[Edaily Yun Junghoon·An Yu-ri Reporter] According to the Ministry of Science and ICT and the Korea Internet & Security Agency (KISA), reports of domestic cyber incidents in the first half of this year totaled 1,236, a 19.5% increase compared to the previous year (1,034).

A string of breaches occurred across both private companies and public institutions, including SKTelecom, Lotte Card, Coupang, KTCorporation, TVING, YES24 Co.,Ltd., Duo, Gangnam Unnie, the National Diplomatic Academy, and the Institute for Information & Communications Planning & Evaluation. A closer look at the investigation results of this series of hacking incidents reveals a common thread: the breaches did not stem from sophisticated attacks orchestrated by AI, but rather from “minor violations of basic security protocols” that even the personnel in charge had overlooked.

The person who breached Coupang was a former employee who had personally developed the alternative authentication system. The root of the problem was that the signature key was never updated or revoked after he left the company. SKT stored usernames and passwords in plain text—without encryption—on a server connected to the public internet, which led to the compromise of its core network. TVING had a developer’s access key stolen; the problem was that the key had been embedded directly into the source code in the first place.

This is truly the “era of massive hacking.” With the advancement of sophisticated AI, no company can guarantee that its security measures are completely secure. This is why Jensen Huang, CEO of NVIDIA, stated at the Goldman Sachs Technology Conference on the 10th that “cybersecurity will be the next major application area for AI.”

Edaily interviewed six experts who examine security from various perspectives to gather advice on what companies—both those already excelling at security and those aspiring to do so—should prepare for and implement.

The six experts included Park Tae-hwan, Director of the AHNLAB,INC.(053800) Cybersecurity Center (ACSC), which investigates actual security breaches and tracks threats; Kim Hyuk-jun, CEO of Naru Security, a security firm that tracks attackers’ traces through network traffic; Kim Dong-min, Team Leader at the White Hat Center ( RaonSecure Co., Ltd.(042510) ), which leads a team of white-hat hackers to conduct simulated penetration tests directly on corporate networks; Kang Byung-tak, CEO of AI Spera, a company specializing in attack surface management (ASM) that monitors what corporate systems are exposed to the internet; Cho Seong-min ( NHN(181710) ), Director (Head of Information Security Policy) who oversees internal information security policies and development security while directly managing large-scale services such as cloud and gaming; and Park Kwan-soon, Chief Information Security Officer (CISO) at Tori, a corporate security consulting firm, and others.

They unanimously emphasized that “it’s not about the number of security products, but how accurately you assess your internal systems and how quickly you patch vulnerabilities.”

Attacks Accelerated by AI... “All IT Assets, Including Servers, Must Be Protected”

CISO Park Kwan-soon attributed the root cause of recent major personal data breaches to “not sophisticated hacking techniques, but minor violations of basic security rules and accumulated security debt.”

As an example of the advancement of AI, he noted that the analysis of high-risk vulnerabilities at the Linux kernel level—which used to take several weeks—has now been reduced to a matter of hours or a single day thanks to AI.

CEO Kang Byung-tak offered a similar assessment. “Attackers don’t come through the front door; if even a single back window is open, they’ll come in that way,” he explained, adding, “What makes AI so frightening is that it can find these small loopholes—ones even security personnel had forgotten about—much more quickly.”

Experts identified Attack Surface Management (ASM) as the first step.

CEO Kang pointed out, “Many companies don’t know exactly what they have exposed on the internet.” Interestingly, this isn’t just a challenge for large corporations.

He advised, “If you’re a small or medium-sized enterprise (SME) concerned about budget constraints, start by utilizing the ASM-based inspection support program provided free of charge by the Korea Internet & Security Agency (KISA).”

CISO Park Kwan-soon also noted, “The initial point of entry usually begins with neglected assets that even the responsible personnel have forgotten exist.”

There was also consensus that credential management must move beyond the goal of “never letting them leak” to “detecting leaks the moment they occur.”

Director Cho Seong-min revealed that NHN is building a source code repository entirely in-house to block external access at the source and is establishing controls to automatically filter out any authentication keys mixed into the code before it is uploaded. In particular, as “Vibe Coding”—where AI writes code on behalf of developers—becomes more prevalent, the company has created and distributed its own development security guidelines instructing AI not to directly embed authentication credentials.

