South Korea's cybersecurity industry has raised concerns with the presidential National Security Office over the growing presence of foreign security companies in the public and financial sectors.

The industry argues that relying on foreign products for critical security infrastructure could undermine the country's security sovereignty, leaving it exposed to price increases or supply restrictions.

Jinsoo Kim, president of the Korea Information Security Industry Association (KISIA), said at a press conference at IT Venture Tower in Seoul's Songpa district on Sept. 14 that he raised the concerns in a meeting with Song Ki-ho, third deputy director of the presidential National Security Office, on Aug. 25. KISIA is a private association with about 340 security companies as members, 98% of which are Korean companies.

The association asked the National Security Office for government support to help domestic security companies grow. "From a sovereignty perspective, it is extremely important for a country to defend its own security with domestic solutions," Kim said. "We asked the government to serve as a catalyst so that Korean security companies can grow strategically in the domestic market." After hearing the industry's concerns, Song said Korean security companies "need to succeed and we will take the lead in supporting them," according to the association.

The financial and public sectors are key sources of revenue for Korean security companies. Foreign cloud-based products had faced difficulties entering the two markets because of network separation regulations that require internal work networks to be separated from the internet, as well as security compliance reviews by the National Intelligence Service (NIS).

Regulations have been eased as demand for generative artificial intelligence (AI) has grown. The Financial Services Commission in 2024 allowed financial companies to use generative AI and software as a service (SaaS) through a regulatory sandbox. The NIS established the National Network Security Framework (N2SF), which applies different security controls according to information classification levels.

Foreign security companies have also begun supplying products to the public sector. The Bank of Korea adopted equipment from Palo Alto Networks in August last year for a pilot "one-PC" project that integrates internet and work functions into a single PC, and has since introduced additional equipment. The products underwent an NIS security compliance review and are operated alongside Korean products.

The association argues that greater dependence on foreign products could make them difficult to replace. Foreign security companies provide integrated security products covering an enterprise's PCs and servers as well as networks and cloud infrastructure, making it difficult to switch to other products once they have been adopted. "If global products become widely adopted and we eventually lose security sovereignty, there could be risks such as sharply higher maintenance costs or vendors restricting sales of solutions to certain companies," Kim said.

Young-chul Choi, senior vice president of KISIA, said technical standards should first be established to allow domestic and foreign products to be compared on the same basis.

However, giving preferential treatment to Korean products in the public and financial sectors could raise concerns about reverse discrimination against foreign companies. Apart from establishing technical standards, the association did not propose specific measures for supporting domestic security companies.

Naver began developing an artificial intelligence (AI) model specialized for cybersecurity after export controls on Anthropic’s Claude disrupted access to the service.

The disruption led the company to conclude that it could not rely on overseas models for its security capabilities.

Kim Jin-hwi, an executive director at Naver Cloud’s Security Division, disclosed the circumstances at the AIDC Security Technology Workshop held at Militopia Hotel in Seongnam, Gyeonggi Province, on Sept. 7. Kim, a former National Intelligence Service official, joined Naver in April. He oversees infrastructure security across the group, including Naver, Naver Cloud and Naver Webtoon.

“The service was interrupted midway because of export controls,” Kim said. “After experiencing that problem, we decided that we needed to build our own AI model.”

The US Department of Commerce in June ordered Anthropic to suspend access by all foreign users to Claude Fable 5 and Claude Mythos 5, citing national security concerns. Access to the two models was blocked for 19 days until the department lifted the restrictions. Mythos 5 remains available only to certain approved organizations.

Kim also pointed to limitations of overseas models. “Foreign models don’t have an understanding of the domestic threat environment,” he said. “Their guardrails, or AI control mechanisms, also pose major problems for how we use them.” He added that the episode made Naver realize it could not depend on overseas providers for its security policies and capabilities.

Kim said, however, that Naver does not plan to handle all AI security tasks with its own model. The company intends to continue using external solutions for tasks including vulnerability assessments.

According to Kim, Naver is already using existing AI models in actual security operations. AI automatically scans all ports on about 100,000 externally exposed servers twice a day. The company also operates a system in which a red team responsible for attacks and a blue team responsible for defense and patching exchange results and repeatedly validate vulnerabilities.

