KB Kookmin Bank's information security budget for last year can be summed up in one line: '39.2 billion won of 67.6 billion won spent.' To be precise, the bank spent 39.297 billion won out of 67.613 billion won, for an execution rate of only 58.1%. The same bank was also confirmed to have suffered an incident in which information was leaked through hacking that used an AI agent. Even when the scope is widened to the top 20 financial firms with the most frequent IT outages, their information security budget execution rate last year was below 70%, and more than 30% of the allocated money went unspent and was carried into the new year.
The tools of attack have changed. An AI agent is an AI program that handles multiple steps such as searching, opening files and accessing systems on its own once a person sets a goal. When a tool brought in to lighten the workload falls into an intruder's hands, it becomes a channel for accessing multiple systems at once, and the Kookmin Bank incident showed that this can happen at commercial banks as well.
Other institutions were also hit. Damage from hacking using AI agents was confirmed at Shinhan Bank, Hana Bank and BNK Busan Bank, as well as at Yegaram Savings Bank, Welcome Savings Bank and Hyundai Capital in the secondary financial sector. The scale of damage and the timing of the incidents at each company have not been disclosed.
Kookmin Bank was not the only one to leave its budget unspent. Hanwha Life Insurance's execution rate last year was also 58.1%, and Suhyup Bank recorded 60.7%. All three left about 4 won of every 10 won in their information security budgets unspent. An information security budget refers collectively to money spent on preventing hacking, such as firewalls, intrusion detection equipment, external security audits and the labor costs of security staff, and the defenses for that year inevitably become thinner by the amount left unspent.
People are also in short supply. Card companies are increasing their security staff in response to a series of hacking incidents, but they complain that they are struggling to find capable talent.
Warnings have also been raised that AI agents in the financial sector could be manipulated by hidden commands into sending out data or having their transaction privileges abused. Hidden commands are instructions planted inside documents or web pages in a way that is not noticeable to the human eye. If an agent accepts them as normal work instructions, it may go as far as sending customer information outside.
The defenders use the same technology. Artex has developed an AI agent that calls on multiple external AIs to carry out security tests. When a machine takes on the work of probing systems at every point to find weak spots, the scope of inspection widens.
Still, the work of fixing the weaknesses found must be handled by people. At companies that have failed to hire security officers, the inspection reports produced by agents may be left unused.
The execution rate of the top 20 firms for IT outages did not exceed 70%. Attackers target multiple financial firms at once with a single agent, while financial firms' security spending moves within annual business plans. As unspent budgets pile up year after year, next year's plans are also set that much smaller.
For the few minutes it takes to submit loan documents on a mobile phone and press the transfer button to be safe, the people and equipment protecting the agents running behind them must be in place on time. The information security budget that Kookmin Bank left unspent last year exceeds 28.3 billion won. Only when that money is turned into security staff and defensive equipment can people trust the AI assistant inside a banking app with their money.