Team Leader Kim Dong-min also emphasized, “Keys must be logged from issuance to disposal, replaced at short intervals, and be capable of immediate revocation if a leak is suspected.”

Preventing Hackers from Moving to Adjacent Areas Even If They Break In

Experts also agree that assets, such as servers, must be segmented to prevent hackers from moving to other areas even after an intrusion.

CISO Park Gwan-soon referred to this as a “guardrail,” stating, “Based on the premise that people can make mistakes at any time, companies equipped with technical controls that prevent employee errors from escalating into system-wide incidents are the most difficult for attackers to breach.”

Team Leader Kim Dong-min cited his experience with actual penetration testing, noting that “companies with only a main page and no actual services are the hardest to breach. Since there are no functional features, there’s no entry point for an attacker.”

Team Leader Kim continued, “The next most difficult target is a company where, even if one point is breached, it’s hard to advance to the next stage, and the organization reacts quickly to even the slightest suspicious activity.” Critical systems require access via managed terminals and multi-factor authentication, and the structure ensures that development and operations environments are separated, with external data transfers restricted.

CEO Kim Hyuk-jun advised, “The moment an attacker’s understanding of the internal environment surpasses the defender’s visibility, the attack disappears completely from the defender’s radar,” adding, “To prevent this, define the scope of normal business operations as data in advance.”

He explained that having established criteria for which servers typically communicate with whom allows the system to immediately flag as anomalous behavior instances such as communication with unfamiliar external addresses or bulk queries of customer information without a valid business reason.

Park Tae-hwan, a division head at AHNLAB,INC., added, “Don’t store all customer information on a single server; it should be separated based on purpose and importance,” noting, “For companies that have implemented a multi-factor authentication system, it is not easy for an attacker to gain access using only the information they’ve obtained online.”

“The ‘golden time’ for response after an intrusion is critical… Intruders won’t wait.”

As most hacking cases demonstrate, government security certifications—such as the Information Security Management System (ISMS)—can be viewed as a minimum requirement.

CISO Park Kwan-soon stated, “Certification is merely a benchmark for compliance; it is not a practical firewall capable of blocking intrusions that evolve in real time,” adding, “Regular audits conducted once or twice a year only assess the status at a specific point in time, but today’s attacks move at the ‘speed of machines’—measured in seconds.”

Director Cho Seong-min remarked, “The trend in government information security disclosure figures is a far more objective indicator than incident history,” adding, “Executive leadership must first verify whether there is a system in place to regularly report these figures to them and whether the security organization is in a position to raise issues without having to worry about the business departments’ reactions.”

CEO Kang identified time as the key factor that truly distinguishes defensive capabilities.

He said, “While some companies let weeks slip by just verifying with the responsible department and coordinating schedules even after a vulnerability is discovered, top-performing companies block the threat immediately and take action right away,” adding, “Attackers won’t wait those few weeks.”

Team Leader Kim also noted, “Speed metrics—how quickly risks are detected and mitigated—are more important than the number of products or the total budget,” adding, “Senior management must personally monitor the time from detection to resolution and the number of cases that exceed deadlines.”

Although the experts reached the same conclusion, their key points of focus differed slightly.

Based on his experience responding to actual incidents, Division Head Park Tae-hwan emphasized “fundamentals” such as multi-factor authentication and distributed data storage; CEO Kim Hyuk-jun, drawing on his field experience tracking signs of breaches, highlighted the importance of securing “visibility” that extends beyond the attacker’s reach; and Team Leader Kim Dong-min, from the perspective of a white-hat hacker who has conducted penetration tests, stressed “internal controls” to prevent the spread of a breach once it has occurred.

CEO Kang Byung-tak, true to his expertise in attack surface management, consistently emphasized “identifying exposed assets” and “response speed,” while Director Cho Seong-min, speaking as an insider at a company operating actual services, prioritized institutional metrics such as “proactive prevention” during the development phase and “information security disclosures” visible to senior management. CISO Park Kwan-soon, drawing on his experience in both security consulting and public-interest vulnerability reporting, most strongly advocated for the concept of “security debt” and the design of “guardrails” based on the assumption of human error.