As generative artificial intelligence (AI) and cloud technology proliferate, the speed of security threats is increasing, prompting companies to shift towards automated and agent-based security systems.
On July 1, Amazon Web Services (AWS) held a press conference titled 'AWS Security 101' at its office in Gangnam, Seoul, where it shared insights on the changing security landscape and response strategies in the era of high-performance AI.
Shin Eun-soo, AWS Korea's Chief Security Solutions Architect, stated, "High-performance AI is changing the speed and scale of cyberattacks."
According to AWS, frontier AI models are evolving to not only detect zero-day vulnerabilities but also generate functional exploits and suggest root cause fixes. Recent benchmarks indicate that the success rate of exploits has reached as high as 87%, while the review time for security experts has decreased from weeks to hours.
Shin noted, "As AI accelerates the timeline of attacks, companies' vulnerability response systems are struggling to keep pace." AWS reported that the average time from vulnerability discovery to actual exploitation has decreased from 2.3 years in 2018 to five days in 2024, and is expected to be around 20 hours in 2026. In contrast, companies still take an average of 32 to 38 days to identify and apply patches for vulnerabilities.
While attacks have sped up to hours, defenses still rely on manual checks and reactive measures, which could widen the response gap in the AI era.
To address this response gap, Shin emphasized the need to enhance the level of automation in security operations. He explained that utilizing automated inference to mathematically validate security policies and network configurations, along with large-scale threat intelligence and security agents, is essential to shorten the process from detection to verification and remediation. He advocated for a shift from periodic checks to a continuous verification system.
As a domestic example, LG CNS presented a case of AI-based security inspection. Lee Jin-wook, head of LG CNS's RED team, discussed the automation of penetration testing using AWS security agents. He noted that while the demand for security inspections is rising due to an increase in major security incidents and the expansion of AI transformation (AX) projects, the pool of white-hat hackers is limited, and existing automated scanning tools face challenges with false positive verification, limiting practical application.
According to Lee, LG CNS is exploring the use of AWS security agents in its security review process and has confirmed the feasibility of practical application in some inspection processes. The AWS security agent not only provides vulnerability scanning results but also presents the rationale and inference process, reducing the burden of result verification. When additional context, such as account permission information, is input, the reliability of inspections increased from 60% to 90%.
In terms of efficiency, LG CNS reported notable improvements. When expert verification was conducted alongside, the average inspection cost decreased by 30%, and the inspection duration was reduced from five days to three. Inspections conducted solely with the agent saw costs drop by 70%, with the time frame shrinking from five days to one. However, Lee noted that expert verification remains necessary in areas requiring review of complex business logic or actual risk assessment.
Lee stated, "The introduction of AI agents will not lead to a reduction in the role of security experts. Instead, repetitive inspections will be handled by AI, allowing experts to focus on validating complex business logic, interpreting results, and communicating with development teams, thereby enhancing the role of white-hat hackers."
* This article has been translated by AI.
Copyright ⓒ Aju Press All rights reserved.