The execution rate of information protection budgets in the banking sector has shown a declining trend over the past three years. Although the scale of budget allocation has expanded, actual spending has failed to keep pace, resulting in more than 120 billion won of unspent budget last year alone. As hacking incidents and customer data breaches have occurred one after another in the financial sector, efforts to expand security investments—previously viewed as a target for cost-cutting—are now gaining momentum.
According to documents submitted by the Financial Supervisory Service to the office of Rep. Lee Yang-soo of the People Power Party on the 12th, the information protection budget execution rate for eight banks—KB Kookmin, Shinhan, Hana, Woori, NH Nonghyup, Kakao, K, and Toss Bank—was recorded at 69.0% last year. This marked a second consecutive annual decline, following rates of 74.5% in 2023 and 70.8% in 2024. Of the 397.8 billion won budget allocated last year, only 274.4 billion won was actually spent, leaving 123.4 billion won unexecuted.
The banking sector’s information protection budget increased by 21.2% over two years, rising from 328.2 billion won in 2023 to 397.8 billion won last year. However, actual expenditures grew only 12.2%, from 244.6 billion won to 274.4 billion won. Consequently, the unexecuted budget amount also increased from approximately 83.5 billion won in 2023 to 123.4 billion won last year.
Even when compared with other financial industries, the banking sector had the lowest execution rate. Last year’s information protection budget execution rates were recorded at 90.5% for card companies, 82.0% for securities firms, 75.3% for life insurance companies, and 104.2% for non-life insurance companies. However, unexecuted budgets do not necessarily indicate investment cuts. Discrepancies can arise due to project schedules or contract amounts.
Recent successive hacking incidents are also bringing about changes in how security investments are perceived within banks. In the past, expanding security personnel and budgets has been difficult amid efforts to improve cost efficiency and streamline organizations. Some voices within the financial sector even suggest that it is fortunate that these incidents have provided an opportunity to bolster security staffing and budgets.
A source at a commercial bank stated, “While banks have certainly increased their security budgets as profits grew, the absence of serious security incidents led them to approach the issue from a cost-efficiency perspective,” adding, “If no incidents occur, organizations inevitably shrink and costs must be cut.”
Banks are taking steps to review their security systems and expand investments. Shinhan Bank is re-examining its budget management direction and investment areas, with plans to allocate an information protection budget at the highest level in the industry. A source at Shinhan Bank said, “We are reviewing projects that can strengthen our information protection system, recognizing security not merely as a cost but as an investment.”
Hana Bank formed a data breach response task force (TFT) immediately after becoming aware of the incident and launched urgent system inspections through a dedicated team including external experts. The bank also plans to expand expenditures for building an AI-based intelligent cybersecurity system.
KB Kookmin Bank has also established a personal information breach response TFT, which is currently operational, and plans to significantly expand its information protection budget for next year by more than 100 billion won.
Within the financial sector, it is pointed out that the effectiveness of security systems is important in addition to budget expansion. A source in the banking industry emphasized, “The paradigm regarding information security will change from budgets to personnel,” adding, “There must be a recognition that security budgets should be properly invested in and not saved on.”
in FINANCE
