Seoul, the capital of South Korea and home to nearly half of the nation’s population, is a prime target for cybercriminals due to its numerous government organizations and critical infrastructure. However, despite its vulnerability, the city is leveraging the threats leveled against it to its advantage by employing artificial intelligence, a technology that continuously improves the more data it receives.
On May 16, The Readable interviewed Kim Wan-jip, Director of the Information Communication and Security Division at the Seoul Metropolitan Government, to learn how Seoul uses AI to monitor and respond to cyber threats. “The AI Seoul Security Center, which operates around the clock, continuously receives and analyzes incoming external threats, allowing it to provide robust security for the city’s institutions,” said Kim.
In September 2023, the city of Seoul integrated AI into its existing Security Operation Center (SOC) to address growing cyber threats. This technology has enabled city officials to respond to breaches instantly. “Before adopting AI, human operators had to manually respond to each threat, taking about 20 minutes per threat to implement basic security measures, such as setting up a web application firewall or blocking malicious internet protocols,” said Kim. With AI, this process has been reduced to six seconds per threat. “It is comparable to the efficiency of 200 human operators,” added Kim.
In line with the city’s commitment to security, its top priority in security operations is to uphold public trust by ensuring the availability of government services and bolstering resilience. The AI-powered Seoul Security Center, now responsible for responding to cyber threats across the city’s 25 districts, collaborates closely with various South Korean government entities—including the Ministry of the Interior and Safety, the National Intelligence Service, and the Ministry of Science and Information and Communication Technology—to oversee security incidents. In addition, the center operates a personal information detection system that scans websites or emails in the public sector to identify leaked personal information. Once identified, the system takes immediate action, either deleting or encrypting the sensitive data in real-time, according to Kim.
Several AI SOCs operate across the nation, all performing similar functions. Kim emphasized the distinction between Seoul’s system and those in other districts, underscoring the scale of the attacks each manages, a factor correlated with the system’s maturity level.
The director further emphasized, “Seoul oversees a far greater number of institutions than any other city in South Korea. Consequently, we face a substantially larger volume of attacks. This glut of information, however, is useful as it provides us with more raw material for the AI system to process.”
“In other words,” Kim continued, “the data we gather allows us to build increasingly sophisticated monitoring systems. As AI continuously learns from the extensive array of threat information it collects, our incident response grows more and more effective,”
Seoul’s efforts to enhance the learning capabilities of the AI Security Center are ongoing. Kim plans to strengthen the AI Security Center by integrating both internal and external threat intelligence updates. Additionally, the director announced plans to establish an AI-specialized workforce starting next year while maintaining collaboration with relevant agencies.
Kim concluded, summarizing, “In short, the more attacks we weather, the ‘smarter’ and stronger we become.”
