Earth Day 2025: How GREEN is your Cybersecurity Automation?

Earth Day has been an annual event since April 22, 1970, with an estimated 1 Billion people participating in their own way each year, to reduce pollution, encourage the use of renewable energy, and general conservation of the planet. In the spirit of Earth Day, we are comparing the energy requirements of GPU compute for “agentic AI” security automation vs. the energy requirements of traditional CPU compute for algorithmic approaches to security automation (what we use at Wirespeed).

#TL/DR; Wirespeed is Green. Agentic AI is not.

You can see the math below, but the short version is: Agentic AI SecOps requires massively more energy than the approach Wirespeed uses. Feel free to question and challenge the math; we make our assumptions transparent using open source (OSINT) data. If anything, we are overly conservative with our estimate and believe the difference is actually far worse than we’re portraying it!

#Background Reading on AI Power Consumption:

Earth

#A Tale of Two Approaches

To set the stage of the comparison, let’s describe the compute requirements of the two approaches:

Conditional Logic. Wirespeed’s approach is a conditional logic algorithm, executing as conventional CPU compute workloads, that performs predefined decisions, explicitly written in code, that a human SOC analyst would make. Wirespeed’s 2024 MTTV (Mean Time To Verdict) was 717ms (~0.7s) across our entire fleet, and has a typical range of 0.5 seconds to 2 seconds.
“Agentic AI”. The approach used by more than a dozen cybersecurity vendors now, in which an Agentic AI model (an LLM running in GPU compute) dynamically generates all the worklow steps on the fly to perform the triage task. For simplicity, we are limiting our analysis to a smallest-case scenario: a single-threaded, single model, single-agent compute model. According to demos of many Agentic AI solutions, the typical MTTV times for their GPU based workloads is between 150-600 seconds (2.5 to 10 minutes), comprised of multiple steps like: spending 20-30s to understand a detected event, another 20-30s to generate workflow steps, another 20-30s at each step generating artifacts like SIEM, DB, or API queries, and finally another 20-30s to synthesize all of the data into a conclusion with an exposition to summarize both the event and the investigation. These steps quickly add up to a handful of minutes of GPU compute per event in the agentic workflow.

Note: In practice, it is common for Agentic AI SOC Automation solutions to be multi-threaded, multi-model, multi-agent, or use GPU clusters … far more energy consumption! We’re also going to assume that there are no other concerns with two approaches, such as LLM hallucinations, lack of repeatability, lack of transparency, or considerable slowness compared to our approach. That’s for another article or two to address.

#The Specific Automation Steps

We are estimating power consumption for the following steps of the SOC workflow:

Ingestion of security telemetry
Enrichment of that telemetry
Triaging detections in that telemetry
Pronouncement of a Verdict (actionable or not actionable)
Recommendation of Next Steps

In many situations, step 5 can be replaced with automated containment steps (we give our customers tools and choices to let us automate some or all of those steps), but for the purpose of comparing apples-to-apples, those are the steps we’re evaluating: just making sense of security telemetry and highlighting the most important events leading to a potential security incident.

#Our Assumptions

If you disagree with our math, chances are your disagreement will be right here in these assumptions, which we gather from OSINT sources. Feel free to modify the assumption and re-calculate yourself; we’re confident these are very directionally accurate and likely massively understating the energy consumption problem.

#Wirespeed Energy Consumption Rate

Wirespeed is designed to run in multiple clouds, but for the purpose of this comparison, we’ll assess our instance in AWS ECS at an energy consumption rate of 20W per vCPU.

#Agentic AI Consumption Rate

We will make an assumption that the average Agentic AI SecOps solution is running on NVidia A100 cores at an energy consumption rate of 400W per GPU.

#Carbon Impact

We are assuming the carbon footprint to be 0.111 gCO₂e/joule (400 gCO₂e/kWh) based on open data. The total amount of carbon impact depends on the energy consumption (joules), so GPUs will have a higher impact than CPUs when the total compute time is the same. However, as you’ll see, the compute times are also not the same, so the carbon impact widens even further than the overall joule rating.

Nvidia A100 GPU

#Energy Consumption per Alert

In our calculation, the smallest “atomic” workflow item is the ingestion and triage of a single security telemetry detection event. The total energy consumed per alert equals the amount of processing time multiplied by the consumption run rate (20W for AWS ECS or 400W for NVidia A100 GPUs).

[Processing Time] x [Energy Rate] = [Total Energy per Alert]

The following table reflects the energy consumption and carbon impact for the typical range of verdict times (min/max) and the mean average, according to each approach:

Approach	Time	Energy (joules)	Carbon (gCO₂e)
Wirespeed (CPU)
Min	0.5s	10	1.11
Avg	1s	20	2.22
Max	2s	40	4.44
Agentic AI SecOps (GPU)
Min	150s	60,000	6,660
Avg	300s	120,000	13,320
Max	600s	240,000	26,640

#Everyday Impact Per Alert

To illustrate the environmental cost of each alert triage, we translate the carbon footprint into relatable everyday equivalents, highlighting the dramatic difference between the two approaches.

