[Issue Interview] "Security Investment Determines Financial Digital Competitiveness... Post-Network Separation Era Brings Security Paradigm Shift"

Interview with Sangwon Park, President of the Financial Security Institute

Security Is an Investment, Not a Cost, Amid Network Separation Relaxation and AI Proliferation

Financial Institutions Should Increase Security Investments to 13–14% of IT Budgets

"The security paradigm in the financial sector is fundamentally changing due to the relaxation of network separation regulations and the widespread adoption of generative artificial intelligence (AI). From now on, the level of security investment will become a key factor that determines both the AI transformation (AX) and digital competitiveness in finance."

Sangwon Park, President of the Financial Security Institute, is being interviewed by The Asia Business Daily in his office at the Financial Security Institute in Yeouido, Seoul. 2026.6.18 Photo by Hyunmin Kim

In an interview with The Asia Business Daily on June 18, Sangwon Park, President of the Financial Security Institute, stated, "In the post-network separation era, security must be viewed not as a cost, but as an investment."

He explained, "Within the boundaries enforced by network separation, it was possible to block external attacks with relatively minimal costs, but the situation is changing. In line with the easing of network separation regulations, domestic financial institutions need to increase their security investments to 13–14% of their IT budgets, reaching the level of advanced economies."

Over the past decade, the government has gradually relaxed network separation regulations that have underpinned the security systems of domestic financial institutions. It has decided to allow the use of high-performance AI such as Anthropic’s ‘Mythos’ and security-related Software as a Service (SaaS) for security purposes. Recently, 10 financial institutions were selected for the application of eased network separation regulations. By the end of the year, the government plans to fully lift network separation regulations for financial institutions with outstanding security and AI capabilities through innovative financial services. This marks the financial sector’s full entry into the ‘post-network separation era’.

President Park noted, "Until now, operational staff at financial institutions have used the slow pace of digital innovation as an excuse by blaming network separation regulations, but that is no longer valid. Financial institutions must now make their own decisions—protecting core networks while boldly opening up areas for innovation, and taking appropriate responsibility if incidents occur."

Currently, the share of security investment in the domestic financial sector is only around 6–7% of the total IT budget. This is just half the level of major U.S. financial institutions such as JP Morgan. President Park explained that to successfully drive the AX transformation in finance, a corresponding increase in security investment is necessary.

He predicted that the spread of AI will dramatically accelerate both the speed of cyberattacks and defenses. As hackers use AI to find vulnerabilities much more quickly and broadly than before, financial institutions must establish response systems that match these new threats.

President Park stressed, "In the age of AI, security must also be handled with AI. Security should be built into the entire lifecycle of AI services—from design and development to operation—and the latest AI-based security technologies should be actively utilized."

He particularly emphasized that security is no longer just the task of the IT department. As AI and cloud-based services become more prevalent, the level of security is directly linked to service competitiveness, making it a core management agenda that CEOs and boards of directors must address directly.

President Park said, "Since last year, a series of IT failures and security incidents have prompted CEOs to shift from neglecting security investments to taking security seriously. Financial sector leaders now clearly recognize that security issues are not just about system operations, but are directly connected to consumer trust, corporate reputation, and business performance."

To respond to security threats stemming from AI, the Financial Security Institute has established the ‘Financial AI Security Research Center’ under the direct supervision of the president. The center is responsible for AI-based threat analysis, safety and reliability assessments, and AI red teaming. Its subordinate AI Security Support Center provides tailored consulting and technical support for small and medium-sized financial institutions. The institute plans to expand its research staff from the current 70 to about 100 by the end of the year.

In addition, the Financial Security Institute will conduct AI-based vulnerability assessments and penetration testing across the entire financial sector. As it has recently become the only institution in the private financial sector to secure the right to use a security code solution based on OpenAI’s GPT-5.5, it plans to provide more sophisticated analysis and support for security vulnerabilities throughout the source code and systems of financial institutions.

President Park stated, "When financial institutions use AI to examine their internal source code, they may discover many vulnerabilities that were previously undetected. For institutions subject to relaxed network separation regulations, we will support source code review and vulnerability verification and analysis. For other financial institutions, we will conduct penetration testing using AI models to help achieve real improvements in security."

He evaluated that although the security capabilities of the domestic financial sector have improved significantly compared to the past, they still have not reached the level required in the AI era.

President Park predicted, "Going forward, it will be important to secure more proactive and autonomous security capabilities, such as asset identification, vulnerability management, and automated threat detection and response. Improving network separation regulations is not the end, but the beginning. The competitiveness of financial institutions now depends on how safely they can leverage AI and the cloud."

Having reached the halfway point of his three-year term, President Park cited as his most meaningful achievement the establishment of a proactive response system to security threats, which has contributed to greater stability across the financial sector since taking office.

He said, "Notably, during last year’s SGI Seoul Guarantee ransomware incident, Financial Security Institute staff were quickly deployed to support early system recovery, demonstrating the institute’s expertise and role. In addition, in response to the spread of new technologies such as AI and digital assets, we have expanded dedicated AI teams and established a department for digital assets, actively supporting financial institutions in the safe adoption of new technologies."

For the remainder of his term, he plans to focus on strengthening the financial sector’s AI response capabilities under the principle of ‘AI defends against AI’.

President Park emphasized, "We will strengthen the financial sector’s AI response capabilities, centering on the newly established Financial AI Security Research Center. In the post-network separation era, we will support financial institutions in firmly establishing autonomous security systems during their digital innovation journey, and ensure that the Financial Security Institute remains the cornerstone of digital financial safety."

This content was produced with the assistance of AI translation services.