Despite Rising Security Concerns After Mythos, Korea’s Cybersecurity Industry Struggles

Despite a growing need for cybersecurity in the wake of a series of hacking incidents and the Mythos incident, the domestic security industry—where small and medium-sized enterprises are concentrated—is facing structural challenges such as securing talent and limited profitability.

According to an analysis of the top 10 listed cybersecurity companies on the Korean stock market as of May 19, only three companies recorded annual sales above 100 billion won last year. Out of roughly 800 domestic cybersecurity firms, only AhnLab (267.7 billion won), Secui (158.7 billion won), and Igloo Corporation (143.2 billion won) exceeded the 100 billion won sales mark. The rest were below this threshold.

The domestic cybersecurity market is largely comprised of small and medium-sized enterprises. According to the “2025 Information Security Industry Survey” by the Korea Information Security Industry Association (KISIA), more than 90% of the 876 information security companies are classified as medium-sized (378 companies) or small-sized (416 companies) businesses. Additionally, 91% (797 companies) are unlisted and therefore face limitations in raising capital through the financial markets. This stands in stark contrast to major U.S. cybersecurity companies such as Palo Alto Networks, with a market capitalization exceeding 200 trillion won, and Fortinet, with over 100 trillion won.

As cyber threats driven by artificial intelligence (AI) continue to emerge, the need to develop security technologies is increasing. However, there is a shortage of talent dedicated to such technological development. The average tenure of employees at major cybersecurity companies ranges from a maximum of 7.98 years to a minimum of 2.47 years. Compared to system integration (SI) companies that are popular destinations for job-switching security industry professionals—such as Samsung SDS (17.2 years) and LG CNS (12.89 years)—turnover is frequent in the cybersecurity sector. The average annual salary at the top 10 cybersecurity companies is only 62.18 million won. By comparison, the average annual salaries at Samsung SDS and LG CNS are 2.22 times and 1.87 times higher, respectively, than the average at the top 10 cybersecurity firms. An industry insider explained, “Cybersecurity companies, due to their small size, suffer significant talent outflow. Employees tend to move to SI companies or the gaming industry, where salaries are relatively higher.”

The industry believes that the limited security investment by Korean companies—typically made only after incidents occur—has led to sluggish growth for security firms dependent on the domestic market. An information security company representative stated, “As server costs have risen this year, we are seeing existing clients reduce their orders for security solutions. When costs go up, it becomes more difficult to secure contracts.” Another industry official commented, “Although repeated hacking incidents have led companies to recognize the need for security investment, most are not making proactive investments. The small size of security firms is itself evidence that companies’ security investments remain limited.”

Hyeongryeol Yeom, professor of information security at Soonchunhyang University, remarked, “If skilled personnel with expertise and know-how in developing information security products and services leave, it will impact the technological competitiveness of security companies. There is a need to strengthen the domestic cybersecurity talent pipeline.” He added, “The absence of large, specialized information security companies in Korea is problematic. We need to acquire new technologies, enhance our technical capabilities to compete with global cybersecurity firms, and collaborate across companies to develop a suite of information security products that can target the global market.”

This content was produced with the assistance of AI translation services.