Select Language

Contact

Company

Service

Product

Media Center

Contact

Company

Service

Product

Media Center

Select Language

Contact

Company

Service

Product

Media Center

Go to Top

Security Insights

The 2026 Security Shift : What’s Changing and How

EnkiWhiteHat

Jan 20, 2026

Content

The major accidents repeated in 2025 showed us an inconvenient truth.

The reality that “we could get breached even after fulfilling all obligations.”

The issue is not the misfortune of a specific industry but that fundamental weaknesses, such as managing old vulnerabilities, clarifying authorizations (accounts), and authentication structures, were accumulating throughout organizations.

In this situation, the government started this year to make security visible through 'evidence' rather than 'words' and to change the structure to prepare before incidents occur, not after.

Our security system was designed around regulations from the early 2000s when the internet was just growing. While the world has completely shifted to cloud, mobile, AI, and platform economies, the security of many organizations remained at the level of 'filling out checklists.' Security officers completed checklists, and executives were comforted by asking, "Did you fulfill all obligations?"

Underneath this was the sentiment that "security is inconvenient and just costs money." It was always pushed to the back of the line in terms of budget and manpower because it’s not usually visible. But when incidents occurred, regret like “we should have paid more attention then” followed. The year 2025 starkly revealed how much this structural complacency and fatigue had accumulated.

Against this background, from 2026, Korea’s security will change comprehensively focusing on three pillars.

Mandatory disclosure of information protection, strengthening the effectiveness of the Information Security Management System (ISMS·ISMS-P) certifications, and changing the evaluation indicators of cybersecurity conditions in government and public institutions.

While these three target the private sector, certification systems, and public sector respectively, they carry a common message.

"Security is now substantive rather than formal, evidence rather than words, and an evolving response rather than fixed standards."

First Transition: Mandatory Information Security Disclosure - "Era of Unconcealable Trust"

The first change is the comprehensive expansion of the mandatory information security disclosure targets.

On January 9, the Ministry of Science and Technology announced a proposed revision to the [Enforcement Decree of the Act on Promotion of Information Security Industry], which includes expanding the scope of businesses subject to mandatory information security disclosure and changing the criteria for calculating the number of users (proposed Article 8, Paragraph 1).
Previously, only companies with a designated CISO and sales of 300 billion KRW or more were required to disclose. The amendment removes this content and expands the mandatory scope to include all listed corporations on the securities and KOSDAQ markets (Revised Article 8, Paragraph 1, Item 2). The criteria for calculating the number of users have also been revised from the average over the last 3 months of the previous year to the average for the entire previous year (Revised Article 8, Paragraph 1, Item 3). Companies required to have information protection management system certification, according to the Information and Communications Network Act as of the end of the previous year, will be included as mandatory subjects of the information security disclosure system (New Article 8, Paragraph 1, Item 4).

Previously, only very large companies (sales of 300 billion KRW or more, etc.) were obliged to disclose how much they invest in and strive for cybersecurity, but this scope has now expanded. Most exceptions for public institutions, financial companies, and small businesses will also be removed.

The government is proceeding with follow-up procedures aimed for implementation by 2027. By 2027, all listed companies will be required to disclose a 'security report card'.

The meaning of this change is not simply that ‘targets have increased’. Looking at incidents involving SK Telecom, KT, and Coupang, the belief that “because it’s a large company, it must be safe” has been shattered. Investors and customers now want to verify, "Is this company's security organization properly established?", "How much was invested in security this year?", and "How did they respond when an incident occurred?" The era of security becoming public information, like financial statements, has come.

A more important change is the quality of disclosure.

The Ministry of Science and ICT has announced revisions to the drafting standards and formats to enhance the effectiveness of the disclosure system. It is not just about stating "how much money was invested in security". Now, very specific security activities must be documented.

It is basic to accurately identify and manage how many computers and servers our company owns. Disclosure must include what internal rules have been set and are being operated for security. Specific plans must be established for how to respond in the event of a hacking incident. It is also essential to check whether the board of directors, which makes key company decisions, directly addresses board security issues. Companies must now not only say, "We are doing well in security," but also show proof in numbers.

This means that disclosure is not a venue for packaging a message of ‘we are doing well’ but rather it turns into data that allows for company comparisons.

In the future, specific numbers such as "Our company's security investment increased by 30% compared to last year, conducted 4 penetration tests, maintained 0 incidents" become a strong signal of trust for investors. Conversely, companies that are not prepared will have to disclose embarrassing figures, and investor trust will decline.

Second Transition: Strengthening ISMS·ISMS-P Effectiveness - "Achieving it once is not the end"

The second point is a comprehensive strengthening of the effectiveness of the Information Security Management System (ISMS·ISMS-P) certification.

The Personal Information Protection Commission and the Ministry of Science and ICT announced on December 8, 2025, that they will proceed with a system reform to enhance the effectiveness of the Information Security Management System (ISMS) certification and the Information Security and Personal Information Protection Management System (ISMS-P) certification based on the Information and Communication Network Act Article 47 and the Personal Information Protection Act Article 32-2.

This is because incidents have been repeated in 2025, leading to increased criticism that "the certification does not keep up with reality."

Accordingly, it was announced that the previously voluntary ISMS-P certification will be made mandatory for key public and private personal information processing systems (major public systems, telecom companies, large-scale platforms, etc.) to establish a constant personal information safety management system.

