Security Staff Account for a Share in the 9% Range of of Securities Firms’ IT Workforce... Will Response Capabilities Increase Ahead of Mandatory Disclosure?

[Financial News] A series of hacking incidents in the financial sector has drawn attention to securities firms’ information security investments and specialist staffing. Security headcounts at large securities firms have increased, but their share of total information technology (IT) staff remains in the 9% range.
However, as AI-driven hacking becomes more sophisticated and mandatory information security disclosures for the financial sector are set to begin next year, some expect firms to step up efforts to strengthen their ability to detect and respond to real attacks, alongside disclosing their investment levels. 
According to financial investment industry sources on the 13th, information security staff at the 10 securities firms with the largest equity capital totaled 131 in the first half of this year, accounting for 9.78% of their 1,340 IT employees. That was 32 more than the 99 recorded in 2021, but the IT workforce also grew over the same period, from 1,059 to 1,340, so the security staff share rose by just 0.43 percentage points, from 9.35% to 9.78%.
Ten securities firms participated in this year’s information security disclosures by the Korea Internet & Security Agency (KISA). Korea Investment & Securities Co., Ltd., Shinhan Investment & Securities, NH Investment & Securities, KB Securities, Hana Securities and Toss Securities were among those that disclosed investment amounts, dedicated staff, certifications and security activities. 
Information security investments amounted to about 18.8 billion won at Korea Investment & Securities Co., Ltd., 17.1 billion won at Shinhan Investment & Securities, 12.4 billion won at NH Investment & Securities and 12.2 billion won at KB Securities. These figures represented 10.6%, 11.2%, 8.2% and 7.7% of their total IT investments, respectively.
Until now, financial companies have been excluded from mandatory information security disclosures and have participated voluntarily. An amendment to the relevant enforcement decree passed the State Council last month, paving the way for mandatory disclosures to be expanded from next year to include financial companies and electronic financial service providers, among others.
When disclosure requirements expand from 2027, the range of information available on each financial company’s information security status is also expected to widen. 
Among them, Toss Securities has been the first securities firm to voluntarily disclose its information security status, doing so since 2021. Disclosures published this year show that it had 22 dedicated information security staff based on last year’s figures, about 4.9% of its 451 employees. 
For security operations, it runs a red team made up of white-hat hackers and a blue team responsible for defense. The approach involves identifying threats missed during simulated attacks and refining detection rules and blocking systems. 
It also pursues external certifications. In 2023, Toss Securities became the first securities firm in South Korea to obtain certification for PCI-DSS v4.0, the global payment and settlement data security standard, and renewed the certification in January this year.
[email protected] Joo Won-gyu Reporter