Using GenAI to secure the delivery of CNI (Critical National Infrastructure)

Critical National Infrastructure programmes operating in secure environments face a paradox: the GenAI tools now demonstrably capable of transforming software engineering productivity cannot always be introduced cost effectively into the classified spaces where they are needed most. This is the story, so far, of one practical resolution to that paradox.

In 2024, BAE Systems and Capgemini began exploring automation opportunities to improve engineering efficiency on CNI programmes. Early initiatives delivered rapidly — saving thousands of engineering hours — but efforts to leverage Large Language Models stalled at a fundamental boundary: the cost/benefit of installing GenAI hardware or "diode type" connections to external LLMs for this particular use case didn't stack up back in 2024.

The breakthrough came from reframing the problem. Rather than attempting to bring GenAI into the secure space, we asked: what if we bring the problem space to GenAI? Where the challenges being solved are inherently process-based rather than product-based, they can be defined and resolved at an appropriate classification level, with outputs flowing back into the secure environment through a formally defined, auditable data pathway. This is a new take on the dev low/deploy high paradigm: reclassify low, develop low, deploy high.

This insight demanded rigour. We will describe the development of a technical architecture governing data flow between classification domains, engagement with security assurance authorities, a formal design review process, and the classification of resulting tools for operational use. We will also reflect on where the approach currently relies on human oversight and process controls in place of mature assurance frameworks — and what that means for the road ahead.
The result is a growing suite of approved, classification-appropriate, GenAI-supported engineering tools actively contributing to on-time CNI delivery, and a repeatable model for others facing the same constraints.

Speakers

Greg Sugden

Principal Engineering Manager, BAE Systems Submarines

Greg is an Engineering Manager for BAE Systems Maritime – Submarines, where he manages the delivery of complex engineering solutions for high-consequence naval defense projects. Greg leverages his background in engineering management to navigate technical governance, optimize team workflows, and support the UK’s primary submarine programs.

Andrew Hawthorn

Chief Architect, Capgemini

Andrew has over 25 years’ of hands-on experience in developing complex systems and is the pre-sales lead for Capgemini Engineering UK. In this role he pulls together the engineering capability in the UK and in our global teams and combine them with Capgemini's transformation and IT capabilities to deliver truly transformational solutions for our clients.