Fighting AI with AI: Korea to phase out ‘network separation’ rules for financial firms

An illustration displays the words "AI Hacking" and PHP code, Oct. 22. Reuters-Yonhap

SEUL, November 6, 2026 — Korea’s financial authorities are moving to phase out longstanding rules requiring financial firms to separate their internal networks from the outside internet, in a bid to strengthen the industry’s defenses against sophisticated cyberattacks powered by artificial intelligence (AI), officials said Friday.

However, cybersecurity experts warn that easing the rules before adequate safeguards are in place could open new avenues for attack.

Financial Services Commission (FSC) Chairman Lee Eog-weon announced Thursday that the regulator would launch a task force this month to develop a plan by the first quarter of next year to replace the so-called “network separation” rules with an AI-based security framework, guided by the principle of “fighting AI attacks with AI.”

The task force will bring together officials from the FSC, the Ministry of Science and ICT, the National Intelligence Service, the Financial Supervisory Service and the Financial Security Institute, alongside private-sector AI and cybersecurity experts and financial industry executives.

The changes will be phased in rather than applied across the industry all at once, with institutions deemed better equipped to manage cyber risks allowed to move first.

Introduced in 2013 after a major cyberattack paralyzed the computer systems of several banks and broadcasters, the “network separation” rules require financial institutions to keep their internal networks separate from the internet, limiting hackers’ access to critical systems.

But as hackers increasingly use AI, firms say restrictions on access to advanced external technologies, including cloud services and high-performance AI systems, are hampering their ability to detect and counter attacks.

In response, authorities began granting temporary exemptions to allow selected firms to use AI-based cybersecurity tools, announcing the first group of participants in June. On Friday, they named 13 additional participants for the second round of the pilot program, including NH NongHyup Bank, Kakao Pay, Samsung Life Insurance and KB Kookmin Card.

Notably absent was KB Kookmin Bank, which recently suffered a cyberattack that exposed the personal information of 2,091 customers. Shinhan Bank and Hana Bank also experienced breaches but had already been selected for the first round.

The exemptions, however, offer limited relief because they are temporary and narrowly defined. Authorities have therefore decided to pursue a phased lifting of the rules using separate tracks.

The push for regulatory change comes amid a growing wave of cyber incidents across the financial sector. From Sept. 30, when a data breach at Shinhan Bank was confirmed, through Tues, authorities received reports of 40 security incidents involving 37 companies, including banks, insurers, securities firms and cryptocurrency businesses.

The incidents exposed more than 473,000 records and resulted in the theft of at least 1 billion won ($737 million), the FSC said.

Experts note that the pace of deregulation should depend on each institution’s ability to manage cyber risks and the sensitivity of the data involved, rather than follow a uniform timetable. Removing an already established layer of protection before adequate alternatives are in place could open up vulnerabilities that the existing system has helped contain.

“Network separation has played a role in preventing external intrusions from spreading to critical financial systems. Rather than scrapping it altogether, regulators should consider applying different levels of separation depending on the importance of the systems and data involved,” said Hwang Suk-jin, a professor at Dongguk University’s Graduate School of International Affairs and Information Security.

“The more connections institutions establish with external systems, the more opportunities hackers have to break in.”

The professor added that authorities should focus less on setting a deadline for lifting the restrictions and more on evaluating firms’ internal security controls and scrutinizing the systems they connect to external networks.

The Korea Times