A 30-Year Journey of Innovation Starting from the Floppy Disk
On March 14th, AhnLab held a ceremony to mark its 30th anniversary. At this event, they reflected on AhnLab's 30-year journey, revisiting the birth and development of various security solutions that contributed to its growth as a leading company in the Korean security industry. Since June 1988, AhnLab, which started with the V3 anti-malware on a single floppy disk, has continuously developed security solutions covering all areas, from PC and mobile endpoints to networks, cloud, and Cyber-Physical System (CPS), in response to the flow of security threats. In this report, we will explore the evolution of AhnLab's key products and services.
1. 1988-2003: The First Step in Korean Cybersecurity - Birth of V3 and Mobile Security Solution
In 1988, the world's first virus, "Brain", began to spread in Korea as well. There was no way to treat it at the time, and the damage from infections was steadily increasing.
Dr. Cheol-soo Ahn, who was studying at Seoul National University Medical School, learned about the Brain virus through a foreign magazine and checked his own diskettes. After discovering that three of them were infected, he spent sleepless nights analyzing the virus and eventually developed an anti-malware program to combat it in June 1988.
Subsequently, the anti-malware continued to be improved and was named "V3," meaning it was developed up to the third version. Dr. Cheol-soo Ahn distributed the anti-malware he developed for free to users nationwide, marking the creation of Korea's first anti-malware. Originally developed to protect personal PCs, V3 expanded to include companies and institutions, establishing itself as Korea's leading security solution.
Figure 1. Diskettes infected with the Brain virus and treated with an anti-malware
As it entered the 2000s, V3 advanced more rapidly towards innovation. During this time, the growing popularity of mobile phones gave rise to new security threats targeting the mobile landscape. In response, AhnLab released "V3 Mobile for Palm" for PDAs in 2001, embarking on the development of mobile security solutions. Subsequently, in 2003, AhnLab introduced "V3 Mobile for WI-TOP," the world's first mobile phone anti-malware, pioneering the mobile security market.
2. 2007-2009: The Beginning of Innovation in Network Security - Emergence of TrusGuard and TrusGuard DPX
In the early 2000s, as high-speed Internet became more widespread, companies and individuals started relying more on network-based environments. With the rise of Internet banking, e-commerce, and online gaming, security threats also increased rapidly.
In 2005, as the importance of network security expanded in Korea, solutions like Intrusion Prevention System (IPS), firewalls, and Unified Threat Management (UTM) began to gain attention. To lead these changes in the security environment, AhnLab launched the next-generation UTM solution "AhnLab TrusGuard" in 2007, which unified firewalls and various security features.
Figure 2. AhnLab TrusGuard UTM 1000
If the existing V3 played the role of preemptively blocking malware, AhnLab TrusGuard prevented the spread of worms and bots entering through network traffic and integrated with V3 to support Internet access control based on the security status of PCs, even without a Network Access Control (NAC) solution. Additionally, it provided harmful traffic blocking and automatic remediation features for PCs infected with malware. AhnLab TrusGuard goes beyond the basic functions of firewall/VPN solutions by combining with security threat detection and blocking capabilities, establishing itself as a powerful unified solution.
From 2014 to 2018, AhnLab TrusGuard achieved the feat of being listed in the Gartner Magic Quadrant for Enterprise Network Firewalls for five consecutive years.
On July 7, 2009, a massive DDoS attack struck South Korea, causing major damage to key national institutions such as the Blue House, the National Assembly, and the Ministry of National Defense, as well as media outlets and portal sites. In response to the continued DDoS attacks that followed, AhnLab launched its dedicated DDoS defense solution, "AhnLab TrusGuard DPX," in 2010.
Figure 3. (Left) AhnLab TrusGuard DPX 2000 (Right) AhnLab TrusGuard DPX 6000
AhnLab TrusGuard DPX offers mobile monitoring capabilities, allowing security administrators to check defense status in real time using mobile devices such as smartphones or tablet PCs. In particular, by leveraging cloud-based technology, it linked DDoS attack information detected on PCs and provided features to remove malware that triggers the attacks, enabling the collection and analysis of new DDoS attack data to support proactive prevention. Rather than simply providing equipment, it introduced the concept of a security service that includes operation and response. This offered continuous protection against DDoS attacks.