As Naver prepared its own model, it also built an in-house “harness” that connects AI models with vulnerability-analysis tools and execution environments. “Using this harness, we reproduced all of the open-source vulnerabilities that Mythos had discovered,” Kim said. Naver’s security team identified and reported 29 previously undisclosed high-risk vulnerabilities during the process, he said.

Against that backdrop, the government announced a project in late July to develop an AI foundation model specialized for cybersecurity. Naver Cloud formed a consortium and applied. “There were many areas that were difficult to address at the level of a single company,” Kim said. “It is an opportunity to build GPU resources, data and validation capabilities on a national scale.”

The consortium, comprising Naver Cloud and 32 other organizations, was selected on Sept. 3 as the final contractor for the government’s project to develop an AI foundation model specialized for cybersecurity.

Naver will contribute 4,000 of its own GPUs. The consortium aims to train Naver’s HyperCLOVA X and LG’s EXAONE on security data to develop a mixture-of-experts (MoE) security model with 700 billion parameters. The completed model will also be deployed on domestic AI chips from FuriosaAI and HyperAccel to validate its performance.

Development will begin on Sept. 18. With Minister of Science and ICT Bae Kyung-hoon saying the security-specialized model will be unveiled within the year, the consortium is targeting a demonstration in December. An interim evaluation will follow in February next year, with the project scheduled to conclude in July. Naver plans to release the final model as open source and distribute it through application programming interfaces (APIs) and software development kits (SDKs), allowing Korea’s cybersecurity industry to use it.

Smilegate's new title "Eclipse: The Awakening," or "Eclipse," launched on PC and mobile at noon on Sept. 10. The game is a key project for Smilegate after its operating profit fell 30% last year, while developer NPIXEL is seeking to offset an operating loss of 12.3 billion won. With Com2uS's new title "Zeus," released about two weeks ago, holding the top spot in mobile game sales, attention is turning to how Eclipse will perform.

Eclipse is a free-to-play game with in-app purchases. The company designed its monetization model to attract users early on while reducing the burden of spending. According to Smilegate, the game secured 1 million pre-registrations before launch. During the first round of character pre-creation on Aug. 19, all 24 available servers reached capacity within 25 minutes. Some streamer servers filled up in just one minute. Smilegate increased capacity and opened a second round the following day, but that also closed within a day.

The game's core concept is "MMOLite," designed to reduce the time commitment, spending pressure and intensity of player competition typically associated with massively multiplayer online role-playing games (MMORPGs). A key example is "Sanctuary," which accumulates character-growth resources and summon tickets even while users are offline. An AI mode allows gameplay to continue automatically after users exit the game. Player-versus-player (PvP) combat is also disabled in most areas.

The monetization system follows the same approach. Eclipse does not allow users to directly purchase "cash accessories" that boost character stats. Some growth-related products are subject to weekly or monthly purchase limits rather than being available without restriction. The goal is to minimize the gap between hardcore and casual players. From a financial perspective, however, the policy could lower average revenue per user (ARPU) by reducing the incentive to spend. The model therefore depends on maximizing the overall number of paying users.

The importance of Eclipse's commercial performance is evident in the financial statements of Smilegate and NPIXEL for last year.

Smilegate posted consolidated revenue of 1.4365 trillion won and operating profit of 359.8 billion won in 2025. Revenue fell 5.6% from the previous year, while operating profit declined 30%. Net income dropped about 36% to 302.3 billion won.

The stakes are even higher for developer NPIXEL. According to its audit report, the company generated 13 billion won in revenue last year. Sales have continued to decline from 67 billion won in 2022 to 31.6 billion won in 2023 and 14.2 billion won in 2024. NPIXEL posted an operating loss of 12.3 billion won last year. It cut operating expenses to about 25.4 billion won from 67.6 billion won a year earlier, narrowing its operating loss by about 77% from 53.4 billion won in 2024. Despite the cost reductions, revenue has yet to recover.

