CEO Kim Ki-hong: “SANDS Lab will expand cross-industry cooperation with its CTI technology and diversify revenue”

CEO Kim Ki-hong: “SANDS Lab will expand cross-industry cooperation with its CTI technology and diversify revenue”

“Expanding revenue by offering CTX and MNX to customers in more diverse forms”

“Strengthening cooperation across industries to expand the security business”

SANDS Lab CEO Kim Ki-hong

SANDS Lab (CEO Kim Ki-hong) began as a Yonsei University student venture in 2003, incorporated in 2004 and adopted its current name. It entered the global market through an agreement with Google’s VirusTotal in 2013, then grew rapidly by launching malwares.com in 2014 and attracting investment from PIOLINK in 2015.

The company has achieved distinctive results in malware analysis and detection. In 2020, it successfully developed the world’s first homomorphic encryption-based malware detection technology. Its 2023 KOSDAQ listing under the special technology listing scheme also helped create a favorable environment for subsequent listings by security technology companies.

It offers diverse solutions centered on the CTX CTI platform, including APIs, datasets, feeds and intelligence. Machine learning-based malware detection and profiling can automatically identify attacker groups.

SANDS Lab invests heavily in R&D talent, with developers making up 84% of its workforce. It has filed 95 patents, of which 48 are registered. These efforts led to New Excellent Technology (NET) certifications in both 2021 and 2022.

The company tracks active cyberattack groups worldwide in real time and provides customers with analysis of attack methods and server information. Its extensive big data capabilities include collecting more than 2.27 million files daily and analyzing more than 2.5 billion pieces of threat intelligence. These data support AI-based threat analysis and a platform for delivering hyper-intelligence.

A view of part of SANDS Lab’s office

■ Interview with CEO Kim Ki-hong

Daily Secu recently met Kim at KSIGN’s Gwacheon office to discuss this year’s achievements and future business direction. The interview follows.

“Publishing datasets and AI models to accelerate security technology development”

Reporter: Let us begin with the first half of 2024. I understand SANDS Lab successfully completed KISA’s cybersecurity AI dataset project. Could you explain its significance and how it progressed?

Kim: Yes, we successfully completed the project in the first half of this year. It collected and analyzed malware and threat intelligence data to build advanced datasets for training AI models. We maintained high quality so that the data could support security technology development and practical security operations. This was an important national project to strengthen cybersecurity response capabilities, and it was highly meaningful for SANDS Lab.

Reporter: Could you describe its practical impact more specifically?

Kim: The collected data greatly helped AI-based security development. Systematically collecting and analyzing malware and the latest threat data enabled security solutions to detect and respond faster and more accurately. For example, it strengthened the ability to quickly identify and counter ransomware and new malware. Making these datasets freely available should also significantly help smaller companies and research institutions develop security technologies.

Starting this year, we are also building AI datasets in earnest and developing automation systems using LLM technology. We will conduct validation alongside dataset construction to assess practical use in security operations. Our goal is to finish within the year and publish the datasets and AI models to stimulate security technology development.

CTX architecture

“Developing next-generation AI cybersecurity technology with global companies”

Reporter: Were there other major achievements in the first half?

Kim: Yes. We successfully hosted the SANDS Lab on Azure seminar with Microsoft Korea, presenting a new direction for cloud security through generative AI and CTI. Signing an agreement with Microsoft Korea and beginning joint development of next-generation AI-based cybersecurity technology was another major achievement.

We also showcased our capabilities globally at RSAC 2024, the world’s largest cybersecurity event, attracting considerable interest and positive feedback. In addition, both our MNX NDR solution and CTX intelligence platform earned Grade 1 GS certification.

“Growing globally through technology partnerships with major companies”

Reporter: What did you experience at RSAC 2024, and what are your plans going forward?

Kim: RSAC 2024 was a tremendous opportunity. Meeting security experts from around the world and demonstrating our technology taught us a great deal. Follow-up discussions with global big tech companies are particularly active. Rather than overextending ourselves by entering global markets alone, we plan to cooperate with global companies. Our Microsoft partnership is part of that approach. Instead of selling individual products, we will gradually secure and provide distinctive technologies that global companies need.

