A Korean NDR Chosen by Major Banks: SANDS Lab’s MNX Gains Ground in Banking Deployments

A Korean NDR Chosen by Major Banks: SANDS Lab’s MNX Sees Successive Banking Deployments

• Major banks adopt MNX in succession, highlighting the competitiveness of Korean NDR in the financial sector
• Tracking lateral movement after intrusion to reveal attack paths and internal propagation
• Korean NDR performance that competes globally, with strengths in integration, customization, and technical support

Photo 1. SANDS Lab’s NDR solution MNX, being adopted by major banks

SANDS Lab (KOSDAQ: 411080; CEO Kim Ki-hong), an AI security specialist, announced that its AI-based network detection and response (NDR) solution MNX is strengthening its position in the financial security market as major Korean banks move forward with adoption. The company said the technical competitiveness of Korean NDR is gaining attention as financial institutions seek to uncover hidden threats within their networks.

Financial institutions rigorously evaluate both the technical capabilities and operational reliability of security solutions, as they must ensure the stability of networks handling large volumes of transactions while protecting customer information. NDR has traditionally been dominated by global security vendors, but evaluations increasingly consider not only detection performance, but also an understanding of Korea’s financial environment, integration with existing security systems, and technical support capabilities.

Leading Korean and global NDR solutions were evaluated together during this selection process, and MNX was chosen. SANDS Lab views this as evidence that Korean NDR now offers the technical and operational capabilities needed to compete directly with global products in the financial sector.

Changes in cyberattack methods are driving the growing importance of NDR in finance. After gaining initial access, attackers increasingly use legitimate accounts or encrypted communications to move between systems and escalate privileges through lateral movement. Alerts from individual security devices alone make it difficult to understand the complete attack chain. By continuously analyzing communications across the network, NDR traces where an attacker entered, which systems they passed through, and how far they moved. It also analyzes abnormal internal connections and signs of data exfiltration to help assess the scope of an attack and prioritize responses.

Building on this network visibility, SANDS Lab’s MNX goes beyond listing individual events and connects scattered communication traces into a coherent attack flow. It combines traffic, session, asset, and file information and integrates with SANDS Lab’s cyber threat intelligence (CTI) service CTX to detect both known threats and new anomalies. AI analysis using supervised and unsupervised learning identifies relationships among multiple events and supports tracking from the initial point of attack through internal propagation.

Photo 2. Dashboard of SANDS Lab’s NDR solution MNX

A proprietary local large language model (LLM) further summarizes detected threats and provides natural language queries and response recommendations. This supports security teams’ investigations and decisions while enabling on-premises analysis without sending data outside the organization, meeting financial institutions’ data management requirements.

The operational advantages of a domestic solution are another major selection criterion for financial institutions. MNX allows detection policies and features to be customized to each customer’s network and security policies, and integrates with existing SIEM, SOAR, and other security operations systems to support workflows spanning detection, analysis, and response. Its Korean development and technical support teams can respond quickly to customer requirements and operational changes, setting it apart from global general-purpose products.

SANDS Lab is expanding MNX’s use in finance based on deployment experience in large-scale 10 Gbps environments and distributed networks. MNX holds Grade 1 Good Software (GS) certification and a Security Function Verification Certificate, and is supported by specialized technical assistance tailored to each customer’s environment.

Financial institutions that selected MNX cited its ability to meet network forensics search and analysis requirements, its broad detection capabilities, and its range of analytical and response features, including dashboards, statistics, and SOAR integration. In particular, they valued the ability to search and analyze threats using diverse fields, the coordinated integration of its analysis tools, and its usefulness from an analyst’s perspective, rating it as a highly mature NDR product overall.

Shin Seung-cheol, the principal engineer overseeing MNX development at SANDS Lab, said, “This evaluation validates the analyst-centered development approach that has guided MNX from the outset. MNX was designed to go beyond checking individual alerts, allowing security analysts to continuously trace threat context and the entire attack flow using a wide range of data.” He added, “We will continue to expand detection and analysis coverage based on the needs of real-world security operations and further refine MNX to meet the demands of financial environments.”