yet, security operations live or die on talent. Properly funded training programmes do more than close a skills gap; they create upward mobility in an industry where median salaries top those of many traditional sectors.

Professional development can help equip individuals – be they internal employees, non-cybersecurity technology professionals, or even non-technology trained individuals – with the necessary skill set to take on cybersecurity roles.

Partnerships with institutes of higher learning can deliver advanced curricula and expose students to the cutting-edge technologies and real-world challenges faced by cybersecurity practitioners.

Investing in human capital also delivers the diverse perspectives needed to tackle complex sustainability challenges.

Companies that treat such investments as core to their social agendas build resilience in two ways: They strengthen the human firewalls inside their own networks, and broaden the pool of defenders available to society at large.

A call for integrated thinking

Climate strategies often focus on electrification and renewables, while overlooking the digital scaffolding that keeps those systems trustworthy. Therein lies an opportunity to merge both schools of thought.

As boards, investors and regulators crank up the pressure on companies to meet climate change targets and sustainability reporting requirements, cybersecurity commitments must be scrutinised with the same rigour.

Cybersecurity and data laws are constantly being reviewed, revised and passed across the Asia-Pacific. Singapore amended its Cybersecurity Act in 2024, Indonesia penned its cybersecurity Bill earlier this year, and Vietnam will be passing its own cybersecurity law in 2026.

The minutiae in these regulations increasingly demand prompt and comprehensive incident notification, disclosure of an organisation’s cybersecurity control maturity, and mandatory penalties when breaches occur.

Regulators and companies should fold cybersecurity into climate-disclosure frameworks, utilities should factor cyber risk into life-cycle carbon models, and sustainability officers should sit at the same table as chief information security officers when net-zero road maps are drawn.

Towards a secure cyberspace and low-carbon future

No single company can solve the climate or cybercrime crises alone, but the security sector is in a unique position to influence both.

By linking incident-response key performance indicators with sustainability dashboards, boards can make data-driven decisions that advance environmental, social and governance (ESG) goals.

This turns public relations slogans into real, measurable progress.

A secure digital ecosystem wastes less energy, protects critical infrastructure, and builds trust on which transparent ESG reporting depends. Cybersecurity is therefore not a cost centre on the periphery of sustainability; it is a catalyst at its core.

The writer is deputy chief executive officer of Group-IB