Moves by a wide range of companies across various fields toward AI-based security are accelerating. Global companies have already put AI at the forefront, and South Korean firms have recently also stepped up “security plus AI” strategies.

XGate, which specialises in network security such as virtual private networks (VPNs) and firewalls, is also among South Korean security companies strengthening AI.

In a recent interview with reporters, XGate Executive Director Kim Han-yong (김한용) stressed that the key is to strengthen competitiveness in areas the company has done well, rather than using AI to target areas it has not tackled before.

According to him, XGate’s AI strategy can be summed up as applying AI to network security to enhance customer experience, and using AI to improve firewall hardware efficiency.

XGate is first applying AI to high-performance firewalls to help customers analyse log data and more easily create policies based on it. It is focusing on adding functions to existing products rather than offering them as separate products.

Kim said, “We are applying AI in areas where it can collect event data and analyse log information by combining AI with logs and SIEM (Security Information and Event Management) and turn it into policy.” He added, “It is important to apply AI to what we do well. AI can also be used to determine whether traffic entering corporate networks is abnormal.”

He said the latest firewalls also recognise applications, and AI can be applied to filter out items that are not in filters when massive traffic flows in.

Kim said AI will lower barriers to using security solutions from a user perspective and provide an opportunity for various functions to be combined.

He said, “Even in firewalls, we provide SIEM and SOAR (Security Orchestration, Automation and Response) on a cloud basis, and the trend of multiple functions being combined in security will become more pronounced.” He added, “SIEM and SOAR will continue to be provided separately, but the flow of providing these functions in firewalls is accelerating.”

Kim also stressed that AI can improve firewall hardware efficiency.

Kim said, “Firewalls distinguish applications from traffic coming in with SNI (Server Name Indication) values, and CPU load can increase in the analysis process.” He added, “If we automatically collect SNI through AI and filter efficiently, we can reduce CPU load.”

XGate is also making zero trust security an important keyword alongside AI. Zero trust, which approaches security on the premise that breaches have already occurred, may appear to have little in common with perimeter security products such as firewalls that are based on the assumption that what is inside a fortress wall is safe, but Kim said there is ample room to support zero trust in firewalls and VPNs as well.

Kim said, “In the past, firewalls understood traffic only by IP, but now they can distinguish even applications. Recently, they also support account management functions that let you see where internal users are accessing.” He added, “As times change, there are security functions that are required, and it is important for firewalls and VPNs to support this.”

He added, “There were forecasts that VPNs would collapse in a zero trust environment, but in the field VPNs are evolving to fit zero trust. VPNs as they were in the past will disappear, but VPNs that have adapted to zero trust will continue to survive.”