Hacking Incidents Driven by AI Surge, but Response System Falls Short

As hacking incidents fueled by artificial intelligence (AI) have erupted in the financial sector, raising concerns over personal information leaks, there are growing criticisms that the government’s investigative and response workforce cannot keep up. Requests by the Korea Internet & Security Agency (KISA) for increased personnel and budget for new projects to better respond to security vulnerabilities next year were not reflected in the government’s budget plan, and the Personal Information Protection Commission (PIPC) has not reached its full staffing level for several years.

According to materials from the office of Assemblyman Kim Namguk of the Democratic Party of Korea, a member of the National Assembly's Science, ICT, Broadcasting, and Communications Committee, KISA requested an additional 20 personnel for its Vulnerability Management Center for next year. However, this was not approved during the Ministry of Economy and Finance’s budget review.

The Vulnerability Management Center was established last May after the release of Anthropic’s AI model “Mythos Preview.” The government set up this organization as part of efforts to shift Korea’s information security framework to an AI-driven model. The center integrates and manages security vulnerabilities and patches both domestically and internationally, shares and disseminates information with relevant organizations and companies, and provides technical support.

Currently, the center’s staff numbers 24, which is only 60% of the 40 positions planned by the government at the time of its creation last May. Of these, 13 are full-time employees assigned by re-shuffling existing staff, while the remaining 11 are part-time personnel who also perform other duties. Although a dedicated organization has been established to connect AI-detected vulnerabilities to real-world mitigation measures, the lack of personnel means it is struggling to fulfill its role.

Securing the necessary budget has also proven difficult. KISA requested 17 billion won for a new funded project next year, but this was not included in the government’s budget plan. The agency submitted two separate requests to increase the budgets for existing projects, but both were also rejected.

The PIPC, tasked with investigating personal data breach incidents, is similarly understaffed. According to data obtained by the office of Assemblywoman Chun Hyunhee of the Democratic Party (a member of the National Policy Committee), the authorized number of investigators at the PIPC remained at 31 from 2023 to 2025. However, the actual number of staff members was only 25 in 2023, 28 in 2024, and 27 in 2025, failing to reach the allotted positions. Even this year, although the number of authorized positions increased to 37, as of the end of August, there were only 31 staff members, leaving six positions unfilled.

Accordingly, some experts stress the need for the government to strengthen its response capabilities, both in preventing incidents and in post-incident investigations. Professor Sangkeun Lee from the Graduate School of Information Security at Korea University noted, “While AI is advancing rapidly, developing security specialists still appears to be at an intermediate stage. Solutions should be considered to take advantage of white-hat hackers not only from institutions, but also from universities and research institutes.” He added, “It is also necessary to invest more in discovering previously unseen security vulnerabilities and to supplement the relevant workforce.”

This content was produced with the assistance of AI translation services.