[Report] "Cyberattack Analysis Time Cut in Half"... Inside AhnLab's AI-Driven Security Operations Center

During Information Security Week: A Visit to the AhnLab Security Operations Center
Enhanced Threat Detection Efficiency and Consistency with AI

On July 6, at the Security Operations Center (SOC) of AhnLab in Seongnam, Gyeonggi Province, which was visited by a reporter, 12 wall-mounted monitors continuously displayed security events and threat statuses. About 20 monitoring personnel were busy analyzing security alerts, surrounded by several monitors. In this center that operates 24 hours a day without pause, approximately 3 terabytes (TB) of logs generated daily by over 500 client companies are analyzed around the clock.

Security Control Center located at AhnLab Headquarters in Seongnam-si, Gyeonggi-do. AhnLab.

As the misuse of artificial intelligence (AI) in cyber threats intensifies, the security industry is strengthening AI response systems that can react more quickly than humans. AhnLab is a prime example, having introduced AI to its Security Operations Center since last year and overhauled its systems accordingly.

AhnLab has applied its agent-based AI security platform, "AhnLab AI Plus," built on security data, to the AhnLab Security Operations Center. The AI agent analyzes the severity of threats, determines whether client companies are affected, and assesses maliciousness before preparing a preliminary response report. Human analysts then verify the content, conduct in-depth analysis, and ultimately determine whether an actual breach has occurred to formulate a response.

The AI at the Security Operations Center performs the initial analysis of half of the daily security events within 20 seconds, and most events within 50 seconds. In fact, the average total analysis time per case has been reduced from 5 minutes to 2 minutes. Monitoring efficiency per personnel has also increased 2.5 times. The annual processing volume expanded from 293,800 cases to 863,100 cases.

The introduction of AI has standardized analyses that previously varied depending on experience and proficiency, thereby enhancing the consistency of cybersecurity. While the AI handles simple, repetitive detection tasks, human analysts focus on complex analysis and research, improving the overall operational efficiency. Shin Sangil, Manager of AhnLab Cyber Security Center (ACSC), explained, "The greatest improvement is workforce optimization, as human analysts can now focus on more in-depth analysis and research," adding, "AI is now capable of proposing responses based on the impact of cyber threats, actual case studies, and accumulated experience."

The emergence of AI-based security monitoring is rooted in the expanding attack surface brought about by AI. According to the Korea Internet & Security Agency (KISA), the number of reported cyber incidents in Korea last year reached 2,383 cases, a record high, representing a 26.3% increase compared to the previous year (1,887 cases).

Sung Hyunwoong (left), in charge of AhnLab Security Operation Center, and Sangil Shin, Manager of AhnLab Cyber Security Center (ACSC). AhnLab.

Recently, attackers have been leveraging AI to automatically search for vulnerabilities that are difficult for humans to detect, greatly reducing the time needed to prepare for attacks. Whereas in the past, humans had to manually identify vulnerabilities, now AI automatically selects attack targets. Sung Hyunwoong, Manager at AhnLab ACSC, explained, "With the introduction of AI, the cycle of cyberattacks has shortened and the volume of attacks has increased exponentially," and added, "Given the limitations of existing systems and personnel, automation has become essential."

Looking ahead, AhnLab aims to operate an "AI-native SOC" where AI not only detects and analyzes threats but also responds to them. The company plans to strengthen functions that assess the organization's attack surface and manage potential vulnerabilities, going beyond detection and analysis. An AhnLab representative stated, "Our goal is to leverage AI as the core engine throughout our security operations, implementing an AI SOC that connects detection, analysis, response, and prevention," adding, "Ultimately, we aim to establish a reliable, autonomous security operations system."

This content was produced with the assistance of AI translation services.