The defining factor in the recent series of breaches across South Korea’s financial sector was not a new type of cyber-attack, but speed.

Between late September and early October 2026, seven financial institutions reported breaches, with more than 68,000 people estimated to have been affected. The attacker used ‘ARTEX’, a recently released Chinese open-source agentic penetration testing tool, alongside a large language model (LLM).

The methods themselves were not new. Instead of attacking core banking systems head-on, the attacker chose a side entrance. At Shinhan Bank, one of the seven affected institutions, the attacker bypassed authentication on a service for loan brokers, exposing the personal and loan information of approximately 25,000 customers. Credential stuffing, the technique used in the attack, has existed for decades and is entirely possible without AI.

What AI changed was the tempo of the attacks. A financially motivated attacker used AI tools to carry out multiple successful intrusions within a short period.

Three Principles for Application Protection: Three Principles of Cyber Defense

Following these financial-sector data breaches, cybersecurity specialist Penta Security and AUTOCRYPT published a response guide centered on three principles. Each addresses a different stage of an automated attack.

Stage 1: Observability

You cannot stop what you cannot see. Every digital system must have technical measures in place to measure and analyses all cybersecurity-related data. These measures must be implemented and operated independently of the digital system’s operating system and any AI that interacts with it.

Organizations must also regularly check that appropriate safeguards cover all major web services, including ancillary services such as broker portals and employee apps. They must review attack detection logs for signs of abnormal access. Typical examples include concentrated login attempts from changing IP addresses, high failure rates and headless browser fingerprints, all of which are characteristic traces left by automated tools.

Stage 2: Cross-Layer Defense

The interfaces between digital system components are vulnerable from a cybersecurity perspective. Connecting these components creates an attack surface. As digital systems evolve and the number of interfaces increases, the attack surface expands. Attack surfaces exist across multiple layers, so each layer must have an appropriate cybersecurity framework, with these frameworks coordinating both horizontally and vertically.

Stage 3: Zero Damage Design

All cyber-attacks aim to steal or tamper with critical information assets, disable systems or seize control. In today’s AI era, no security controls are perfect.

Measures must therefore be in place to nullify attackers’ objectives. Penta Security identifies four ways to achieve this:

• Encrypt all information assets and manage keys securely.
• Ensure the resilience and systematic recovery of critical functions.
• Use compartmental design to prevent damage from spreading.
• Ensure fail-safe mechanisms, minimal risk maneuvers and emergency stop mechanisms (red buttons) for critical functions.

In other words, protecting the data itself can prevent a breach from causing actual damage. To achieve this, organizations must check how much of their critical data they actually encrypt and how they separate encryption keys from the data those keys protect.

Using AI for Defense

Defense against AI-powered attacks comprises three stages. If the first stage, observability, fails, organizations cannot respond effectively to AI-powered attacks.

Observability starts with a well-tuned, properly functioning web application firewall (WAF). Maintaining that condition is difficult, however, as attack patterns change daily and many organizations lack specialist staff. Penta Security’s logic-based intelligent WAAP, ‘WAPPLES’, bridges this gap by using AI in two ways.

1. AI Logic Analysis Engine

The WAPPLES AI logic analysis engine establishes and continuously optimises security policies to suit each organisation’s business environment. Its policy testing feature allows administrators to inject attack patterns directly into policies currently in operation to check whether they detect the attacks, using the latest and high-risk attack patterns provided by Penta Security.

‘SecureAdvisor’, an AI-based optimization guide, analyses false positives and false negatives to enhance the detection engine. This helps maintain a high standard of security policies against new attack patterns.

2. Machine Learning-Based Self-Checks

A WAF that cannot withstand load and stops functioning becomes a vulnerability in its own right. WAPPLES clusters operational and analytical data accumulated over more than a decade to learn the characteristics of anomalies such as traffic overload, CPU and memory load, and database capacity issues. When it detects anomalies, it raises alerts and responds automatically, even when the administrator is away.

Attackers using AI do not keep office hours. A defense system that undergoes validation and tuning and monitors itself is far less likely to become a weak link.

Getting the Fundamentals Right

AI-powered attacks can rapidly increase the speed and scale of existing attack techniques. Yet the key to reducing actual damage remains the thorough application of fundamental security controls. These incidents show both how quickly a single overlooked service can become an entry point and how a well-configured defense system can stop the same attack.

As AI-related incidents continue to spread, organizations must review their security posture and respond promptly to any issues they find. They must be able to see every attack, avoid relying on a single gateway and prepare to ensure that even stolen data cannot be misused.