[비즈한국] Amid the increasing sophistication of cyber-attack threats, it has been found that domestic companies' spending on information security systems has increased by more than 14% compared to the previous year. This year, the total information security investment by all 773 companies required to disclose such data amounted to 2.4234 trillion won, maintaining an upward trend following last year’s milestone of breaking the 2 trillion won mark.
The ratio of information security investment to total Information Technology (IT) investment for all disclosing companies was recorded at 6.29%, an increase of only 0.24%p over the year. Considering the indicator from two years ago (6.11%), this represents a "stagnation." The ratio of information security investment to revenue for major Information and Communication Technology (ICT) companies also remained in the 0% range. While the scale of information security investment is growing annually, the consensus is that there is still a long way to go.
With the deadline for this year's information security disclosures passing on the 30th of last month, the investment status of major companies has been revealed in detail. This year, 773 companies participated, including 666 companies subject to mandatory disclosure, marking the highest participation rate in the four years since the information security disclosure system became mandatory. The total investment in the information security sector reached 2.4234 trillion won, a 14.4% increase from the previous year (746 companies, 2.1193 trillion won).
Information Security Accounts for Only 5% of Total IT Investment
An analysis of mandatory disclosure materials from major firms—including the three major telecommunications companies, Naver, Kakao, Coupang, and giants such as Samsung Electronics005930, SK Hynix000660, and LG Electronics066570—showed that these 9 companies allocated only about 5.04% of their total IT investment to information security. Comparing the ratio of information security investment to IT investment by sector, the three major telecom companies (SK Telecom017670, KT030200, and LG Uplus) were the highest at 5.97%. The major electronics and semiconductor industry (Samsung Electronics, SK Hynix, LG Electronics) stood at 5.1%, while the two major platforms (Naver, Kakao) were at 4.0%.
This indicator reflects how much priority is placed on security. As digital infrastructure expands, so do security vulnerabilities; thus, security investment must grow in proportion to the scale and complexity of IT systems to effectively control risks. Even at the average level, this is less than half that of the United States. According to a report last year by the U.S. cybersecurity consulting firm IANS Research, the average information security investment ratio for U.S. companies is 13.2%, having steadily increased from 8.6% in 2020.
The status of the top 3 companies in terms of investment scale and objective figures remained solid. Following their disclosures last year, Samsung Electronics, KT, and Coupang were identified as the companies with the highest information security investments among all firms. 1st place Samsung Electronics invested 356.194 billion won in the information security sector throughout 2024, a 19.8% increase from the previous year (297.4 billion won). KT invested a slightly increased 125.028 billion won, and Coupang spent 86.07 billion won, an increase of approximately 20 billion won.
Strengthening Security After Hacks, LG Uplus Shows Growth
The telecommunications industry, which has suffered successive hacking incidents including the SK Telecom data leak in the first half of this year, has recently been strengthening its information security investments. The three major telecom companies had the highest information security investment ratio relative to IT (5.97%). Specifically: SK Telecom at 4.2% (4.4% when including SK Broadband), KT at 6.3%, and LG Uplus at 7.4%.
LG Uplus was found to have increased its information security investment scale and related personnel the most among the three. LG Uplus disclosed an investment of 82.832 billion won in the information security sector for 2024. This is a 31.1% increase compared to the previous year (63.2 billion won), continuing a steep upward trend for three consecutive years since 2022 (44.2 billion won). This highlights their policy of focused investment to strengthen information security capabilities.
In the case of SK Telecom, the investment was 65.231 billion won, a 7.5% increase from the previous year, but the lowest among the three companies. When combined with SK Broadband, which handles the wired business, the total is 93.347 billion won; while higher than LG Uplus, it falls short of KT, which operates both wired and wireless businesses.
Lower Expectations for Naver and Kakao: Why?
ICT, electronics, and semiconductor companies that hold large-scale IT infrastructure and sensitive customer/technical data are playing a leading role in information security investment. It is in this context that these companies occupy the top ranks of investment.
As many companies continue to increase their investment scale, changes in corporate rankings have occurred. SK Hynix, which was 6th among all companies last year, disclosed an investment of 52.6 billion won in the information security sector this year, lower than last year (62.7 billion won). Conversely, SK Telecom and Naver increased their investments, reversing their rankings. Naver stated that it invested 55.3 billion won in the information security sector last year, a 32% increase from the previous year (41.7 billion won). LG Electronics invested 29.597 billion won as of 2024. The ratios of information security investment to IT investment for SK Hynix and LG Electronics were 5.4% and 4.5%, respectively.
In terms of investment scale among the 9 analyzed companies, the two major platforms remained in the middle-to-lower range. Naver and Kakao invested 55.2 billion won and 24.6 billion won, respectively. The ratio of information security investment to IT investment was 4.5% for Naver and 3.5% for Kakao. Kakao ranked at the bottom among the 9 companies in both investment scale and ratio. For these companies, there is an impact where, as IT-based technology firms, the amount reflected as accounting expenditure is small relative to their actual security level or capabilities. Naver explained, "As an IT company, our information technology investment ratio is high. We use many self-developed information security systems, so the reflected ratio of information security investment appears low."
Critics point out that because successive hacking incidents have revealed structural vulnerabilities across the industry, a comprehensive overhaul of security systems is required, going beyond simply increasing budgets. On the 4th, the Ministry of Science and ICT released the results of the joint public-private investigation into the SK Telecom breach and stated that users who terminate contracts due to hacking incidents should be exempted from cancellation fees. The reason is that the company failed in its responsibility for the incident and violated the "obligation to provide safe communications" essential to the contract.
It is expected that moving away from the custom of making reactive, post-incident countermeasures and instead adopting preemptive and systematic security strategies will become a core element of corporate competitiveness. Park Sang-hoon, a specialist at the Korea Institute of Science and Technology (KIST), emphasized, "Small and medium-sized enterprises, as well as large corporations and public institutions, can become targets of attacks. Complacent security awareness is the most dangerous thing," adding, "We must stop viewing security as a consumable cost and instead think of it as an investment or insurance for survival."