SANDS Lab CEO Kim Ki-hong: “We will lead domestic and global markets with threat intelligence built on high-quality, cost-effective datasets”

“Leading domestic and global markets with threat intelligence built on high-quality, cost-effective datasets”

[Interview] SANDS Lab CEO Kim Ki-hong

Dataset technology is central to advances in AI and machine learning. Accurate, refined datasets determine model performance and enable precise prediction and analysis. As privacy and data security become increasingly important, regulation of dataset management and use is also expected to tighten.

Threat intelligence depends on datasets to analyze vast amounts of cyberattack information, predict threats and develop response strategies. These datasets include malware samples, attack patterns and vulnerability information, which train machine learning algorithms for more sophisticated detection and prediction. Technically, datasets are a core determinant of intelligence accuracy and efficiency. Well-refined data help intelligence systems identify new threats and issue alerts. For example, an AI-based system can learn from historical attacks to detect new patterns in real time.

Dataset quality is also directly linked to intelligence reliability. Intelligence generated from accurate data helps security teams make faster, more precise decisions. The interaction between datasets and threat intelligence therefore improves overall cybersecurity effectiveness.

SANDS Lab has built its technical capabilities on datasets and long led the intelligence field. Its AI security R&D aims to go beyond conventional AI security and create AI that performs the role of a security professional. Its threat intelligence is gaining recognition both at home and abroad. We met CEO Kim Ki-hong, who emphasizes datasets as the foundation of both security and AI, to discuss the technology and global vision behind its ambitious international expansion.

Q. How is global cyber threat intelligence changing?

Cyberattack volumes are growing exponentially, but the key is identifying which attacks are relevant to us. Throughout our years in intelligence, customers have repeatedly told us that well-known reports are available, yet it is unclear how useful they are to their own organizations.

Reports from major vendors such as CrowdStrike and Mandiant are excellent, but practitioners say their immediate priority is solving the problem in front of them. Each organization therefore needs tailored intelligence. We analyze millions of threat records, identify malicious elements and deliver intelligence optimized for each customer’s systems.

Another change is that attackers now use AI to create more sophisticated phishing and malware. Broad DDoS attacks and worm infections once dominated, but precise attacks against specific targets are increasingly common. Defenders must therefore use company-specific curation and AI to build more effective strategies.

We use AI to analyze information about targeted organizations and provide precise intelligence to optimize defenses. For example, we curate intelligence for a specific company so its security team can respond quickly.

Q. What are the biggest challenges companies face?

There are two aspects. First, security spending tends to focus only on legal requirements, leaving insufficient investment for systematic improvements. Security staff struggle to secure budgets.

Second, there is a large gap between the pace of technological progress and investors’ understanding. AI security solutions receive attention, for example, but obtaining the budget to implement them is difficult. Decision-makers need to recognize security’s importance and invest more to maintain business continuity. They should also systematize security and establish processes aimed at comprehensive protection, rather than only minimum requirements.

Q. What makes CTX technically competitive?

CTX goes beyond analyzing individual malware samples to provide the full context of an attack. It identifies the groups associated with a file, their typical techniques and related IP addresses, domains and URLs. For example, analyzing a particular Chinese hacking group’s malware, methods and infrastructure helps companies establish medium- and long-term response systems.

From a business perspective, the ultimate roadmap is for AI, rather than people, to write threat reports. If AI can analyze vast data and its reports are validated, we believe it could perform at least the role of a senior or lead researcher within an organization. AI can provide comprehensive, practical support for security planning, identify internal vulnerabilities and show how accumulated data can be used.

Even the best AI is ineffective if trained on unrefined data. CTX therefore thoroughly refines its datasets before training to deliver Korean intelligence that can compete globally. This maximizes AI efficiency and helps companies build more effective security strategies.

Q. What has CTX achieved so far?

CTX has been available for less than a year, but its customer base continues to grow. Since launch, customers have been able to use the website for small-scale analysis. Intelligence services broadly fall into closed models, where one company retains information, and open models, where feedback helps refine accuracy. CTX follows the open model, and we are confident in it.

The open approach lets us lower prices and enable high-volume use, attracting many users domestically and internationally. Threat intelligence is typically expensive, and organizations with large analysis volumes often cannot afford to integrate all of it. We are seeing more customers facing that challenge.

Customers sometimes worry that openness could expose their information. Uploading to VirusTotal, for example, makes issues public, while CTX only performs analysis and returns results, avoiding that concern. Although the intelligence service is open, the analysis itself is provided privately. This strength is accelerating customer acquisition.

SANDS Lab’s CTX vision

CTX is used most widely by government and public institutions, as well as big tech and startups with forward-looking infrastructure. More conservative industries such as finance want it within their own systems, so we are developing a compact version for internal deployment. CTX is growing rapidly at an average annual rate of 33–55%.

Q. How do you address different national security environments and regulations?

First, we use cloud infrastructure. We considered building our own data center, but distributed processing on Azure allows global use, and placing analysis infrastructure in each region is more practical.

Because analysis takes place in different countries, providing results requires care, and profiling, validation and cross-validation remain challenges. A common voice and direction among intelligence companies would be more effective than SANDS Lab acting alone. It may still be early, but an industry council that establishes a shared direction could further stimulate the entire market.

Responses to security environments and regulation are tied to policy. Careful policymaking is appropriate, but technology advances faster, and that gap makes the industry hope for quicker solutions.

Q. What is your global business strategy?

We are considering multiple approaches. Direct global expansion requires caution because success is not guaranteed. In terms of opportunity cost, strengthening domestic technical capabilities while expanding with partners is a good alternative. Established partners can raise our value and extend the business more effectively than direct sales alone.

Our recent Microsoft collaboration is a good example. Strengthening our technology first enabled the joint seminar, and positive use cases are emerging. These meaningful results can broaden customer services and create opportunities for both Microsoft and SANDS Lab.

SANDS Lab CEO Kim Ki-hong

We want to build a broad, diverse partner ecosystem. Our first strategy is to link with SIEM and SOAR products or industries and sell intelligence as an additional package. A second strategy and future plan is to form a trust-style intelligence consortium to expand the overall market.

For customer support, we provide dedicated APIs. We build them to suit customer circumstances and requirements, eliminating the need for customers to process data or develop intermediate integrations themselves. Our goal is to provide service worth more than customers spend.

Q. What are your future direction and plans?

We will find more strong partners and develop various models that create synergies. We will also work harder to form alliances and communities that energize the market. Through big tech partnerships, we want customers to experience CTX seamlessly protecting them within those companies’ services.

Second, as a company at the center of Korean cybersecurity, we hold abundant high-quality data. We plan to organize it and release concrete AI models. We hope providing strong datasets to companies and institutions at home and abroad will lay the foundation for the next generation of AI.

Our aim is to create an up-to-date, cybersecurity-specific AI model capable of fully performing one person’s role, and optimize it for individual businesses. Such a model should deliver capabilities that genuinely justify its electricity costs—a topic now prominent in AI discussions.

We are not rushing, but steadily building and advancing a technology roadmap that supports security and AI use. We are winning the projects and work needed to do so, and customers can look forward to the results.