(EDITORIAL from Korea Herald on Oct. 28)

Korea faces a troubling gap in cyber defense capabilities. After recent disclosures of critical vulnerabilities, the government quickly raised its cyber alert level. However, days later, it remains unclear if the necessary repairs have been completed. The problem lies in the disconnect between detecting weaknesses and confirming their resolution.

AI has accelerated attacks by providing hackers with powerful tools to locate and exploit software flaws quickly. While researchers can use AI to analyze code for vulnerabilities, attackers can leverage the same technology to identify at-risk systems even before patches are deployed. This rapid cycle leaves organizations vulnerable to attacks.

Many companies lack the resources to rapidly respond to security updates, particularly smaller businesses that may have outdated systems built by outside contractors. Without proper maintenance records or clear accountability, some organizations may not have the capacity to promptly install critical fixes, especially if doing so would disrupt their operations.

The government's ability to oversee this process is also limited. It cannot verify whether vulnerable systems are fixed across public institutions or even determine the extent of the problem. This lack of visibility and authority leaves the government powerless to ensure compliance.

To address these issues, policy must create a clear process for tracking and confirming system repairs. Authorities need an up-to-date inventory of all software running critical services, along with clear responsibility for applying and verifying each update. When an update is unavailable or a system cannot be patched quickly, operators should have alternatives, such as isolating the vulnerable service.

Public and private security firms must have a reliable channel for sharing threat intelligence, with clear assignments of responsibility for acting on it. Smaller businesses should receive practical assistance to meet these demands, including financial support for security assessments and the replacement of obsolete systems.

Smaller businesses with large volumes of personal information should face penalties for persistent neglect of security. Incentives should reward sustained investment in maintenance and timely updates. While AI can improve detection, it cannot establish accountability or ensure that repairs are completed. Every cyber alert should identify who is responsible and require independent confirmation that the repair has been completed.

Korea must measure its cyber defenses not only by the time it takes to issue warnings but also by the time it takes to verify that those warnings have been acted upon.