The Numbers That Should Keep CISOs Up at Night
Google's carbon emissions jumped 25% year-over-year. Amazon's climbed 16%. Both companies dropped their sustainability reports in early July 2026, and if you're a security or compliance professional responsible for cloud risk posture, those numbers deserve your attention — not just the sustainability team's.
Here's why this matters beyond environmental reporting: when your primary cloud providers can't control their own carbon footprint, you're looking at regulatory exposure, supply chain risk, and a compliance landscape that's about to get a lot more complicated. The same infrastructure powering your Microsoft 365 tenant, your AWS workloads, and your Azure deployments is generating emissions at a pace that makes net-zero targets look like wishful thinking.
Neither company explicitly blames AI for the surge. But read between the lines of their own reports, and the connection is impossible to miss. Both acknowledge energy consumption has spiked as AI usage scales. Both devote multiple pages touting AI's environmental benefits — which, honestly, feels like protesting too much.
The carbon intensity metric both companies track — pollution per dollar of revenue — tells the real story. China has been pushing for this exact metric in climate treaty negotiations for years, and now we're seeing what happens when the world's largest tech companies can't keep pace.
The AI Connection Nobody Wants to Admit
Let's be direct: the sustainability reports from Google and Amazon read like corporate damage control. Both companies acknowledge rising energy use. Both reference AI's growing role in their operations. Neither puts the two facts together in a way that makes executives uncomfortable.
That's the problem. When your cloud provider's emissions are climbing faster than their revenue, you've got a material risk that affects everything from regulatory compliance to business continuity. Security teams need to understand this because it's not just an ESG story — it's a governance, risk, and compliance story.
Google's carbon intensity metrics show they're struggling to decouple growth from pollution. Amazon's reports reveal the same pattern, just with different numbers. Both companies are investing heavily in renewable energy — years of purchasing power kept their direct energy carbon relatively stable. But renewables plus batteries can't scale fast enough to meet the new data center load that AI demands.
So what happens when you can't keep up with clean energy? You pivot to natural gas. Both companies have begun investing in fossil fuel infrastructure, and that's where things get interesting from a compliance perspective. Governments are watching. Regulators are asking questions. And the carbon intensity numbers don't lie.
Scope 3 — Where the Real Emissions Hide
Here's where most people miss the story. The bulk of Amazon's and Google's growing carbon footprint doesn't come from their own operations — it comes from Scope 3 emissions. That's the category that includes goods and services they buy, products they sell, and everything in between.
For these companies, Scope 3 means GPU purchases. It means the manufacturing of phones and tablets that run on their cloud services. It means the entire supply chain that supports AI inference and training.
Google's Scope 3 emissions increased by 2.1 million metric tons last year alone. That's double what they were in 2019 — their baseline year for climate commitments. Amazon's rising Scope 3 comes mostly from capital goods and fuel or energy used in their operations, which includes data centers and warehouses.
This matters for security and compliance teams because Scope 3 emissions are exactly the kind of indirect risk that shows up in audit findings. When your cloud provider can't control their supply chain emissions, you inherit that exposure. It's not direct responsibility, but it's absolutely part of your vendor risk management equation.
The construction angle is particularly nasty. Data centers require massive amounts of steel and cement — both heavy polluters with low-carbon alternatives that simply aren't ready at the scale needed. Every new facility adds embodied carbon to the equation before it even turns on.
The Data Center Buildout Race
Amazon added more data center capacity globally than any other company in 2025. We're talking over 1.2 gigawatts in the fourth quarter alone. That's not a typo — that's 1,200 megawatts of new load in a single quarter.
Google's not far behind. Both companies are in a race to build infrastructure that can handle AI workloads, and they're doing it at a pace that makes renewable energy deployment look sluggish by comparison. The result? A growing reliance on natural gas power plants to fill the gap.
This creates a compliance time bomb. When your cloud provider is building data centers faster than they can power them cleanly, you're looking at regulatory exposure that could affect everything from carbon reporting requirements to potential future taxes on emissions-intensive infrastructure.
