As reports of cyber incidents in South Korea rise, artificial intelligence (AI) is being used both by attackers to find vulnerabilities and by defenders to analyze and block threats. But even after finding a vulnerability, defenders must prepare a patch and check whether it conflicts with existing systems or interrupts services. The key point is that how quickly and safely patch validation and approval procedures can be handled may become important in narrowing the speed gap between attackers and defenders.

Background and context

According to statistics from the Korea Internet & Security Agency (한국인터넷진흥원, KISA), reports of cyber incidents in South Korea rose from 1,277 in 2023 to 2,383 in 2025. There were 1,236 reports in the first half of 2026, a figure comparable to the total number of reports for all of 2023. However, these statistics do not indicate whether AI was used in the incidents. The increase in the number of reports alone therefore does not establish that AI caused or drove the increase.

Experts predicted that the rise in cyber incidents could accelerate as the use of AI in cyberattacks grows more sophisticated. Their analysis is that faster vulnerability discovery and attack attempts could increase the burden on defenders. It is important to distinguish this from the fact that AI’s use in a series of financial-sector hacks has not been confirmed.

The use of AI by defenders is also advancing. Microsoft’s enterprise security platform, Defender XDR, uses AI to analyze threat signals collected from PCs, servers, and accounts, and helps contain the spread of attacks by, for example, blocking communications from compromised devices. XDR is a type of security platform that analyzes security signals collected across multiple devices and accounts. OpenAI and Anthropic also offer specialized cybersecurity models that help with defensive tasks, such as finding vulnerabilities and writing code to fix them.

What this news means

Even if AI tools identify threats more quickly, fixing the vulnerabilities they uncover takes additional time. A patch is a software update that fixes a security issue or error. An attacker can try exploiting another vulnerability if an attempt to use one fails, but defenders must validate a patch after creating or obtaining it to check for possible conflicts with existing systems or service interruptions.

Yeom Heung-yeol, emeritus professor in the Department of Information Security at Soonchunhyang University (순천향대), said defenders must go through patch validation and approval procedures, creating an asymmetry with attackers in terms of time and effort. Kwak Jin, a professor in the Department of Cyber Security at Ajou University (아주대), pointed out that “security debt” can build up when organizations cannot patch vulnerabilities all at once and defer or skip some measures. Security debt refers to security problems that accumulate when their resolution is postponed.

Internal organizational policies and decision-making can also affect response times. Dave Chisnall, CTO of the UK National Cyber Security Centre (영국 국가사이버보안센터, NCSC), noted in an official blog post last month that defenders are heavily constrained by organizational policies. This means that the processes for reviewing and approving patches, no less than the technology for finding vulnerabilities, can affect actual defensive capabilities.

For example, if an organization finds a vulnerability but must check for system conflicts before applying a patch, the time required for validation and approval remains even if AI detects the issue quickly. In that case, response times can be reduced if the process—from identifying a vulnerability to fixing it—is automated, and a system is in place to check again after deployment that no problems have arisen. This is an explanation based on a hypothetical scenario; it does not mean that the level of automation adoption or its effectiveness has been confirmed at any organization.

Related policies and support information

Financial authorities are discussing a gradual easing of network-separation regulations in the financial sector to enable the use of new technologies. Network separation is a security approach that separates internal work networks from external internet networks. The discussion of regulatory easing concerns the environment for using new technologies in the financial sector, but the information provided does not establish when it will take effect, the specific scope of the easing, or requirements for individual institutions.

The discussion of easing regulations should therefore not be interpreted to mean that financial institutions have already adopted AI security tools or changed their network-separation practices. Whether and under what conditions the changes are actually applied must be confirmed separately.

Confirmed facts and what remains unknown

Confirmed facts

  • Reports of cyber incidents in South Korea totaled 1,277 in 2023 and 2,383 in 2025, and there were 1,236 reports in the first half of 2026.
  • KISA statistics do not classify whether AI was used in each cyber incident.
  • Defender XDR uses AI to analyze threat signals from multiple devices and accounts and helps contain the spread of attacks, including by blocking communications from compromised devices.
  • OpenAI and Anthropic offer specialized cybersecurity models that help find vulnerabilities and generate code fixes, among other tasks.
  • Experts emphasized patch automation, security debt management, and ongoing revalidation after deployment.

What remains unknown

  • It has not been confirmed whether AI was actually used in the series of financial-sector hacks.
  • No information was provided on the level of patch automation adoption at individual organizations or its effects.
  • The information provided does not specify the timeline or scope of the easing of network-separation regulations in the financial sector.

What readers can check

  • Security staff at an organization can check what procedures are required to validate and approve a patch after a vulnerability is discovered, and whether any steps in the process cause delays.
  • They can check whether deferred vulnerabilities are accumulating and keep track of the items whose remediation has been postponed and their status.
  • They can check whether procedures are in place to continuously revalidate patches after deployment to ensure that no problems have arisen with systems or services.