Companies are strengthening their security strategies by applying security technology they develop themselves, but critics say the government's information security disclosure system fails to reflect that shift in the industry. Spending on outside security solutions is counted as information security investment, while technology developed in-house through research and development can make disclosed investment look relatively small. Because disclosure data is also used in deciding whether to reduce fines for personal data breaches, some are calling for the standards to be revised.
Companies with their own security technology are leading calls to improve how information security investment is calculated, according to IT industry sources on the 13th. The current system requires companies to disclose total IT investment, information security investment and the number of dedicated security staff. Actual outlays such as purchases of outside solutions, system construction and maintenance costs and wages are reflected, but when technology is brought in-house, its value is not fully counted as investment.
As a result, IT companies that have strengthened security capabilities by developing their own technology can appear to devote a relatively small share of spending to information security. NAVER disclosed this year that its information security investment last year came to about 66 billion won ($46.3 million), up 19.5% from a year earlier, but the share of total IT investment stayed at 4.5%, unchanged from the previous year. Since disclosure became mandatory in 2022, NAVER has explained through notes and other items that it uses a number of information security systems it developed itself, so disclosed investment can look smaller than its actual security activity.
Smaller security firms and startups that develop and sell their own security solutions face a similar problem. With limited capacity to invest compared with large companies, they use their own solutions for internal security, which can work against them in disclosures. "If you use your own product internally, there is no separate purchase cost, so investment is tallied lower even when the level of security is the same," an official in the security industry said. Some security firms were found to have information security investment shares below the 6.3% average for all companies that file disclosures.
Current disclosure guidelines count only staff working solely on information security as dedicated personnel, excluding those with other duties. IT products and services that include some security functions are also not counted as information security investment unless they can be clearly identified as spending for security purposes.
Industry officials worry the standards could weaken incentives to develop security technology in-house. Even if companies internalize technology through R&D, they say, insufficient recognition in disclosures could leave them rated less favorably than firms that buy outside solutions.
The Ministry of Science and ICT says it applied strict standards to isolate only spending used for information security activity. "The intent is to prevent costs that were not spent solely on information security, such as general system upgrade expenses, from being reflected," a ministry official said. "Since the guidelines are revised every year, we will actively revise them while fully reflecting companies' concerns."