An automated response can stop ransomware quickly and still cause serious harm if it disconnects a hospital computer or a bank workstation at the wrong moment. Romanus Prabhu Raymond of ManageEngine uses that tension to explain why ethical cybersecurity is an operational requirement rather than an abstract statement of values.
His approach extends security beyond defending systems to protecting organisations, individuals, and society responsibly. Privacy, transparency, fairness, and human oversight must shape how data is collected and how controls act, especially as AI increases the speed and reach of detection and containment.
Security teams regularly make choices between confidentiality, availability, safety, and privacy rather than maximising one value without limit. Ethical practice gives those trade-offs a repeatable process, ensuring exceptional emergency powers are justified, recorded, time-limited, and reviewed once the immediate threat has passed.
Fast Containment Can Create New Harm
Customers wanted aggressive responses to ransomware families such as Akira and Ryuk, but automatic quarantine can interrupt clinical care, payments, or other critical operations. The security event and the defensive action therefore belong in the same risk calculation. Scale makes the surrounding controls more important, since a small error rate can still create substantial operational work when the system handles millions of interactions. Sampling should therefore continue after launch, with high-consequence cases receiving more scrutiny than routine low-risk outputs.
Organisations can classify assets by operational criticality and predefine proportionate responses. Isolation may be immediate for an ordinary endpoint, while a critical device triggers rapid human approval, network segmentation, or a restricted operating mode that preserves essential service. Evaluation should include total operating cost, correction effort, and recovery time alongside speed or benchmark results. Otherwise, apparent efficiency can simply move work to another team or a later stage. Finance and operations should agree the calculation so favourable activity measures do not substitute for realised value.
Ethical by Design Extends Beyond Compliance
Raymond described ethical cybersecurity as responsible protection of systems, people, and society. ManageEngine says it embeds fairness, transparency, and accountability during product design and does not treat customer data as something to monetise or monitor without purpose. The development is best understood as a reallocation of work across software, infrastructure, and people rather than as the removal of human responsibility. Job design and training should change deliberately so staff retain the knowledge needed to recognise and resolve unusual cases.
Principles need observable implementation: data minimisation, documented model inputs, access reviews, meaningful notices, and test results for false positives. Procurement teams should ask for those artefacts instead of accepting broad assurances about trustworthy AI. Human review should be concentrated where consequences are highest rather than added as a ceremonial final click. Reviewers need context, authority, and enough time to recognise when automation has crossed a boundary. Their corrections should improve rules and tests, turning oversight into an active learning mechanism instead of hidden rework.
Privacy and Security Are Not Opposites
The source compared responsible monitoring with security cameras that protect a neighbourhood without pointing into residents’ windows. Effective defence can focus on relevant signals and behaviour rather than collecting every available piece of employee or customer information. Its value will vary by workload, which makes segmented measurement more useful than a single average drawn from the easiest or most visible use cases. Reporting should include weak segments and abstentions, not only the aggregate that presents the system most favourably.
Privacy-preserving design reduces breach impact and can improve signal quality by forcing teams to justify collection. Security analysts still need enough context to investigate, so purpose-specific access and time-limited escalation are preferable to either unlimited surveillance or deliberate blindness. Distributional checks are essential: averages can hide weak performance for a language, location, customer group, or unusual workload. Feedback from people closest to the process should shape the next deployment decision. Publishing known limitations internally also helps users choose when another tool or a human specialist is more appropriate.
Humans Need Authority Over Automation
AI systems can correlate alerts and act faster than analysts, but their confidence may not reflect the real-world cost of a mistake. Ethical deployment keeps people involved where business continuity, rights, or safety can be affected. What appears to be one product decision is consequently a chain of choices about data access, integration, monitoring, escalation, and long-term maintenance. Mapping those choices early gives decision-makers a realistic budget and reveals where a reversible trial is preferable to a broad commitment.
Oversight must be operational: named responders, reachable escalation channels, rehearsed playbooks, and interfaces that explain why a control recommends action. A human who lacks time or authority to intervene is not a meaningful safeguard. The deciding factor is likely to be execution discipline: realistic baselines, clear ownership, routine monitoring, and a workable exit path. Those elements convert an impressive capability into dependable infrastructure. They also give leaders a common language for comparing competing proposals whose marketing claims otherwise use incompatible measures.
Independent measurement will be particularly valuable where suppliers define the headline metric or where future specifications remain subject to change. Ethical security is not softer security. It asks a harder question: whether a control reduces total harm in the environment where it operates. The answer requires technical evidence, local context, and people authorised to choose continuity or containment when neither option is risk-free.
