Using security analysis AI
within Korea's network separation rules
Under the Electronic Financial Supervisory Regulation (전자금융감독규정), the internal business networks of financial companies in Korea are separated from the internet. This also applies to Korean subsidiaries and branches of foreign financial groups. The 2024 network separation improvement roadmap opened a path to generative AI and SaaS, but most of it comes with conditions: a regulatory sandbox designation and security measures. For work that has to see all of your internal data, like security log analysis, keeping the AI inside the internal network makes the process simpler.
What it requires
The legal basis for network separation is Article 15 (measures to prevent hacking and similar attacks) of the Electronic Financial Supervisory Regulation.
What follows is based on Financial Services Commission (FSC) Notice No. 2026-29, in effect since July 15, 2026.
Logical separation. Article 15(1)(iii) requires internal business systems connected to the internal network to be separated and blocked from external networks such as the internet, with access prohibited.
Physical separation. Item (v) of the same paragraph requires information processing systems in the data center, and the terminals that connect directly to them for operations, development or security, to be physically separated from external networks. That includes the terminals security monitoring staff use to connect directly to servers.
There are two exceptions. The first covers research and development that doesn't process users' unique identification information or personal credit information (pseudonymized data handled under the pseudonymization rules is excluded), where the company has done its own risk assessment, applied the alternative security controls set by the Governor of the Financial Supervisory Service (FSS) in place of network separation, and received approval from its information security committee. The second covers cases that are unavoidable for business reasons and confirmed by the FSS Governor (for item (v), recognized by the Governor).
Clauses that touch security operations
- Article 15(3): appoint an owner for each information security system and keep its operating results for at least 1 year
- Article 15(4): set up and run measures to prevent electronic intrusions, limit damage and recover quickly
- Article 16: measures to prevent malware infection and spread, and to recover from it
- Article 18: record and keep internet access history for internal and external IPs separately for at least 1 year
- Article 14-2: using cloud computing services requires a business criticality assessment, a provider security assessment and a business continuity plan, followed by review and resolution by the information security committee
Network separation improvement roadmap for the financial sector (August 13, 2024)
A three-stage plan announced by the FSC.
Stage 1 opens things up through the regulatory sandbox first, and tasks that prove safe are then moved into the regulation.
Allowed first through the sandbox
Sandbox exemptions from the internet use restrictions allowed the use of generative AI. For SaaS, the scope widened from non-critical work such as document and HR management to security management and customer relationship management (CRM), and processing pseudonymized data and using mobile devices were also allowed. Research and development networks are being addressed by amending the Electronic Financial Supervisory Regulation.
Extended to personal credit information
Once stage 1 results and safety are verified, the exemptions widen so companies can process personal credit information directly, beyond pseudonymized data. As the data scope grows, more security measures are attached.
Self-directed security with accountability for outcomes
Verified tasks move into the permanent framework, and a Digital Financial Security Act (working title) would shift regulation from rule-based to goal and principle-based. Under this direction, the liability a company carries after an incident actually gets heavier.
Under the roadmap, sandbox designations come with security measures matched to the expected risks, and the FSS and the Financial Security Institute (FSI) carry out security checks and consulting for each applicant. In practice, using an external AI means meeting each of these conditions one by one.
AI guidelines for the financial sector
The FSC announced these guidelines on June 18, 2026, and they took effect on June 22.
They merge what used to be separate documents: the AI operating guidelines for finance, the guide to developing and using AI, and the AI security guidelines.
They set seven principles for every financial company that uses AI: governance, legality, AI as a supporting tool, reliability, financial stability, good faith, and security. They are self-regulation with no statutory force, so each company decides how far to apply them. Where the AI Basic Act governs a case, such as high-impact AI, separate legal duties apply.
On the same day, two companion documents were released: the AI Risk Management Framework for the financial sector (FSS), which spells out the governance principle, and the AI Security Guide for the financial sector (FSI), which spells out the security principle. In practice you read both together.
Principles that apply when you use security AI
- AI as a supporting tool: AI verdicts stay in the role of helping people decide. You need a record of who approved actions such as isolation or blocking.
- Reliability: you have to be able to explain why a verdict came out and check it again, or you won't have answers during an examination.