The security angle here is subtle but important. Data centers are critical infrastructure. When they're being built at this velocity, quality control becomes a concern. Construction shortcuts, electrical safety issues, fire suppression system gaps — these aren't just environmental risks, they're operational risks that affect availability and resilience.
Your cloud security incident response playbook should account for infrastructure buildout risks. When providers are moving this fast, the likelihood of incidents increases. It's basic risk management.
The Supply Chain Problem Nobody's Talking About
Let's talk about semiconductors, because they're the hidden emissions monster in AI infrastructure. GPU and memory chip manufacturing uses enormous amounts of energy. Leading-edge chip factories in Asia run on fossil-fuel-dominated grids — we're talking coal-heavy power systems in regions with limited renewable alternatives.
Then there's the chemical problem. Semiconductor manufacturing uses potent greenhouse gases — compounds that are thousands of times more warming than equivalent CO2 over a 100-year period. These aren't theoretical risks; they're real emissions that show up in Scope 3 calculations.
For security and compliance teams, this supply chain reality matters because it affects vendor risk assessments. When your cloud provider's emissions are driven by suppliers you can't directly control, you're dealing with a governance challenge that extends far beyond your own organization.
The steel and cement problem is similar. Data centers require massive structural components, and the carbon footprint of those materials is enormous. Low-carbon alternatives exist in theory but aren't available at the scale needed for global data center expansion. This means every new facility carries embodied carbon that won't go away for decades.
This is why your third-party risk management program needs to look at supply chain emissions, not just direct operational metrics. The companies you depend on are only as clean as their suppliers.
What This Means for Your Cloud Security Incident Response Playbook
Here's where this all comes together for security professionals. The emissions crisis at Google and Amazon isn't just an environmental story — it's a risk management story that should reshape how you think about cloud security posture.
Your incident response playbook needs to account for infrastructure buildout risks. When providers are constructing data centers at this velocity, the probability of operational incidents increases. Electrical failures, cooling system issues, construction accidents — these aren't hypotheticals.
Compliance teams need to understand that Scope 3 emissions create indirect regulatory exposure. As governments tighten carbon reporting requirements, your cloud provider's supply chain emissions could affect their ability to meet contractual obligations. That's a business continuity risk.
The 365 ecosystem depends on this infrastructure. Microsoft 365 tenants, Azure services, the entire cloud-native stack — they all run on data centers being built at unprecedented scale. When that infrastructure carries increasing environmental and operational risk, your security posture changes too.
Update your vendor risk assessments. Include emissions trajectory in your cloud provider evaluations. Make sure your incident response procedures account for infrastructure-related disruptions. This isn't optional anymore — it's basic due diligence.
The Cost of Catch-Up
So what does it actually take to fix this? The reports suggest a multi-pronged approach that's both ambitious and expensive.
First, you need to ramp up renewable energy purchases dramatically. Both companies are already doing this, but they're playing catch-up against infrastructure that's expanding faster than clean energy can be deployed.
Second, you need heavy investment in advanced steel and cement manufacturing. Low-carbon alternatives exist but aren't commercially viable at the scale required for global data center construction. That means billions in R&D and capital investment.
Third, you need to buy many millions of tons of carbon removal credits. This isn't offsetting in the traditional sense — it's active carbon capture and storage at industrial scale. The technology exists, but the cost is substantial.
Here's the honest assessment: it's still possible to meet net-zero targets. But AI's embrace has made it significantly harder and far more expensive. The companies that thought they could buy their way out of this problem with renewable energy credits alone are now facing a reality check.
For security and compliance professionals, the takeaway is clear. Infrastructure risk isn't just about cybersecurity anymore. It's about environmental sustainability, supply chain resilience, and regulatory compliance all rolled into one. Your incident response playbook should reflect that complexity.
The cloud providers are aware of the problem. They're investing heavily in solutions. But the gap between commitment and reality is widening, not narrowing. That's a risk you can't ignore.