NPIXEL also faces pressure from its financial structure. At the end of last year, the company had 7.7 billion won in current assets, compared with 56.3 billion won in current liabilities, more than seven times as much. Total assets stood at 14.8 billion won and total liabilities at 66 billion won. Total equity was negative 51.1 billion won, leaving the company in a state of complete capital impairment. EY Han Young said in its audit report that material uncertainty exists that may cast significant doubt on the company's ability to continue as a going concern. NPIXEL's co-chief executives have also lent money to the company. Borrowings related to co-CEO Jung Hyun-ho totaled 11.9 billion won, while those related to co-CEO Bae Bong-gun amounted to 6.9 billion won.

Eclipse therefore carries significant weight for both companies. For Smilegate, it represents a new revenue source that could help revive earnings. For NPIXEL, it is a game that needs to rebuild the company's revenue base and help it move out of losses and capital impairment.

The game industry is focusing less on Eclipse's initial user numbers than on its future retention rate and sales ranking. Users drawn in by free summon tickets and other incentives need to remain in the game for at least a month, with some converting into paying customers. Smilegate's "MMOLite" model will only prove viable if the game can generate meaningful revenue while keeping the burden of spending low.

As of 4 p.m. on Sept. 10, Eclipse ranked No. 10 in sales on Apple's App Store. It ranked No. 1 in free downloads.

Zscaler has unveiled Agentic SOC, a security operations platform that uses frontier artificial intelligence (AI) models from companies including OpenAI and Anthropic.

The U.S. cloud security company said on Sept. 9 that AI-powered attacks are occurring at speeds that traditional security operations centers (SOCs) struggle to handle, requiring SOCs to be redesigned so AI can take the lead in detecting, investigating and blocking threats.

Zscaler's Agentic SOC combines security information and event management (SIEM), which collects logs and detects threats, with security orchestration, automation and response (SOAR), which handles identified threats. It adds AI agents that can independently assess situations and take action throughout the process.

The company has also partnered with frontier AI labs including Anthropic and OpenAI, based on its view that a single model or approach has limitations in delivering accurate agentic AI operations.

Agentic SOC assigns AI agents to perform decisions and responses traditionally handled by security analysts. The agents identify genuine threats among large volumes of security alerts, investigate attack paths and root causes, and determine whether a threat is present. They can then automatically take necessary actions, such as isolating compromised users or blocking attackers' command-and-control (C2) communications.

Zscaler provides the AI agents with security data collected from networks in real time and its own threat intelligence. The platform can also integrate with customers' existing security tools to analyze threat information and automatically block lateral movement by attackers across systems.

"Agentic SOC represents a fundamental reimagining of security operations," said Deepen Desai, Zscaler's vice president of cybersecurity. "It is designed to proactively reduce exposure and contain threats at machine speed."

"AI attacks operate with a speed, scale and adaptability that are markedly different from humans, fundamentally changing the threat landscape," said Allie Mellen, a principal analyst at Forrester Research. "Defenders need to focus on fundamentals such as zero-trust principles, data loss prevention and access restrictions."

Biometric security company Union Biometrics said it plans to expand sales of biometric security solutions to data centers in Korea and overseas.

Physical access control and permission management are critical for artificial intelligence (AI) data centers because they house expensive computing equipment such as graphics processing units (GPUs) and handle critical data. Union Biometrics said it is addressing that demand by combining biometric technology with access control, permission management and authentication history management.

The company has deployed AI-based biometric security systems at data centers in Lyon and Grenoble operated by French data center operator Data One. It is also exploring the deployment of biometric access control solutions at new North American data centers, including one in Vineland, New Jersey.

Union Biometrics said it plans to leverage that experience to address new demand. The government launched an AI Data Center (AIDC) Alliance on July 29 and plans to establish a public-private cooperation framework in the second half of the year. Korean companies and global big tech companies are also pursuing AI data center projects totaling 5 gigawatts (GW) of capacity and 2 million GPUs.

"We will respond to expanding investment in AI infrastructure based on our experience supplying security solutions to data centers in Korea and overseas," a Union Biometrics official said.