- Security: the AI system itself is subject to security checks and improvement. Isolate the analysis AI so it doesn't become an attack path.
Why security analysis happens inside the internal network
The data you analyze lives on the internal network
Monitoring logs mix employee accounts, internal IPs and records of customer data lookups. Sending them to an external AI means going through a network separation exception or a sandbox designation, plus a review of personal (credit) information processing.
No new exception needed
When Genox is installed on the internal network, analysis finishes inside it, so you don't need a separate exception for an external connection. Detection rule and model updates are brought in offline.
Records you can pull out during an examination
Each verdict is stored with its evidence, reasoning, confidence, and the model and policy versions. You can use these to address the reliability principle in the AI guidelines and the Article 15 requirement to keep operating results.
Internal installation doesn't solve everything. You need a procedure for bringing in updates, and you still have to do the internal security review for introducing an information processing system and report to the information security committee. If you want a Korea-only cloud setup, you first have to go through the Article 14-2 cloud usage procedure.
How the requirements map to Genox features
Using Genox doesn't count as meeting the regulation.
Below are the features you can use when preparing for each requirement, and what you still have to do yourself.
| Requirement | Related Genox features / services | What you have to do yourself |
|---|---|---|
| Article 15(1)(iii) and (v) Network separation | Standalone installation on the internal network, analysis nodes with outbound transmission blocked | Design the network and keep it separated. If you need an exception, do the risk assessment and get information security committee approval |
| Article 15(3) Keep information security system operating results for at least 1 year | Monitoring verdict records and signed audit logs, with the retention period set by you | Appoint owners, set retention to at least 1 year, and check that it is actually kept |
| Article 15(4) · Article 16 Intrusion prevention and recovery, malware measures | AI security monitoring and MDR, Behavioral Analyzer sandbox, incident response | Approve response procedures, meet legal reporting duties such as reporting to the financial authorities |
| Article 18 Keep internet access history per IP for at least 1 year | Receives proxy and firewall logs and analyzes unusual connections | The access history itself must be recorded and kept by your proxy, firewall or similar |
| Network separation improvement roadmap Generative AI and SaaS sandbox | AI/LLM red team assessment to check injection and leakage risks in the AI service you plan to adopt | Apply for the sandbox, meet the designation conditions, respond to FSS and FSI checks |
| AI guidelines for the financial sector Seven principles | Reasoning chain and replay record for each verdict, human approval steps, AI governance consulting | Set up the AI governance structure and risk management criteria, decide how far to apply the guidelines |
Frequently asked questions
Do we still need internal installation after the network separation roadmap?
The roadmap opened a path to generative AI and SaaS, but most of it depends on a sandbox designation and on carrying out security measures. Security analysis has to see all of your internal logs, so it sends a lot of data out, which makes those conditions harder to meet. That's why Genox installs on the internal network by default.
If we use Genox, will we have no issues in FSI checks or FSS examinations?
We can't say that. Records from Genox can serve as explanatory material during an examination, but compliance is judged by looking at how the company runs its controls as a whole.
Do the financial AI guidelines apply to security monitoring AI?
The guidelines cover financial companies that use AI in general, regardless of sector or task. If you use AI for security monitoring, it's safer to include that AI in your governance and security reviews too. How far to apply them is up to the company.
Can we use it on a Korea-only cloud?
You can, but you have to go through the cloud usage procedure: a business criticality assessment, a provider security assessment, a business continuity plan, and review and resolution by the information security committee. Genox provides the material you need for these assessments, but the company does the assessment and the resolution itself.
References
- Electronic Financial Supervisory Regulation (전자금융감독규정), Korean National Law Information Center (in Korean)
- Announcement of the network separation improvement roadmap for the financial sector, FSC press release, August 13, 2024 (in Korean)
- Planned revision of the financial sector AI guidelines and draft guidelines, FSC press release, December 22, 2025 (in Korean)
- Announcement of the AI guidelines for the financial sector, FSC press release, June 18, 2026 (in Korean)
Show us your internal network layout first
Share your network diagram and the monitoring tools you use today, and we'll work out where Genox should sit and which approvals you'll need.