Artificial intelligence is accelerating the pace of cyberattacks, reshaping the corporate security market. According to Zero Day Clock, a global security metrics site, the time between the disclosure of a vulnerability and its actual exploitation in an attack has shrunk from an average of 2.3 years in 2018 to 20 hours this year, as of April. Companies, by contrast, take an average of 32 to 38 days to patch a vulnerability once it is found. As the speed gap between attack and defense widens, demand is growing for a new type of security that tests AI systems for vulnerabilities in advance and controls the access rights and behavior of AI agents.
Oh Soon-young, senior solutions architect at Amazon Web Services Korea, warned that "as high-performance AI advances, the security assumptions we have held are breaking down," adding that "the industry's overall security strategy needs to be reset." Everything from existing compliance frameworks to vulnerability management and risk management models must change for the AI era, she said.
According to the information technology industry on the 14th, the scope of security is broadening from protecting existing systems to managing AI itself and the permissions and actions granted to it, and the related market is expanding rapidly. Gartner, the global market research firm, projects that worldwide spending on AI protection will rise 68.7% to $4.783 billion next year from $2.835 billion, or about 3.8 trillion won, this year. By 2028, spending is expected to approach $7.7 billion.
The market for AI usage control, which limits the range of corporate systems and data that AI can access, is forecast to grow 73.0% next year, the highest growth rate among major segments. The market for AI gateways, which manage data flows and access between AI and external systems, is expected to expand 70.9%. As AI agents gain direct access to corporate systems and data, the need to manage access rights and the scope of data use is growing.
Shailendra Upadhyay, senior analyst at Gartner, said the market is growing sharply "as companies face urgency to protect AI systems and strengthen defenses against advanced cyber threats," adding that "without sufficient security and visibility controls, corporate AI initiatives run a high risk of failure."
South Korea's information security market is also growing. Domestic information security industry revenue reached 7.1244 trillion won in 2024, up 15.9% from a year earlier, according to the 2025 Information Security Industry Survey released by the Ministry of Science and ICT and the Korea Information Security Industry Association. The number of information security companies rose 7.6% over the same period to 876. With generative AI and AI agents emerging as new objects of protection, domestic security firms are quickly adding technologies that test AI for vulnerabilities and control access rights.
SK Shieldus defines AI agents as a new type of Non-Human Identity, or NHI, that accesses corporate systems to perform tasks, and is widening its AI security coverage from access control to advance vulnerability testing. The approach identifies which systems and data an AI accesses and continuously verifies its identity and permissions, granting only the level of access required. The company also offers an AI red-teaming service that tests AI systems for vulnerabilities from an attacker's perspective. Its white-hat hacker group EQST uses a proprietary database of AI attack scenarios and an AI-specific penetration testing methodology to directly attack generative AI, AI chatbots and AI agents, checking for AI-specific threats such as data leaks, misuse of permissions and agent hijacking.
AhnLab (053800.KQ) is targeting the market for applying AI to security operations. Centered on AhnLab AI PLUS, the company is applying AI to key products including endpoint detection and response and extended detection and response, and also offers features that support security operators' judgment, such as a conversational AI assistant and AI-based analysis reports. It plans to extend AI across its products and services to build an AI-native security framework in which detection, analysis, investigation and response flow as a single process.
The industry believes that as corporate adoption of generative AI and AI agents increases, AI security is likely to establish itself as a standalone market rather than a feature added to existing security products. An industry official said that "if AI agents connect directly to core business systems in finance, manufacturing and the public sector, new security demand will also grow for red teaming that tests AI vulnerabilities in advance, access controls and AI gateways," adding that "the competition in AI adoption will expand beyond how capable an AI a company uses to how safely it controls that AI."
