Why South Korea's Anti-Hack Labs Run With No Antivirus

The Guard Who Doesn’t Lock the Door

South Korea runs some of the world’s most sophisticated cybersecurity research institutions. The National Security Technology Research Institute (NIST), the Electronics and Telecommunications Research Institute (ETRI), and the Korea Institute of Science and Information Technology (KISTI) are the country’s premier hubs for hacking-defense R&D — the very agencies tasked with protecting the nation’s digital infrastructure from increasingly sophisticated threats.

And yet they are running their servers without antivirus.

Of 14,989 servers across three government-funded research organizations under the Ministry of Science and ICT (MSIT), only 395 — 2.6 percent — have antivirus installed. That means 97 percent of the machines responsible for studying how to defend against hacks are unprotected by the most basic defensive tool available.

The finding, reported exclusively by DongA Ilbo, comes from data obtained by Rep. Lee Hun-ki of the ruling Democratic Party of Korea. It confirms what auditors flagged in July: a systemic gap between what these agencies study and how they operate.

The Budget Argument Falls Apart Fast

When researchers from the Six Agencies cited insufficient budget as their reason for delay, the numbers told a different story.

These six organizations — including the Korea Production Technology Research Institute and the Korean Medicine Research Institute — increased their information security budgets from 2.473 billion won ($1.8 million) last year to 3.619 billion won this year: a 46.3 percent jump. Their budget requests were fully reflected without cuts.

Meanwhile, only 88 of their 751 servers had antivirus. That is a 11.7 percent installation rate despite spending more money.

The cost of doing this properly is not a mystery. Industry estimates put the expense at over 40 million won per 100 servers — a figure that should be trivial for agencies running thousands of machines. The argument that there is no money is increasingly hard to sustain.

Even the Most Exposed Servers Are Naked

The most alarming detail is not that internal servers lack protection. It is that nearly half of the servers connecting directly to the internet — the DMZ-facing machines that serve as doorways into entire networks — are also unprotected.

Across the 23 MSIT-affiliated agencies, 766 external-facing servers were counted. Of those, 372 — 48.6 percent — had no antivirus at all.

This is not a fringe problem. The pattern repeats in recent financial sector breaches across Asia: attackers do not target the core banking systems first. They go through the weak perimeter, the unprotected web-facing server, and use it as a foothold to move laterally deeper into the network.

South Korea’s own national security research institutes are sitting on exactly that kind of door, wide open.

The Regulatory Loophole That Isn’t One

One explanation given by affected agencies during the Audit and Inspection Board’s July review was that installing antivirus on servers is not a legal requirement.

They pointed to the National Intelligence Service’s Basic Guidelines for Cyber Security, which mandate antivirus on general servers but — they argued — do not explicitly require it for the specialized research environments at these institutes.

That interpretation is technically defensible. It is also deeply irresponsible.

The MSIT headquarters itself, operating under the same guidelines, has installed antivirus on 100 of its 108 servers — a 92.6 percent rate. There is no technical reason the research agencies cannot meet the same standard.

Lim Jong-in, a professor emeritus at Korea University’s Graduate School of Information Protection, put it bluntly: “Saying you don’t have antivirus means you are leaving yourself defenseless even against preventable attacks. It is contradictory for institutions that study how to defend against AI-driven attacks to ignore the most basic security measure.”

He compared the situation to car safety researchers refusing to wear seatbelts while designing crash tests.

AI Threats Are Accelerating While Defenses Stagnate

The timing makes the gap feel almost故意的.

AI-powered hacking tools are advancing faster than most defensive frameworks can adapt. Attackers are increasingly targeting application programming interfaces (APIs), automating vulnerability discovery, and crafting personalized phishing campaigns at scale. The threat landscape is moving quickly.

Yet the response from some of South Korea’s top security research agencies is to schedule antivirus installations for 2027.

KISTI, one of the five agencies flagged by auditors, plans to finish installing antivirus on 200 unprotected external-facing servers only by February 2027. Three other agencies have similar timelines stretching into next year.

In July, auditors found that among 17,073 servers at five of the agencies, only 374 — 2.2 percent — had antivirus. By September, that rate had ticked up to just 5.6 percent. The pace of improvement is measured in percentage points per quarter.

Kang Jin-ha, head of security operations at Bespin Global, acknowledged that antivirus alone cannot stop all AI-driven attacks — particularly those targeting APIs and logic flaws. But he stressed that it remains a foundational layer: “Without it, you have nothing.”

What This Means Beyond Korea

South Korea is not an anomaly. Government agencies worldwide — especially those in research and defense — often operate under unique technical constraints that complicate standard security practices. Antivirus can interfere with experimental software, interfere with sensitive data handling, or clash with specialized research environments.

But the Korean case is notable because it is so extreme. A 2.6 percent installation rate across the very institutions supposed to lead on cybersecurity is not a minor compliance gap. It is a structural signal that something is broken in how these agencies prioritize their own security.

For the rest of the world, the lesson is straightforward: institutions that study threats should model the behaviors they recommend. If South Korea’s top cybersecurity researchers cannot be trusted to run antivirus on their own servers, why should private companies, foreign governments, or critical infrastructure operators take their guidance seriously?

Rep. Lee Hun-ki called for all MSIT-affiliated agencies to complete antivirus installation and security audits before the end of this year. Whether that deadline will hold remains an open question — one that will test whether South Korea’s security institutions are serious about the standards they claim to champion.