As AI (artificial intelligence) agent hacking attacks targeting the financial sector are becoming a reality, it has been revealed that large banks' investments in AI-related security account for less than 1% of their total IT (information technology) budgets. Moreover, most of this budget is concentrated on detecting insider abnormal behavior, with half of the funds allocated to this area, leading to repeated criticism that monitoring systems for detecting abnormal transactions from external IP (Internet Protocol) addresses are being neglected.
According to financial industry sources on the 11th, the IT-related budgets of the five major banks—KB Kookmin, Shinhan, Hana, Woori, and NH Nonghyup—as of the end of last year totaled 2.358 trillion won.
Of this amount, the information security budget was 228.1 billion won, representing 9.7% of the IT-related budget. Within that, investment related to AI security was 22.1 billion won, accounting for 9.7% of the information security budget. The amount spent on AI security out of the total IT-related budget is approximately 0.9%.
By bank, Hana Bank had the highest proportion of AI security-related spending within its information security execution amount at 23.3%. This was followed by KB Kookmin Bank at 11.5%, Nonghyup Bank at 4.5%, Woori Bank at 3.9%, and Shinhan Bank at 3.2%.
The financial sector tends to invest more in information security compared to other industries, given that it handles sensitive personal information such as customer assets and credit data. However, unlike the scale of general information security investment, the construction of AI-utilizing security systems can still be considered in its early stages. Since late last month, hacking incidents targeting financial companies, including Shinhan, KB Kookmin, Hana, and BNK Busan Bank, have occurred consecutively, with AI agents being identified as the masterminds. As external attackers successively infiltrated loan solicitor-exclusive services and business support systems used by employees, personal information of customers and staff was leaked, prompting financial authorities to launch an emergency inspection.
A greater concern lies in the composition of AI security investments. The area with the largest expenditure among the top five banks' AI security investments is User and Entity Behavior Analytics (UEBA) for detecting insider abnormal behavior. The amount executed in this area was 11.5 billion won, accounting for more than half—52%—of the total AI security investment budget. Generative AI security followed at 21%.
In contrast, relatively little investment has been made in systems that detect signs of external intrusion. The investment proportion for AI-based Security Operations Center (SOC) monitoring, which detects cyberattacks on internal servers or networks, was 19%. Fraudulent Transaction Detection (FDS), which identifies fraudulent transfers and other anomalies in customer accounts, accounted for only 5%. Combined, these two areas make up less than one-quarter of the total AI security investment.
The method used in this hacking targeting the financial sector is presumed to be "credential stuffing," a technique involving the indiscriminate input of personal information posted on dark web sites to gain access. Consequently, the importance of monitoring external intrusions is increasing. As AI agents automate everything from vulnerability scanning and analysis to securing attack paths and executing actual attacks, the speed and scope of attacks are expanding daily.
Experts point out that even if AI agents have increased the speed of attacks, the methods themselves have existed previously, making external monitoring capabilities crucial for early detection and blocking of abnormal access. They explain that had real-time detection been applied to repeated login attempts, bulk information queries within a short period, or connections from abnormal IPs, the spread of damage could have been blocked more quickly. A security expert noted, "The fact that intrusion attempts continued for over 10 hours, whether through backdoors or front doors, and information queries were made multiple times, yet measures such as IP blocking did not function, indicates that the fraudulent transaction detection system was inadequate."
There is also a trend of expanding AI security investments overseas. According to IANS, a U.S. cybersecurity consulting institutional investor, software-related security, including AI-related investments, accounts for 35% of information security budgets. Among the 500th CISOs (Chief Information Security Officers) who participated in the survey, 69% responded that they plan to increase AI security expenditures next year.
Domestic banks are also expected to actively increase their AI security investments following this incident. This is particularly because the government is continuing to push for the relaxation of network separation regulations while strengthening its stance on building AI-based security systems. A bank official stated, "It was necessary to lower network separation regulations in order to connect external security systems such as commercial 미Toss, and the first batch of companies selected for network separation relaxation has been pushing this forward, so going forward, we will focus on this aspect within the framework of network separation relaxation." The official added, "If guidelines regarding security personnel or budgets become stricter following this incident, it will be fully reflected in the budget starting next year."
in FINANCE
