KISA 於 2027 年增加 90% 網絡安全評估預算

KISA headquarters in Naju, South Korea. (Photo: KISA)

The Korea Internet & Security Agency (KISA) will increase its budget for outsourced integrated cybersecurity enhancement services by 90% in 2027. The agency will also more than triple the number of IT infrastructure assets subject to security assessments and expand inspections of websites and mobile applications.

KISA said on Nov. 5 that it had recently issued a request for proposals for its 2027 Integrated Cybersecurity Enhancement Services project and begun selecting a contractor. The budget is set at 950 million won, up 90% from 500 million won in 2026. The project will run from January through December 2027.

The assessments will cover 500 IT assets at KISA’s headquarters data center in Naju, 600 at the Korea Internet Information Center’s data center and 400 at external facilities, including private cloud and internet data centers (IDCs). The total number of IT infrastructure assets will rise to 1,500 from 450 in 2026, more than tripling. The number of websites and mobile applications covered will also increase from 39 to 107.

KISA plans to assess technical vulnerabilities in servers, network equipment and security devices, as well as security flaws in websites and mobile applications. It will also analyze backbone network traffic to detect unauthorized communications between segregated networks, including internal business networks, internet networks and contractor networks.

The agency will introduce attacker-perspective penetration testing for the first time in 2027. The tests will assess potential intrusions under scenarios involving malicious hackers or jailbroken AI agents. The aim is to identify previously undetected security weaknesses.

The assessments will also cover vulnerabilities flagged for remediation by the National Intelligence Service and the Ministry of Science and ICT. KISA will examine whether publicly disclosed vulnerabilities identified by Common Vulnerabilities and Exposures (CVE) identifiers affect its information systems and verify that appropriate corrective measures have been implemented.

KISA said the project will go beyond identifying vulnerabilities in information systems to verifying whether remediation measures have been completed.

The contractor will be selected through an open competitive bidding process, with technical capabilities accounting for 90% of the evaluation and price for 10%.