South Korean Research Institutes Plan Security Checks for Just 15.9% of Servers

More than 16,000 servers left outside planned checks

South Korea's government funded research institutes selected just 3,025 of their 19,041 servers for security vulnerability checks in 2026, according to Ministry of Science and ICT data submitted to the National Assembly. That leaves 16,016 servers, or 84.1%, outside the inspection scope, even though national cybersecurity guidelines require checks at least once a year.

The figures cover 23 institutes conducting research in fields including artificial intelligence, semiconductors, biotechnology, nuclear energy and cybersecurity. Within the limited inspection scope, the institutes recorded 34,536 vulnerabilities between January 1 and October 16. All 23 said work to address the findings was still under way.

A second gap concerns protection against malicious software. Figures presented during parliamentary scrutiny showed that 17,387 servers, or 91.3%, had no antivirus software installed. Among 766 servers connected directly to the internet to provide services such as websites, 372 lacked antivirus protection.

The ministry headquarters had much broader coverage: all 108 of its servers were included in vulnerability inspections, and 100 had antivirus installed. Lawmakers questioned why institutes responsible for nationally important research operated with substantially narrower protection under the same security guidelines.

The ministry cited shortages of specialist staff, expensive scanning tools and technical difficulties installing antivirus on some research equipment. Its proposed response includes common criteria for deciding which servers to inspect first. Rep. Lee Hoon-ki, a Democratic Party member of the National Assembly's science and technology committee, called instead for an immediate review covering every server.

The largest server operators have the narrowest coverage

The Korea Institute of Science and Technology Information, known as KISTI, selected 267 of its 11,132 servers for checks. The Electronics and Telecommunications Research Institute, or ETRI, selected 100 of 3,747.

Together, those two institutes operated 14,879 servers, about 78.1% of the total across the 23 institutes. They selected only 367 for inspection, approximately 2.5% of their combined inventory. Their size makes their inspection decisions central to the national picture.

KISTI's server antivirus installation rate was 0.6%, while ETRI's was 8.4%. Their responsibilities include computing infrastructure and communications technology, making the protection of their systems particularly relevant to research operations.

The inspection figures describe servers selected for checks during the reporting period. Readers still need a complete account of checks performed, weaknesses corrected and protections applied to servers outside that selection to understand how much work has been completed.

Four years of limited inspection scope

The ministry data show a persistent pattern rather than a short interruption in inspections. Across all 23 institutes, the share of servers outside the inspection scope was 84.2% in 2023, 84.2% in 2024, 83.7% in 2025 and 84.1% in 2026.

Coverage therefore stayed close to one server in six throughout the four years. The modest improvement in 2025 was largely reversed in 2026.

ETRI recorded a sharper change. Its share outside inspection rose from 61.1% in 2025 to 97.3% in 2026. KISTI's excluded share remained above 96% in every year examined, reaching 97.6% in 2026.

The Korea Electrotechnology Research Institute left 94.8% outside inspection in each of the four years. At the National Security Research Institute, the excluded share fell from 90.9% in 2023 and 2024 to 71.8% in 2025 and 67.3% in 2026. That improvement still left roughly two thirds outside the selected scope.

What the inspection rules require

Article 53, paragraph 2, of the National Cybersecurity Basic Guidelines requires server administrators to review their security measures and inspect and address vulnerabilities at least annually. The risks covered include theft of stored information and unauthorized changes to server settings or data.

An amendment effective May 1 also requires regular examination of operating system and software vulnerabilities and updates. A vulnerability is a weakness, such as an unsafe setting or outdated software, that could give someone an opportunity to enter a system or interfere with its operation.

Institutes used different criteria to choose their inspection targets. Some excluded servers examined the previous year; others excluded machines scheduled for retirement. The ministry had left those choices to individual institutions.

The main developments span several years:

• 2023 to 2026: The share of institute servers outside the inspection scope remained above 83% each year.
• May 1: An amendment added requirements for regular checks of software vulnerabilities and updates.
• July: The Board of Audit and Inspection called for inspection priorities where institutes could not examine every server in detail.
• September 2026: Antivirus coverage across the 23 institutes stood at 1,654 of 19,041 servers.
• October 16: The vulnerability reporting period ended with 34,536 findings.
• October 20: Lawmakers challenged the ministry's security management during the parliamentary audit of research institutes.

