80% of Korean Firms Hit by a Security Incident, Cisco Says

What the survey found

Cisco's Relentless Defense report, released on October 13, found that 80% of Korean organizations experienced a cybersecurity incident with real business impact over the past year. The study surveyed 8,000 security professionals across 30 markets, including Korea, during April and May of this year.

The wording matters. Respondents weren't asked whether they had been attacked — they were asked whether they had suffered an incident that materially affected the business. That excludes blocked scans and filtered phishing mail, and points instead to outages, data exposure, and recovery costs that show up in operations or on the income statement. Eight out of ten saying yes suggests security incidents have shifted from exceptional events to a standing operational cost.

91% globally vs. 80% in Korea

The global figure was 91%, eleven points higher than Korea. Reading that as "Korea is safer" would be premature. The same report scored Korea's cyber defense capability on a 100-point scale and singled out weak cross-functional collaboration as a core gap.

There's a known paradox in this kind of survey: the better an organization's detection and reporting, the more incidents it reports having experienced. Breaches that are never noticed — or that are learned about only when an outside party calls — don't make it into the count. The 11-point gap may reflect differences in visibility as much as differences in exposure.

What AI actually changed: the unit cost of attack

The report's recurring theme is AI, and the mechanism is economic rather than exotic. Generative models lowered the barrier for tasks that used to require specific skills — writing fluent, idiomatic phishing copy in Korean, for instance, was historically a real obstacle for foreign-language attackers targeting Korea. They also automate reconnaissance, vulnerability hunting, and malware variation, compressing the attack cycle. The net effect is a lower cost per attempt.

Defenders use AI too, but the asymmetry is structural: an attacker needs one success out of thousands of attempts, while a defender must stop all of them. Automation that multiplies attempts disproportionately favors the offense. That is what "AI made hacking faster and cheaper" really means.

Why collaboration, not tooling

It's notable that Cisco led with organizational collaboration rather than technology spending. In many Korean companies, security sits under the IT department, and even where a CISO exists, budget authority and escalation power can be limited. During an incident, if the security team, infrastructure, legal, communications, and executives all move at different speeds, fast technical detection doesn't help — decision-making becomes the bottleneck.

Korea adds a regulatory layer. Breach notification duties under the Personal Information Protection Act and incident reporting under the Network Act mean that publicly acknowledging an incident is itself an executive decision. Without pre-agreed escalation paths, that decision drags, and delay converts directly into wider damage.

What this changes for practitioners

Three practical takeaways.

Design for compromise, not just prevention. An 80% incidence rate is not a number you fix by buying a better perimeter. Time-to-detect and time-to-recover are the metrics that actually move outcomes.

Retire the old phishing training. Advice built around spotting awkward grammar is useless against machine-generated text. Procedural controls — sender verification, out-of-band confirmation for payment or account-change requests — carry the weight now.

Extend the process to suppliers. A large share of incidents arrive through partners or SaaS accounts rather than your own systems. If notification timelines aren't written into contracts, you absorb the cost of a breach that started somewhere else.

Using the number honestly

Vendor security reports double as demand-generation material, and the figures deserve some skepticism. Still, a multi-country survey of 8,000 practitioners is a reasonable external reference when a security team needs to make a budget case to executives. The useful reframing isn't "we could be next" — it's "how many hours until we're back up."