SANDS Lab turns 20: “AI-powered Korean threat intelligence has a clear competitive edge overseas”

SANDS Lab turns 20: “AI-powered Korean threat intelligence has a clear competitive edge overseas”

SANDS Lab CEO Kim Ki-hong [© SANDS Lab]

“One breach, and it is all over.”

With cyber threats continuing unabated this year, this phrase is becoming an accepted rule among major institutions and companies worldwide. Just as investigators identify the person responsible for a crime, determining “who” the attacker is in cyberspace has emerged as a fundamental way to strengthen defenses.

Major security markets such as the United States are therefore positioning cyber threat intelligence (CTI) solutions as tools to strengthen their defenses. Interest is also growing in adding AI to reduce manual work for security teams, reinforcing the view that CTI technology is reaching maturity.

Korean intelligence providers must also seek opportunities. SANDS Lab, celebrating 20 years since its incorporation in 2004, is no exception. It has equipped its intelligence solutions with AI trained on high-quality datasets and is ready to pursue domestic and overseas markets.

◆ A stronger SANDS Lab brings AI for Security to markets at home and abroad

​

In a recent interview with Digital Daily, CEO Kim Ki-hong said, “If SANDS Lab in the past was full of passion, dreams and ambition, the company at 20 has been refined and strengthened. We have reached a stage where maintaining the strength of our technological capabilities is important.”

SANDS Lab has grown by providing core products centered on its CTX (Cyber Threat Intelligence Service) platform and MNX network detection and response solution. It is focused on competing overseas as well as at home. In May, it participated in RSAC 2024 in the United States, one of the world’s largest cybersecurity conferences, to promote CTX.

Kim said, “The global intelligence market is clearly growing. In Korea, however, investments tend to go first to security products and technologies tied to legal requirements, so intelligence often falls down the priority list.” His point was that domestic interest in intelligence products remains lower than overseas.

This also explains why Korean intelligence providers seek competitive opportunities abroad. Kim sees clear factors that can strengthen their international competitiveness, particularly when AI is added. “People usually associate the word intelligence with being intelligent,” he said. “That means threat intelligence can be one of the industries that implements security through AI.”

CTX uses an AI engine to analyze files and support searches for specific hashes (MDS, SHA1 and SHA256). It provides information not only on maliciousness but also on attack groups, target industries and MITRE ATT&CK techniques, making it a specialized tool for identifying cyber attackers.

Kim expressed confidence in its differentiation from other Korean companies. “Our defining capabilities are creating intelligence centered on malware and possessing foundational technology that analyzes malware to produce insights,” he said.

“Each company has its own specialty, whether dark web information, OSINT or outstanding in-house analysts,” he added. “We know how to analyze a malware sample and rapidly trace who launched the attack and who created it.” He cited profiling technologies such as DBP for executable files and DDP for non-executable files as strengths that reinforce defenses. Another distinguishing feature is defining threat profiling context as datasets.

Kim emphasized, “Our strength is that AI produces the analysis results, with high detection rates. SANDS Lab is implementing AI for Security—using AI technology to maximize cybersecurity.”

SANDS Lab CEO Kim Ki-hong [© SANDS Lab]

◆ Finding common ground with Microsoft after lengthy discussions

Cooperation with Microsoft is one of SANDS Lab’s most significant achievements this year.

In March, the companies signed an agreement to strengthen next-generation security technology, pledging cooperation on AI and cybersecurity R&D using Microsoft infrastructure. In June, they held the SANDS Lab on Azure seminar, where the integration of CTX and Azure cloud infrastructure attracted attention. Kim said, “This has been a very long-running deal. Starting at last year’s RSA, we approached them and suggested working together.”

He emphasized that aligned interests in intelligence were key to making the partnership happen. “An intelligence business cannot succeed alone,” he explained. “It needs connections to SIEM and SOAR platforms, or integration with existing platforms so everything works together.”

“Microsoft has Sentinel, and the platform’s philosophy aligned with ours,” Kim said. “When operating Sentinel, some threats may not be identified. Leaving them alone could cause damage, so cross-checking and system-level integration that allows one system to query another have become important.” He likened it to seeking multiple medical opinions to identify an illness.

With the partnership only recently formalized, its results remain to be seen. Kim said, “The market is currently trying the integration and using it. After extensive validation, we are now showing it to customers.”

SANDS Lab on Azure event [© SANDS Lab]

◆ A maturing SANDS Lab aims to become a “first penguin” in intelligence

What is next for SANDS Lab at 20? Kim replied, “As I said at our IPO, I want us to be a first penguin.” The term refers to a pioneer that enters or leads a market before others.

“Our data, people and intelligence technology helped us complete an IPO and secure stable operating funds,” Kim said. “We want to show that the challenges we took on first were meaningful.” He cited the recent introduction of a security-specific LLM and implementation of AI security automation as examples of that pioneering spirit.

The company is also accelerating its overseas strategy, with patents expected to play a central role. Kim said, “Our strategy is to use patents, which are easy to overlook. Others may think having the technology is enough, but a time comes when ownership rights are contested.”

SANDS Lab is among the Korean security companies most committed to patent registration. Kim said, “We file 30–40 or more each year and have accumulated approximately 110. It takes substantial time and money, but even if the benefits are not immediate, we expect them to become a valuable asset in a few years.”

The company is also contributing to a stronger AI ecosystem. It recently won KISA’s KRW 4.5 billion cybersecurity AI dataset construction and utilization enhancement project, as well as a core information security technology development project led by the Ministry of Science and ICT and IITP. Joint development participants include LG Uplus, KAIST, 42Maru and Logpresso.

Kim concluded, “I want people to know that security work can become easier if AI is used well. Security staff worry that a wrong decision could lead to a major hacking incident, so I want to create a model that acts as their companion.”