AhnLab TrusGuard DPX has continued to evolve since then and is currently being marketed under the name "AhnLab DPX."
3. 2018: The Evolution of Network and Endpoint Security - AhnLab TMS and AhnLab EDR
After AhnLab TrusGuard and AhnLab TrusGuard DPX set key milestones in network security, AhnLab ushered in another wave of change in 2018 with the launch of two core solutions aimed at strengthening both network and endpoint security. AhnLab TMS and AhnLab EDR presented an innovative approach to threat response, going beyond traditional security models for more sophisticated and systematic threat management.
AhnLab TMS is a threat management platform with a unified network that provides effective solutions for the expansion of IT environments and complex security issues. While existing unified management solutions are limited to viewing information by product or detection type with only basic analysis and statistics features, AhnLab TMS goes further by integrating firewall, IPS, DDoS defense, and APT protection into a single interface, allowing unified access to logs and events across all products. This enables the collected events to be brought together for unified analysis and monitoring, allowing for more sophisticated threat responses.
Figure 4. AhnLab TMS
AhnLab EDR is a solution that detects and responds to endpoint threats using AhnLab’s proprietary behavior-based analysis engine. It monitors all activities across various devices, including PCs, minimizing the dwell time of unknown threats and focusing on preventing potential damage and recurrence. In particular, it integrates with AhnLab V3, AhnLab MDS (sandbox solution), and AhnLab EPP (endpoint protection platform) to maximize threat response capabilities and support endpoint operations optimized for company environments.
Furthermore, when combined with AhnLab's recently launched threat detection and response service, AhnLab MDR, it delivers in-depth analysis and real-time response to threats detected in the client's endpoint environment. Logs collected through EDR are sent to the MDR monitoring center, where experts conduct malware behavior analysis and generate detailed reports. This enables clients to swiftly identify and respond to threats.
Figure 5. AhnLab EDR dashboard
With these powerful features, AhnLab EDR provides clients with more optimized security management and threat response capabilities. It continues to play a crucial role in strengthening today's company security environments.
4. 2020: Evolution Towards Cloud Security - AhnLab CPP
As the pandemic era began in 2020, companies rapidly shifted their infrastructure and applications to the cloud in pursuit of digitalization. As a result, ensuring the secure availability of cloud services and business continuity emerged as a major challenge in the security field, prompting many companies to rethink their cloud security strategies. To address this, AhnLab launched Korea's first cloud workload security platform, "AhnLab Cloud Protection Platform (CPP)," on June 5, 2020.
AhnLab CPP is a unified security platform equipped with anti-malware, host IPS, application control, and container security features, offering a comprehensive range of capabilities needed to build a secure cloud environment. It meets workload security requirements through a single management console and safeguards server workloads from sophisticated threats. AhnLab CPP covers hybrid environments that span from on-premises to the cloud and enables seamless threat management and response.
Since its initial launch, AhnLab CPP has been continuously enhanced to improve availability through performance upgrades. It continues to strengthen cloud security in response to the evolving demands of server operations.
5. 2020-2023: Security Expanding to OT Environments - AhnLab CPS PLUS
As the boundaries of cybersecurity continue to blur, security threats are no longer confined to IT environments—they now extend deeply into Operational Technology (OT) environments across industries like manufacturing, energy, and transportation. Traditional IT security approaches alone are no longer sufficient as a comprehensive strategy that encompasses the OT domain, the intersection of IT and OT, endpoints, networks, and ICS security frameworks has become essential. In response, AhnLab is operating a unified CPS security platform called "AhnLab CPS PLUS" that covers both IT and OT.
Figure 6. AhnLab CPS PLUS structure
AhnLab CPS PLUS is structured to allow various IT and OT security solutions to operate seamlessly based on the Purdue Model. Its core modules include AhnLab EPS, an OT endpoint protection solution, and AhnLab XTD, a solution for OT network visibility and threat detection.