Additionally, stronger certification standards will be developed and applied to large companies with significant national influence, such as telecom companies and large platform operators. The Personal Information Protection Commission and the Ministry of Science and ICT plan to promptly push for amendments to the Personal Information Protection Act and the Information and Communication Network Act for this purpose.

The examination method will be thoroughly strengthened by pre-verifying key items during the preliminary review and enhancing technical reviews and on-site verification audits. An industry-specific certification committee will be operated, and auditors will be educated on new technologies such as AI to enhance the professionalism of the certification.

Post-management will also be dramatically strengthened. If a data breach occurs at a certified company, a special post-audit will be conducted promptly to verify compliance with certification standards. If significant defects in certification standards are found during the post-audit process, certification can be canceled through review and resolution by the certification committee. Moreover, for companies involved in incidents, the personnel and duration of post-audits will be doubled, and the causes of incidents and measures for preventing recurrence will be intensively inspected.

Many companies have so far considered that "once you get certified, it's over," akin to a license. All that was needed for renewal was proper documentation. However, the repeated hacking incidents at certified companies have rendered the phrase "We are ISMS certified..." ineffective, collapsing the trust of the public and investors.

In this context, technical reviews such as vulnerability diagnostics and penetration testing, and on-site verification centered on key systems will be strengthened. You cannot pass with just documentation; the actual safety of the system must be confirmed. A special post-audit will be conducted if a data breach occurs. Certification can be revoked if major defects are found.

In short, certification is no longer a 'once and for all' — it marks the beginning of constant management and proof. SK Telecom has maintained its certification despite neglecting vulnerabilities for eight years. However, in the future, certification may be canceled following a special review in the event of a major incident. It's changed from "once and for all" to "continuous proof is required for maintenance." This means an era is opening where "proof of operation worthy of maintaining certification" becomes more important than "holding the certification" itself.

From a corporate standpoint, the burden may increase, but conversely, it creates a rule whereby companies that genuinely excel can gain trust.

Third Transition: Changes in Cybersecurity Evaluation Indicators for Government and Public Agencies - "Not whether the network is segmented, but whether it's properly protected"

The third change is a fundamental shift in cybersecurity evaluation indicators for government and public institutions. The National Intelligence Service revamped the cybersecurity evaluation indicators for public institutions by the end of 2025. This restructuring signals not just a simple score adjustment, but a change in the very criteria for viewing cybersecurity.

The focus has shifted from “filling out checklists” to awarding more points to aspects that genuinely enhance operational capabilities such as “budget allocation, training, recovery, and policy transition.” Furthermore, it's not about “network segregation” but rather “ensuring actual safe operations in the AI and cloud era.”

The main feature of this indicator overhaul is that it clearly encourages the adoption of new technologies. Institutions that incorporate AI-based security monitoring systems or establish the National Network Security Framework (N2SF) will receive additional points.

It's not just a message that it's okay to use new technologies, but a clear directive that “not using them will put you at a disadvantage in scoring.” Especially, AI is no longer just a technology for automating tasks. In security, it has become a crucial tool to supplement areas prone to human oversight, such as log analysis, anomaly detection, and prioritizing responses. The 2026 evaluation asks if these changes are being properly followed.

Moreover, it goes beyond preventing incidents to assessing the ‘resilience and recovery capacity.’ Throughout 2025, there were experiences where national services were immediately disrupted when systems halted due to cyberattacks or fires. The government has increased the weighting of disaster and incident response items. Simply saying “there is a plan” is no longer sufficient. Points will directly reflect whether actual cybersecurity training has been conducted, if budgeting has been secured, and if recovery capabilities are prepared. Security is not a declaration but a result of preparation, training, and investment.

The 2026 cybersecurity evaluation is no longer a ‘checklist.’ It is a testing ground for assessing a truly operative security system and operational capabilities.

What Three Transitions Tell Us

The three changes starting in 2026 target different areas but convey a single consistent message.

"Security is now a domain where we must openly demonstrate our competence, rather than just claiming 'we're doing well.'"

Information protection disclosure demands that private companies transparently reveal their security status, enhanced ISMS certification requires ongoing evidence rather than a one-time verification, and changes in the assessment indicators urge the public sector to have real control capabilities rather than formal criteria.

Overall, the focus of security is shifting completely from "formal compliance" to "substantial operation."

Organizations that are unprepared will have to disclose embarrassing figures, face difficulties in obtaining certifications, and receive lower scores in evaluations. However, for organizations that excel, security becomes a measure of trust, a distinctive competitive edge, and sends a strong signal to the public as a "trustworthy organization." 2026 will not just represent a regulatory shift but mark the beginning of a societal transformation in the perception of security.

EnkiWhiteHat

가천대 스타트업 컬리지 겸임교수

Offensive security experts delivering deeper security through an attacker's perspective.

EtherRAT Targeting Windows Disguised as a Game Mod Installer

Threat Intelligence

EtherRAT Targeting Windows Disguised as a Game Mod Installer

Threat Intelligence

EtherRAT Targeting Windows Disguised as a Game Mod Installer

Three Ways to Respond to Security Transitions Thumbnail

Security Insights

How to Prepare

Security Insights

How to Prepare

Security Insights

How to Prepare

Security Insights