A New Chapter in AI Security: AhnLab AI PLUS
AhnLab recently launched its AI platform, AhnLab AI PLUS—an in-house AI platform developed by harnessing the vast security expertise AhnLab has accumulated for three decades, including threat analysis data and response experience to malware and breach incidents.
In this report, we will take a comprehensive look into the progress of AI in cybersecurity, AhnLab's ongoing AI innovation, and the value that AhnLab AI PLUS brings to customers.
How Has AI Evolved?
One thing must be mentioned when considering the major turning points in AI development—it is the game of Go. In March 2016, the match between AlphaGo and 9-dan Lee Sedol brought AI into the spotlight, and it has continued to advance for nearly 10 years since then.
Comparing Go and cybersecurity from an AI perspective, both require understanding the opponent's strategy and developing a counter-strategy. However, while Go has clear rules, there are no set rules for offense and defense between attackers and defenders in cybersecurity. In other words, cybersecurity involves much greater uncertainty. In this regard, let us examine how AI was able to defeat humans in Go—a similar yet simpler sector by comparison—before explaining cybersecurity.
AlphaGo's emergence in Go implies a shift from automation to intelligentization. Compared to chess, a Western board game where IBM Deep Blue defeated human intelligence in 1997, AI took around 20 extra years to surpass humans in Go. The delay stemmed from the AI's limitations of pattern-based automation.
With pattern-based automation, Go is played mechanically based on "game records," which comprise fixed patterns. Defining patterns in Go is difficult, as myriad moves are possible during the game, and each stone's meaning and strategic value change according to the context. Preexisting pattern-based AIs for Go could not surpass humans due to this complexity.
In contrast, AlphaGo used deep learning and reinforcement learning to claim its victory from human players by going beyond fixed patterns, independently assessing the situation before making a move, and deploying creative tactics unpredicted by the human mind. This shows the "intelligentization" of AI.
Here, we must pinpoint the difference between automation and intelligentization.
First, automation refers to performing routine and repetitive tasks—a concept that can improve efficiency by repeating tasks based on human-defined rules and processes. However, automated tasks cannot respond to new and irregular situations, and when such circumstances arise, humans change the rules accordingly. On the other hand, intelligentization lets the machine judge the situation on its own to find the optimal workflow and adapt to changes in the environment. This allows flexible responses to unexpected situations.
The history of AI development is essentially the history of intelligentization. Until 2010, the focus was on developing learning capabilities, mainly through machine learning. AlphaGo demonstrated that AI has overtaken humans in games with clear rules, especially in understanding situations and making the right strategies. Later, efforts began to develop technology to apply these decision-making abilities to the real world, riddled with uncertainties.
The first step was understanding language. With the emergence of generative AI, represented by large language models (LLMs), a foundation was created for communicating and interacting with people through means such as language, speech, and images.
The capacity for execution was later added to the process by integrating with external tools, which is called "agentic AI."
Like how AI predicts multiple moves ahead for its response, the technology has begun demonstrating strategy establishment capabilities of using multi-step reasoning (reasoning AI) to anticipate and plan for what comes next in the real world.
The progress of applying machine learning or AI to cybersecurity is similar to the development of AI. Until the 2010s, the focus was on detection, categorization, and pattern recognition. In the 2020s, generative AI began to be used as a tool to assist security operations, such as analyzing threats, offering explanations, and establishing countermeasures. Recent trends point to developing autonomous security operations through agentic AI technology with executive capacities.
AhnLab's AI Innovation: Boosting Productivity Across All Security Tasks
In the past, AhnLab's AI technology centered around developing threat detection models through machine learning. Using machine learning technology, AhnLab focused on improving the threat detection rates for malicious behavior in AhnLab EDR and for phishing emails and URLs in AhnLab MDS. AhnLab built separate processes for each detection model to collect, pre-process, and train data, using the models developed this way in the product's detection features. However, this approach involved several limitations. The issues include the lack of synergy during the acquisition and cross-utilization of various data, as well as the costs that did not decrease for broader AI implementation.
To overcome these limitations, AhnLab gathered various types of data—including its own threat intelligence and monitoring analyses—in one place and trained a single generative AI model to provide multiple features. Because AhnLab's AI includes security data unique to the company, it differs from general generative AI models as a tool specialized in security.