First introduced in 2014, AhnLab EPS ensures system stability by blocking unauthorized programs, removable media, and network access based on an allowlist approach. As a lightweight agent designed to guarantee equipment availability, it minimizes system resource consumption and offers a three-stage lock mode to optimize security operations in OT environments. Over the past decade, AhnLab EPS has continuously evolved, culminating in the release of version 3.0 in March 2024, which is now available to clients.
Following this, AhnLab XTD, which was released in 2022, provides network-based OT visibility. It detects not only threats entering through IT networks but also malware and vulnerability exploits that spread within OT networks. By leveraging proprietary protocol profiling and Deep Packet Inspection (DPI) technology, AhnLab XTD delivers detailed analysis of various devices and traffic in OT environments, offering a high level of visibility.
AhnLab XTD can be integrated with AhnLab EPS to extend visibility not only to the network area but also to endpoints, such as the operating system patch versions of servers and workstations connected to the OT network.
6. 2023: The Evolution of Threat Detection and Response - AhnLab XDR
Although security events are growing exponentially, there is a shortage of personnel to detect and respond to them. To overcome these operational limitations, AhnLab launched Korea's first extended detection and response platform, AhnLab eXtended Detection and Response (XDR), on October 5, 2023.
Figure 7. AhnLab XDR dashboard
AhnLab XDR collects and analyzes data from various domains—such as endpoints, networks, and the cloud—to identify risks. It aims not just to detect and respond to threats, but to assess risk levels and set response priorities to elevate the organization's overall security level. By applying AI and machine learning (ML) technologies, it enhances both the efficiency and accuracy of security operations, optimizing the user's security workflow.
AhnLab XDR performs contextual analysis by correlating diverse events and data, then quantifies the results into a "Risk Score," allowing security teams to intuitively grasp the severity of potential threats. Based on this analysis, it can generate alerts for detected threats or automatically initiate actions through consolidation with other security solutions, enabling a streamlined and systematic response process. Additionally, it is offered as a cloud-based Software-as-a-Service (SaaS), allowing for a secure environment that considers scalability and stability.
2024: A True Milestone in Integrated Security – AhnLab PLUS
In 2024, AhnLab expanded its 30-year vision of security innovation from a product-focused to a platform-centered vision. As a result, the company introduced the unified security platform AhnLab PLUS, covering six core domains: endpoint, network, cloud, security operations (connect), services, and CPS.
Figure 8. AhnLab PLUS platform
AhnLab PLUS aims to address hundreds of security challenges and tens of thousands of threats through a single platform. By leveraging flexible integration and automation technologies, it minimizes friction between people and technology, as well as between different technologies—moving beyond product-level unification to achieve platform-level unification and overcome the limits of point solutions. Furthermore, by applying the latest threat intelligence across all platforms, AhnLab PLUS enhances detection, blocking, response, and risk management capabilities across the board.
From 2025 onwards: Challenges towards the Future – Evolution of AI-Centered Security Technology
AhnLab has continuously achieved innovation by keeping pace with technological advancements and changes in the security market over the years. Starting with V3, the company has expanded its security coverage from endpoint security covering personal PCs to mobile devices, to include network, cloud, and CPS domains, and has continuously researched and developed optimal solutions to effectively protect each area. Going forward, AhnLab will continue to respond to security threats effectively and meet diverse customer needs by leveraging cutting-edge technologies such as artificial intelligence (AI), cloud security, and zero trust. In particular, the application of agentic AI to security will enable autonomous security systems that provide even stronger protection in the digital environment.
Through its commitment to technological innovation, AhnLab has become a key player in the development of the security industry over the past 30 years, and is now prepared to proactively confront future security threats. AhnLab will continue to provide clients with a safe and reliable digital environment through continuous innovation. Additionally, AhnLab aims to strengthen its reputation and trust in the security market and rise to become a world-class cybersecurity company in the global market.
More details about AhnLab’s 30-year journey can be found on the AhnLab 30th Anniversary website.
▶ Go to AhnLab 30th Anniversary Website
