A loan status portal and an employee mobile work system are routine parts of a bank's daily operations. According to industry reports cited by CrowdStrike, both types of business support systems were compromised in recent cyberattacks on South Korean financial institutions.
As AI tools become part of attackers' workflows, they can help identify potential vulnerabilities, analyze target systems, and conduct attacks more efficiently. That raises the bar for enterprise incident response.
01 Attacks on South Korean Financial Institutions Expose Security Blind Spots
On October 2, 2026, South Korea's Financial Services Commission reported that, following a data breach at Shinhan Bank on September 30, other major financial institutions, including KB Kookmin Bank, had also experienced cyberattacks. Regulators called on financial institutions to review their externally exposed IT systems and services, strengthen authentication and access controls, and accelerate threat intelligence sharing.
On October 7, 2026, CrowdStrike published research disclosing AI tool configurations and conversation records associated with the attack activity. Citing industry reporting, the research described the reported compromise of a bank's loan status service for loan brokers and another bank's employee mobile work support system.
CrowdStrike's analysis documented the use of AI tools in this activity. It did not establish the precise contribution of AI to each reported breach, and the number of affected organizations remained unconfirmed as of its October 7 report.
For enterprises, the lesson is clear: security coverage must follow the business and its data. Supporting systems also belong within the scope of defense.
02 AI Accelerates Cyberattacks and Raises New Security Challenges
AI is improving enterprise efficiency while also becoming a tool for attackers. Recent incidents show how it can lower technical barriers and increase the scale and efficiency of attacks.
January–February 2026: Attackers used AI to compromise hundreds of network security devices worldwide.
According to research published by AWS on February 20, an attacker using generative AI compromised more than 600 FortiGate devices across more than 55 countries in just over a month. The investigation did not observe exploitation of FortiGate product vulnerabilities. Instead, the intrusions relied primarily on basic security gaps, including exposed management interfaces, weak credentials, and single-factor authentication.
AI helped the attacker write tools, plan attacks, and automate operations, enabling these common weaknesses to be exploited at scale.
February 2026: AI voice impersonation was used in financial fraud.
Reuters reported on September 25, 2026, citing two people familiar with the matter, that Fideuram, the private bank within Italy's Intesa Sanpaolo group, had been targeted by fraudsters in February. The fraudsters first impersonated the group's chief executive on WhatsApp and requested an urgent international transfer. According to those sources, they then used AI to replicate a lawyer's voice to confirm the instructions by phone, inducing the bank's then-chairman to arrange transfers totaling approximately €95 million. Some of the funds were subsequently recovered. Intesa Sanpaolo and Fideuram declined to comment to Reuters.
As AI voice synthesis advances, a familiar voice or convincing message is no longer a reliable basis for verifying identity. Enterprises need stronger identity checks, transaction approvals, and risk controls for sensitive operations.
These incidents show how AI can make cyberattacks more efficient while placing greater demands on existing defenses. Enterprises need to strengthen three capabilities: find problems earlier, constrain access privileges, and shorten the time from evidence to action.
03 Three Questions to Test Your Enterprise Defenses
First, are security issues affecting critical business operations identified and addressed promptly?
Asset inventories change, code is updated, and cloud configurations evolve. New exposure can emerge after an assessment is complete. Enterprises need to know which issues affect critical operations, who owns remediation, and whether fixes have been verified.
Second, can you limit an attacker's access and actions after an account is compromised?
Administrator accounts, service accounts, and third-party maintenance personnel often have access to multiple systems. If an account is compromised, an attacker may use its existing privileges to extend the intrusion. Enterprises need to define which resources each account can access and when authorization expires, keep sensitive actions recorded and traceable, and promptly detect and block actions beyond authorized permissions.
Third, can your team quickly assess an anomaly and complete a response?
Logs, alerts, identity information, and tickets are spread across different tools. Security teams often have to reconcile them manually to understand what happened. Timely response requires correlating information and reconstructing events, establishing clear approval processes and operating permissions, and confirming that response actions were carried out.
These are the three questions SecNova AI's intelligent enterprise defense solution is designed to address.
04 Fight AI with AI: Bring AI into Critical Defense Workflows
To help enterprises respond to the changes of the AI era, SecNova AI has introduced its “Fight AI with AI” intelligent enterprise defense solution. Four core products connect risk discovery, code remediation, privileged access, and security operations into a defense process that improves continuously.
Find & Fix Security Gaps
AI Pentest and AI Code Audit examine running environments and source code, respectively. They help enterprises understand security exposures and code defects, producing reviewable findings, root cause explanations, and remediation recommendations.
After remediation, retesting and regression testing verify the results. Traceable records give CISOs a clear view of which risks have been resolved and which still need attention.
Control Access. Contain Threats.
AI PAM helps enterprises manage privileged accounts and access rights: identify account owners, protect credentials, and reduce the risk of privilege misuse through least privilege, time-limited authorization, operation approvals, and session auditing. It also helps teams identify anomalous behavior that warrants closer investigation.
Enterprises can establish who received which privileges, when access was granted, what actions were performed, and how to terminate a session or revoke access when risk is identified. Privileged access management should also work with identity management, multifactor authentication, and authentication and authorization mechanisms for business interfaces, so that access is authorized, actions are traceable, and permissions can be revoked.
Detect & Respond Faster
AI SIEM brings distributed logs and signals into a unified investigation process. AI-assisted queries, alert analysis, correlated investigations, and workflow orchestration help security teams organize evidence, prioritize issues, and coordinate response more quickly.
Every response should be traceable to the original evidence, approval decisions, and execution results. AI handles repetitive analysis while security teams retain control over critical judgments and high-impact actions.
The four core products support risk discovery, code remediation, privileged access management, and security operations, working alongside existing tools such as WAF, EDR, IAM, MFA, and DLP.
05 Measure Defense Outcomes with Evidence
After introducing an AI security solution, enterprises need to verify three outcomes.
Risk governance: Are critical assets covered? Are confirmed issues remediated on time? Can retest records be compared against the original version? Track the verified risk closure rate, overdue remediation, and residual risk.
Identity protection: Are privileged accounts under management? Are permissions granted as needed? Are sessions traceable? When risk increases, do access restrictions actually take effect? Review authorization records, session evidence, and the results of permission revocation.
Detection and response: Are critical activities observable? Do investigation conclusions link back to original logs? Do approved responses complete their intended actions? Measure the time spent on detection, investigation, approval, and execution separately to confirm improvement at each stage.
This evidence supports a continuous cycle: discover risks, remediate issues, and verify fixes; control access, detect anomalies, and execute approved responses; then feed lessons from incident reviews into the next assessment.
Each cycle should leave an auditable record that helps teams determine which gaps have been closed and where further investment is needed.
06 Start with One Critical Business Scenario
Enterprises can begin a focused proof of concept (PoC) with a critical application, a privileged access scenario, or a representative security incident.
Define the scope and evaluation criteria first. Then verify three things: whether risks have been remediated, whether access controls are effective, and whether incident response actions were completed. Use reviewable records to identify gaps and guide further improvements.
For sensitive operations such as fund transfers, combine technical safeguards with independent verification, business approvals, and staff training to reduce risk across both systems and business processes.