Approach	Car Miles Driven (404 gCO₂e/mile)	Diesel Exhaust (10.18 kgCO₂e/gallon)	Trees to Offset (22 kgCO₂e/year per tree)	Household Electricity (8.925 kgCO₂e/day)
Wirespeed (CPU)
Min	0.0027 miles	0.00011 gallons	0.00005 trees	0.00012 days
Avg	0.0055 miles	0.00022 gallons	0.0001 trees	0.00025 days
Max	0.011 miles	0.00044 gallons	0.0002 trees	0.0005 days
Agentic AI SecOps (GPU)
Min	16.5 miles	0.65 gallons	0.30 trees	0.75 days
Avg	33.0 miles	1.31 gallons	0.61 tree	1.49 days
Max	65.9 miles	2.62 gallons	1.21 trees	2.98 days

A single alert triaged by an agentic AI workflow with a 5 minute processing time (in the average case) is the equivalent to driving a typical car 33 miles, powering a household for a day and a half, and has the carbon offset of nearly 2/3 of a tree!

#At Scale Impact Summary

Let’s look at the energy requirements and their impact at larger scale…

Industry publications from Gartner, Splunk, Cisco, Crowdstrike, and Verizon suggest employees generate 100-500 security events annually, so we will use a midpoint of 300 events/employee/year as a balanced estimate. We assume a 90% reduction by cybersecurity detection controls and products (that run in typical CPU compute with a lower energy impact than agentic AI), filtering these into 30 alerts per employee per year requiring triage, reflecting typical cybersecurity workflows where most events are benign or deduplicated.

The following tables show the at-scale total impact for energy, carbon, and the everyday equivalents for three different sized organizations (SMB with 250 employees, Mid-Market with 1,000 employees, and Enterprise with 10,000 employees), over an average year, using the average MTTV runtimes from the table above. For some very interesting comparisons, take a note at the energy consumption measured in household days of electricity, unleaded car miles, diesel semi-truck miles (22 gCO₂e/mile), trees and acres of deforestation (5 tCO₂e/acre), and SpaceX Falcon 9 rocket launches (77 tCO₂e/launch)

#SMB Annual Energy Impact

This is the real world energy impact for a Small-to-Midsize Business with 250 employees, generating approximately 7,500 alerts per year, using the formulas above:

Approach	Energy	Carbon	Household Electricity	Gas Car	Semi-Truck	Trees	Deforestation Acres	SpaceX Falcon 9 Launches
Wirespeed	7,500 × 20 = 150,000 joules	7,500 × 2.22 = 16,650 gCO₂e	~1.87 days	~41 miles	~36 miles	~0.76 trees	~0.003 acres	~0.0002 rocket launches
Agentic AI	7,500 × 120,000 = 900,000,000 joules	7,500 × 13,320 = 99,900,000 gCO₂e	~11,190 days (~30 years)	~247,500 miles	~216,000 miles	~4,540 trees	~20 acres	~1.3 rocket launches

#Mid-Market Annual Energy Impact

This is the real world energy impact for an mid-market organization with 1,000 employees, generating approximately 30,000 alerts per year, using the formulas above:

Approach	Energy	Carbon	Household Electricity	Gas Car	Semi-Truck	Trees	Deforestation Acres	SpaceX Falcon 9 Launches
Wirespeed	30,000 × 20 = 600,000 joules	30,000 × 2.22 = 66,600 gCO₂e	~7.46 days	~165 miles	~144 miles	~3.03 trees	~0.013 acres	~0.0009 rocket launches
Agentic AI	30,000 × 120,000 = 3,600,000,000 joules	30,000 × 13,320 = 399,600,000 gCO₂e	~44,770 days (~123 years)	~989,100 miles	~863,000 miles	~18,160 trees	~80 acres	~5.2 rocket launches

#Enterprise Annual Energy Impact

Nvidia A100

This is the real world energy impact for an Enterprise organization with 10,000 employees, generating approximately 300,000 alerts per year, using the formulas above:

Approach	Energy	Carbon	Household Electricity	Gas Car	Semi-Truck	Trees	Deforestation Acres	SpaceX Falcon 9 Launches
Wirespeed	300,000 × 20 = 6,000,000 joules	300,000 × 2.22 = 666,000 gCO₂e	~74.6 days	~1,650 miles	~1,440 miles	~30.3 trees	~0.13 acres	~0.009 rocket launches
Agentic AI	300,000 × 120,000 = 36,000,000,000 joules	300,000 × 13,320 = 3,996,000,000 gCO₂e	~447,700 days (~1,226 years)	~9,891,000 miles	~8,630,000 miles	~181,600 trees	~799 acres	~51.8 rocket launches

#Final Thoughts

We already knew Wirespeed’s approach is faster than the Agentic AI SecOps approaches, with more consistent, repeatable, and transparent decision steps, but now we can see how massively more efficient Wirespeed is over the GPU compute based LLM options as well, especially at scale! Efficiency takes into consideration all properties and we are more and more excited daily with our approach!

Greener Than AI