Reporter: What strategies will you use to strengthen global competitiveness?

Kim: We are considering several strategies. First, strengthening cooperation with big tech to secure a technological advantage. Second, developing proprietary AI technology to differentiate ourselves. Third, increasing trust by complying with global standards and obtaining diverse certifications. Through these strategies, we intend to grow by partnering technologically with major global companies.

“Strengthening cooperation across industries to expand the security business”

Reporter: This year, SANDS Lab, 42Maru and LG Uplus announced joint LLM development. What does that involve?

Kim: We agreed to jointly develop LLM technology to strengthen cybersecurity. The three companies plan to build and distribute LLMs specialized in four areas: security monitoring, threat intelligence, anomaly analysis and vulnerability identification. Once commercialized, companies will be able to use LLMs internally to reduce the risk of information leakage.

LG Uplus will handle LLM development and safeguards for customer information. 42Maru will develop cybersecurity and crime-prevention-specific LLM modeling and retrieval-augmented generation (RAG), while SANDS Lab will provide datasets for use within corporate infrastructure. We will apply generative AI to security services and solutions to rapidly advance our AI cybersecurity business. 42Maru’s domain-specific LLM42 will support enterprise private mode and cost savings. LG Uplus plans to introduce its ixi-GEN LLM and AI Agent this year to strengthen digital innovation capabilities.

“Expanding revenue by offering CTX and MNX to customers in more diverse forms”

Reporter: Could you outline your plans for the second half?

Kim: We will use various strategies to make our products and technologies more accessible. For example, we will offer CTX and MNX in more diverse forms and lower price barriers. We will also accelerate new AI-based security solutions, using generative AI to create security environments that customers can use more conveniently.

Reporter: Please briefly introduce your main products, CTX and MNX.

MDX architecture

Kim: MDX (Malware Detection X) is one of our flagship solutions. It is an AI-based zero-day detection solution that identifies APT attacks in electronic documents and other non-executable files, designed to integrate with internal business systems. It achieves an average document-malware detection rate of 99.4% and provides lossless network traffic capture based on DPDK, helping customers work more securely.

Another core solution, CTX (Cyber Threat eXchange), is a CTI platform that identifies attack groups and techniques and counters diverse threats through machine learning-based malware detection and profiling. It collects and analyzes over 2.27 million files and 2.5 billion pieces of threat intelligence daily, allowing customers to track attack groups in real time, identify their methods and respond rapidly.

Reporter: What is SANDS Lab’s business direction and goal?

Kim: Our vision is to counter cyber threats worldwide with innovative AI security technology and create a safer digital environment. We continually develop new technology and strengthen global competitiveness. In the long term, we aim to create greater synergies by combining security with other industries. We will expand our business through continued partnerships beyond traditional security, including smart cities, telecom operators and manufacturers involved in autonomous vehicles.

“Strengthening cooperation with Korean security companies and supporting startup growth”

Reporter: What are your thoughts on cooperation with Korean security companies and building a startup ecosystem?

Kim: We are strengthening integration efforts with other Korean security companies, sharing complementary technologies and information and working toward common goals. I believe these efforts will strengthen the cybersecurity ecosystem and help deliver more effective solutions to customers and global markets.

We also want to develop startup growth support programs that provide young entrepreneurs with the resources and assistance they need, helping more startups grow and turn innovative ideas into reality.

Finally, I hope Korea’s larger security companies will take an open-minded approach to partnerships with smaller companies. Entering the U.S. or European market alone is difficult for Korean businesses. It would be valuable if major firms opened a path to overseas markets together with technologically capable small businesses and startups. (End of interview)

Kim aims to develop SANDS Lab into a global CTI specialist through continued technology development and market expansion. The company plans to use AI and big data for more accurate and rapid threat detection and provide customers with the best security solutions. He also expressed his ambition to strengthen the cybersecurity ecosystem through diverse partnerships and integration, contributing to a safer digital world.