Union Biometrics provides applications including access control and attendance management based on biometric identification technologies such as facial and iris recognition. Its security solutions can be deployed in areas ranging from general access zones to server rooms, control rooms, and power and cooling facilities. The company posted revenue of 51.3 billion won and operating profit of 1.2 billion won last year.

AI Spera CEO Kang Byung-tak strongly criticized contractors' reliance on vibe coding following the hacking incident involving the "Moduui Changeop" startup support platform.

He said a growing number of contractors are using artificial intelligence-generated code without sufficient verification, creating new security risks.

Kang cited the Moduui Changeop hack at the AIDC Security Technology Workshop held Sept. 7 at Militopia Hotel by Marine in Seongnam, Gyeonggi Province. "The websites built by contractors are a mess beyond imagination," he said.

Moduui Changeop is a startup support program run by the Ministry of SMEs and Startups. In June, non-public information belonging to 5,000 successful applicants in the program's first cohort was leaked externally, including email addresses, evaluation comments and summaries of startup ideas.

A government investigation found that some of the platform's application programming interfaces (APIs) contained non-public information. The data leaked while the APIs were being collected externally through methods including web crawling. The data was encrypted, but the encryption key needed to decrypt it was also exposed.

An AI solutions company participating in the program obtained non-public email addresses through abnormal API calls and other means. Controversy grew after the company sent promotional emails to those addresses. It was later revealed that about a month before the incident, an external security team had discovered a similar API vulnerability and reported it to the Moduui Changeop operator.

"News coverage has largely focused on the contractor having carried out the hacking, but in my view both issues are serious," Kang said.

The "two issues" Kang referred to were the actions of the company that obtained the non-public information and the platform's own security flaws. He argued that the fundamental problem was that the platform had been designed to allow such access in the first place.

"The code written by the contractor looks to me like it was probably created through vibe coding," Kang said. "Security was not considered at all."

Vibe coding is a development method in which users describe desired functions in natural language and AI generates the necessary code and user interface (UI). "Vibe coding is certainly a whole new world, but in my view it is a ticking time bomb," Kang said. "I think it has increased contractor supply-chain risks by more than 100-fold."

"ChatGPT or Claude does a very good job when you use it for security checks," he said. "But after fixing the issues, some functions stop working. If you use vibe coding again to fix those functions, new vulnerabilities emerge." Most of those problems involve permissions, he added.

Kang outlined major security problems found in systems built by contractors, including cases where users are authenticated but authorization checks are not performed; databases are left directly accessible from outside without firewalls or access restrictions; and actual client data is uploaded unchanged to test and development servers without access control lists (ACLs).

Kang also disclosed examples of security problems involving companies and public institutions beyond Moduui Changeop.

One involved an AI chatbot that Kang identified as a system belonging to the Agency for Defense Development. "AI chatbot screens containing important defense-related data are exposed on the internet and can simply be accessed," he said. "It is not even a case of the ID and password being 'admin admin' — there is no authentication at all. It actually works when you submit prompts."

He also cited what he described as a system belonging to the Financial Security Institute. "Access tokens and refresh tokens are exposed on the site as JSON files," Kang said. "This does not really even require hacking." Access and refresh tokens function as credentials issued by a server after login. If exposed, they can allow access with the account's privileges without a password.

Kang also cited examples involving private companies. Referring to a system he described as an AI service from Starbucks, he said, "You can see all the content immediately without logging in, and you can submit prompts as well."

Regarding an AI system for credit assessment developed by Upstage, Kang said, "There is no login, so not only can you look through all this data and freely submit prompts, but you can also see the actual data inside." He said the issue was particularly serious because the system contained various types of data, including apartment purchase contracts.

Kang said the examples illustrate how the external attack surface that companies must manage is expanding significantly in the AI era. "When people talk about hacking AI, they mostly think of prompt injection or attacks on AI models," he said. "But rather than hacking the AI itself, targeting administrator pages is much easier to compromise and attack."

AI Spera is a cybersecurity company founded in 2017.

Attack Surface Management (ASM), whose importance Kang emphasized by disclosing security issues at multiple companies and institutions, is AI Spera's core business. Its flagship solution, Criminal IP, collects and analyzes internet-connected IP addresses and servers to identify externally exposed assets and security risks.