As hacking and data leak incidents targeting the financial sector continue, whether banks have properly invested in information security is emerging as an issue. Major banks’ information security investment shares exceed a past recommended standard for the financial sector, but their actual budget execution rates are low. Some banks have also reduced security’s share of overall information technology (IT) investment. With banks moving again to expand security spending after a recent string of hacking incidents, attention is focused on whether bigger budgets will translate into vulnerability improvements and stronger response capabilities.

Data from the financial sector and information security disclosures from the Korea Internet & Security Agency (KISA) show that in 2025, information security investment as a share of total IT investment at the four major commercial banks was 9.1 percent at Woori Bank, 9.0 percent at Hana Bank, 8.15 percent at KB Kookmin Bank and 7.96 percent at Shinhan Bank.

That exceeds 7 percent, the share of the information security budget under the financial sector’s past “5·5·7” recommended standard. The “5·5·7” guideline recommended securing IT personnel at 5 percent or more of total staff, information security personnel at 5 percent or more of IT staff, and allocating 7 percent or more of the IT budget to information security.

The guideline has been operated as a voluntary guide by the Financial Security Institute since 2020. Still, meeting the past recommended level alone makes it difficult to judge whether information security investment is appropriate.

Looking at investment trends by bank, some banks saw information security investment amounts and shares fall even as overall IT investment increased.

Shinhan Bank’s IT investment rose 8.1 percent to 463.4 billion won in 2025 from 428.8 billion won in 2024, but its information security investment edged down to 36.9 billion won from 37.0 billion won. Its information security share also fell to 7.96 percent from 8.64 percent. By contrast, KB Kookmin Bank’s information security investment share rose to 8.15 percent from 7.49 percent over the same period.

◆ Security budget execution rate at four major banks is 68 percent... some also cut this year’s allocation

Separately from the size of information security investment, attention is also focused on how much of the allocated security budget was actually spent.

Data the Financial Supervisory Service submitted to parliament show that the four major commercial banks allocated a total of 244.6 billion won for information security in 2025. Actual spending was 166.3 billion won, for an execution rate of 68.0 percent.

The execution rate for information security budgets at the four banks fell for a second consecutive year, to 68.0 percent in 2025 from 69.5 percent in 2024 and 73.5 percent in 2023.

Over the same period, allocated information security budgets increased 16.8 percent to 244.6 billion won from 209.3 billion won. Actual spending rose 8.0 percent to 166.3 billion won from 153.9 billion won. Actual execution did not keep pace with the growth in allocations.

Data that Park Sung-hoon (박성훈), a People Power Party lawmaker on the National Assembly’s Political Affairs Committee, received from financial authorities also showed that the information security budget execution rate in 2025 at the top 20 financial companies by number of IT system failures was 69.6 percent. Actual spending was 305.0 billion won out of 438.0 billion won allocated.

◆ Banks expand security investment after string of hacking incidents... execution effectiveness is key

Against this backdrop, cyber threats against the financial sector are expanding. In response to a recent series of hacking incidents in the financial sector, major banks are moving to increase information security budgets and upgrade security systems.

KB Kookmin Bank said it plans to allocate more than 100.0 billion won for its information security budget in 2027. That would be an increase of at least 16.2 percent compared with the 86.1 billion won allocated for 2026.

A KB Kookmin Bank official said, “To support the prevention of secondary damage to customers whose information was leaked after the incident, we have established and are operating a dedicated customer center, and we have formed an internal task force team (TFT) to respond to personal information leakage incidents.” The official added, “We will reestablish group-level information security governance and continue to expand security investment.”

It is also pushing new security projects to respond to cyber threats using artificial intelligence (AI).

KB Kookmin Bank is working to complete an AI threat response project worth about 5.1 billion won within this year. It is verifying the performance and effectiveness of active defense technology to respond to various AI attacks through internal white-hat hackers. It is also reviewing research and adoption of AI-based security solutions. It plans to reflect related technology adoption in its 2027 business plan.

Shinhan Bank also says it plans to allocate its 2027 information security budget at the highest level in the industry.

A Shinhan Bank official said, “Through internal discussions, we are currently analyzing the history of budget allocations and execution at our bank and other banks over the past three years.” The official added, “Based on this, we are reviewing the future direction of budget operations and areas of information security investment, and we plan to allocate the budget at the highest level in the industry.” The specific budget size and the rate of increase from the previous year have not yet been finalized.

Hana Bank is currently pursuing a security system 구축 project worth several tens of billions of won. By contrast, Woori Bank says there is nothing specifically decided regarding an increase in next year’s security budget or an expansion of information security specialists.

Still, it is difficult to conclude immediately that a low information security budget execution rate means weak security capabilities. That is because unspent budgets can be affected by changes in project schedules or adjustments to investment plans, and actual security levels should be assessed through various factors such as detection and blocking capabilities and vulnerability management.

A financial sector official said, “A future task will be whether information security investment goes beyond simply securing budgets and can lead to meaningful vulnerability improvements and stronger capabilities to respond to security incidents.”