Figure 1. AhnLab's generative AI operation structure
Through productivity innovation using AI, AhnLab is expanding AI's role to go beyond the existing threat detection features and improve productivity in all areas of security operations, offering ▲ multimodal detection that provides context explanations, ▲ support for interactive analysis and security operations, ▲ comprehensive guidance from diagnosis to response, and ▲ analysis report creation.
AhnLab AI PLUS Launch: Boosting Productivity Across All Security Tasks
As part of these efforts, AhnLab launched its AI-based security platform, "AhnLab AI PLUS," in the first quarter of 2025, bringing together its own data and AI technology.
AhnLab AI PLUS is the company's in-house AI platform developed by harnessing the vast security information AhnLab has accumulated for three decades, including threat analysis data and experience responding to malware and breach incidents. Through a variety of efforts, encompassing ▲strengthened intelligent security detection and analysis based on generative AI and LLMs, ▲ expanded AI-powered operations through the application of AI to various products and services, and ▲ providing advanced AI services and improving security via learning systems based on self-collected data, AhnLab seeks to carry out AI-powered intelligentization for all its products and services.
Looking at the structure of AhnLab AI PLUS, a vast amount of security information is centralized in an internal data lake, and through data processing and model training, a security-specialized LLM and a knowledge database were established. The LLM and knowledge search functions are provided to the application layer as API services. In addition, guardrails are applied—factoring in data and model reliability, risk management, and security—to minimize risks that may arise from AI.
AI is provided as an assistant with differentiated roles: ▲ AI agent for detection, ▲ AI agent for threat intelligence, and ▲ AI agent for operation. AhnLab is also developing Orchestrator AI, which will be used to link the assistants and handle integrated security operations.
Finally, all of these achievements can be accessed through AhnLab's AI Portal.
Figure 2. AhnLab AI PLUS structure
Customers may have several questions as they encounter AhnLab AI PLUS for the first time. Here are the answers to the three most fundamental questions they might ask.
#1. How is it different from AhnLab's previous AI?
AhnLab AI PLUS uses generative AI and LLM technologies to further advance its existing machine learning and deep learning-based detection technology. By analyzing various types of unstructured data, such as files, URLs, behavioral information, and smishing messages, the AI thoroughly understands the causes of threats and attack methods to provide detection results and response guides.
As a result, security personnel can understand security events more intuitively and quickly identify threats. AhnLab AI PLUS also improves accuracy and response speed in security operations, allowing efficient response to diverse threats.
#2. How is the AI applied to security solutions?
AhnLab began applying AhnLab AI PLUS by integrating Annie—an AI security assistant—into AhnLab XDR. The product UI offers an interactive AI security assistant with various features to support security operations, such as real-time threat detection, suggesting response measures (playbooks), and recommending additional questions. These features allow clients to easily understand their security status even in complex threat environments and build a faster, more systematic response system.
Figure 3. AI security assistant implemented in AhnLab XDR
AhnLab AI PLUS is designed to be applied not only to AhnLab XDR but also to various AhnLab products and services. In the future, AhnLab plans to expand AI applications to even more products and services.
#3. Is there any risk of data leakage or other security concerns when training the model?
AhnLab AI PLUS does not collect or use client data. Instead, it carries out training sessions and enhances its AI service quality through AhnLab's expertise in malware analysis and breach incident response, big data comprising files, URLs, IPs, and behavior information collected using AhnLab TIP and AhnLab Smart Defense (ASD) infrastructure, and security intelligence. Clients can use advanced AI services built on AhnLab's extensive threat intelligence without concerns of external exposure or leakage of their data.
Next Step: Toward Security Intelligentization
AhnLab aims to enhance the readiness for security intelligentization by continuously advancing its AI. This concept goes beyond detecting, analyzing, and responding according to predefined scenarios, as AI understands the context and independently plans and executes processes. The ultimate goal of security intelligentization is for AI to independently design and execute the appropriate workflow for the given context by integrating various generative AI features across all security operations.
Figure 4. Use of AhnLab's generative AI and agentic AI technologies
Figure 5. AhnLab agentic AI concept
To this end, AhnLab is developing an AI agent to carry out the three aforementioned roles: ▲ AI agent for detection, ▲ AI agent for threat intelligence, and ▲ AI agent for operation. The ultimate goal is to build an autonomous security operation system where a single integrated agent makes plans, works seamlessly with multiple AI agents, and carries out a series of tasks. As AI agent-based security operation systems become more advanced, AI support for humans will be optimized, leading to improved security and increased client business productivity.
