As data breach incidents continue to hit churches, banks, and even matchmaking companies across both the public and private sectors, a report submitted to a National Assembly research body has renewed criticism that South Korea lacks a cybersecurity command center to coordinate responses. The assessment is that differing response frameworks across government ministries are causing the country to miss critical windows of opportunity when threats emerge.
According to a report titled “Comparative Study of Domestic and International Legislation and Policy on New AI-Driven Security Risks and Responses,” submitted last month to the National Assembly Research Service by Professor Lee Hae-won of Kangwon National University Law School, South Korea’s cybersecurity response is fragmented by domain. The National Intelligence Service handles the public sector, the Ministry of Science and ICT and the Korea Internet & Security Agency (KISA) oversee general private-sector areas, and South Korea’s Financial Services Commission and the Financial Security Institute manage the financial sector—each operating under separate statutes.
Professor Lee noted that in an environment where AI models and infrastructure converge without boundaries, this siloed approach delays information sharing and impedes effective nationwide response. Without a command center capable of overall coordination and enforcement when threats arise, blind spots emerge on the rapidly shifting cyber front.
The report also addressed the limitations of the National Security Office under the presidential office. “The presidential office is fundamentally an advisory body to the president and lacks enforcement functions,” the report stated. “Without a dedicated enforcement organization or personnel, it inevitably relies heavily on the National Intelligence Service and other agencies for policy implementation.”
The contrast with major economies is stark. The United States consolidated cyber threat response—previously divided among the FBI, the Department of Defense, and intelligence agencies—under the Cybersecurity and Infrastructure Security Agency (CISA) within the Department of Homeland Security. In particular, the Cyber Incident Reporting for Critical Infrastructure Act (CIRCIA) unified reporting channels and granted civil litigation immunity for voluntary reporting, enhancing the effectiveness of inter-agency information sharing.
In the United Kingdom, the National Cyber Security Centre (NCSC) under GCHQ serves as the command center, while Japan’s National Cyber Oversight Office (NCO), directly under the Cabinet Secretariat, plays that role. Following the Mitos incident, Japan launched “Project Yata,” a government-wide security package, and swiftly revised its AI basic plan centered on the AI Strategy Headquarters. Japan has demonstrated agile cross-ministerial response by building an active cyber defense system that links police and Self-Defense Forces authorities.
The EU, which previously had separate regulatory authorities and reporting procedures under different laws—GDPR for personal data protection, NIS2 for cybersecurity, and the AI Act—is now pursuing a Digital Omnibus package that introduces a single reporting window. The bloc is working to unify regulatory enforcement and incident reporting channels that had been spread across multiple ministries and agencies, establishing an organic pan-European response framework.
The United States has also established the AI Information Sharing and Analysis Center (AI-ISAC) under the Department of Homeland Security’s leadership as part of its AI Action Plan, enabling public-private sharing of security threat information. The use of legal immunity mechanisms to strongly incentivize voluntary private-sector threat information sharing also contrasts with South Korea’s approach.
In South Korea, relevant legislation has already been introduced and is under discussion. The National Cybersecurity Act Bill, proposed last July by Representative Yoo Yong-won of the People Power Party, centers on establishing a National Cybersecurity Center within the National Intelligence Service to carry out comprehensive and systematic cybersecurity operations at the national level and enable efficient response to cyberattacks and threats. The bill mandates the establishment and operation of an information-sharing system for the efficient distribution, sharing, and management of information necessary for responding to cyberattacks and threats. The bill is currently pending before the National Assembly’s Intelligence Committee.
Professor Lee emphasized the importance of legislation for building a proactive defense framework. “There is a need to impose obligations on AI operators above a certain threshold to ensure cybersecurity response capabilities and resilience,” he said, adding that “measures to reform the nationwide cybersecurity governance structure should be pursued.”
He further noted, “With differing responses across ministries and companies feeling burdened by excessive punitive sanctions and post-incident penalties, information gets concealed and the nation’s overall supply chain security capability weakens—a vicious cycle that keeps repeating.” He added, “We must break down inter-ministerial silos and grant legal immunity and incentives so that private companies can share vulnerability and threat information without fear.”