South Korea’s government project to develop a cybersecurity-specialised AI foundation model has narrowed to a two-way contest between Naver Cloud and SK Telecom. Naver Cloud appears to be placing emphasis on developing a foundation model to be used across national cyber security, while SKT appears to be focusing on proving an AI agent for corporate security sites.

The Ministry of Science and ICT said on Wednesday that two consortia, led by Naver Cloud and SKT, each submitted proposals for the project by the deadline the previous day. The Naver Cloud consortium includes 32 companies and institutions, while the SKT consortium includes 13.

Naver Cloud presented “embedding national cyber security capabilities” as the goal of the project. The consortium also includes broad participation from security companies that cover multiple stages of cyber attacks and demand-side institutions in finance, defence and energy.

AI SPERA has strengths in analysing attack surfaces and threat intelligence such as externally exposed IP addresses and domains. Theori is strong in offensive security that finds system vulnerabilities from an attacker’s perspective. SANDS Lab and S2W focus on cyber threat intelligence (CTI) such as malware and attack groups, while Logpresso mainly handles internal corporate security logs and events.

Sparrow, Tatum and PnP Secure also operate businesses in application, cloud and database (DB) security, respectively. Given the participant lineup, it appears security data generated across multiple stages, from external attack surfaces and vulnerabilities to malware and attacker information and internal corporate security logs, could be used for model development.

Demand-side institutions including the Financial Security Institute, Korea Aerospace Industries (KAI), Korea Hydro & Nuclear Power and KEPCO KDN also joined. With sectors that have high security requirements, such as finance, defence and energy, taking part directly, the model is also expected to be used for validation and proof-of-concept work reflecting real industrial environments.

On the AI model and infrastructure side, participants include LG CNS, LG AI Research and LG Uplus, as well as Bdraft, Trillion Labs and HyperExcel. With a composition that broadly includes security companies, demand-side institutions and AI companies, the effort places relatively more weight on building a foundation model that can be used across national cyber security rather than for a specific security task.

A Naver Cloud official said the company applied for the project by forming a consortium with LG CNS and others. The official said it is difficult at this stage to disclose the consortium’s detailed composition and roles.

The SKT camp has focused on connecting the cybersecurity AI foundation model to actual corporate security work. It presented a goal of proving an “agentic security service” based on South Korea’s cyber threat environment.

The consortium includes concentrated participation from companies in security monitoring, endpoint and network security. SK Shieldus and Igloo Corporation focus on security monitoring, AhnLab on malware and endpoint security, and Genians on network access control (NAC) and endpoint detection and response (EDR). Secui and Piolink are also strong in network security.

Given the participant lineup, SKT appears to be placing greater weight on improving on-site usability by linking the project to existing security monitoring systems rather than on the general-purpose nature of the model itself.

Participation by AIM Intelligence also stands out. Unlike other participants, which have strengths in responding to cyber threats across systems and networks, it specialises in AI red teaming that verifies vulnerabilities and safety of generative AI itself from an attacker’s perspective. It may also use its capabilities to verify vulnerabilities and safety of the model itself.

SKT and Upstage are participating in model development. The structure combines the two companies’ foundation model development capabilities with security monitoring, endpoint and network security capabilities that security companies have accumulated in the field.

An SKT official said the company decided to participate in the project by forming a consortium as the lead firm.

The ministry plans to select one final consortium in early September after reviewing the suitability of submitted documents and conducting presentation evaluations by external experts. The selected consortium will receive support for 256 Nvidia B200 graphics processing units (GPUs) for 10 months.