Thousands of weaknesses await corrective work

The Korea Institute of Science and Technology, or KIST, recorded 7,079 vulnerabilities, the largest total among the institutes. The Korea Institute of Machinery and Materials followed with 6,472, the Korea Institute of Geoscience and Mineral Resources with 4,290, and KISTI with 3,944. The Korea Research Institute of Bioscience and Biotechnology recorded another 2,693.

At the machinery institute, 6,472 findings came from 89 servers, an average of about 73 per server. A single machine can have many weaknesses because its operating system, applications and security settings can each require attention.

The institutes classified their corrective work as ongoing. Fixing a finding can involve installing an update, changing a setting, removing unnecessary software or restricting access. The figures give a count of identified weaknesses, while the practical workload depends on their severity and the changes needed.

For research teams, corrective work also has to be coordinated with the systems they use. Servers may support calculations, store experimental results or control equipment. The ministry's staffing explanation points to the need for people who can assess a weakness and carry out repairs while maintaining those functions.

Antivirus gaps reach public internet services

Only 1,654 of the institutes' 19,041 servers had antivirus installed, an installation rate of 8.7%. At ministry headquarters, the corresponding figure was 92.6%, a gap of 83.9 percentage points.

Internet connected servers had better coverage than the institute inventory as a whole, but nearly half still lacked the software: 372 of 766, or 48.6%. These machines face direct contact with the public internet, giving attackers a route to probe their services for weaknesses.

Antivirus software and vulnerability inspections perform different jobs. Antivirus looks for malicious programs or suspicious activity. A vulnerability inspection looks for weaknesses that need repair. Institutes need to manage both the condition of their software and signs that harmful programs are present.

Ministry planning and coordination chief Kang Sang-wook acknowledged technical limits during questioning about antivirus coverage:

Some equipment at the research institutes is technically difficult to install antivirus software on, so achieving 100 percent coverage is not straightforward," he said. "But I do think there is much room for improvement.

Kang said the ministry would accelerate installation and strengthen oversight so institute heads paid closer attention. For equipment unable to support conventional antivirus, Lee called for verification of equivalent protections. Those can include tightly limiting access, separating networks and using other methods to detect malicious activity.

Malware findings challenge positive security ratings

An earlier Board of Audit and Inspection review examined five research institutes operating 17,073 servers. Only 374 servers, or 2.2%, had antivirus installed. That review covered a different group and period from the September tally across all 23 institutes.

Auditors checked 251 servers without antivirus and detected 38 types of malicious software on 21 servers across four institutes. About 8.4% of the examined machines contained malware. The rate describes the machines selected for that examination.

The audit also identified delayed security updates on major servers and inadequate controls over programs that allowed access from outside to internal networks. These findings put concrete operating practices alongside the antivirus installation figures.

Despite those weaknesses, the ministry had annually rated the institutes' information security management as very good. People Power Party lawmaker Seo Cheon-ho questioned whether those assessments reflected conditions inside the institutions.

Democratic Party lawmaker Kim Nam-guk raised another oversight gap. Of 19 security recommendations and guidelines sent to research institutes from 2023 onward, compliance with only one was being checked. He said the ministry had also failed to verify action on guidance concerning a vulnerability assigned the highest risk category under an international vulnerability assessment system.

Together, the findings identify two tasks for the ministry: checking whether instructions are followed and testing whether its ratings capture weaknesses found during more detailed examinations.

Budget growth puts spending choices under scrutiny

Six institutes said they would install antivirus in stages after securing funding. Their combined information security budgets, however, rose from 2.47 billion won to 3.62 billion won, an increase of 1.15 billion won, or 46.3%.

The six were the National Institute of Green Technology, Korea Institute of Oriental Medicine, Korea Institute of Industrial Technology, Korea Institute of Machinery and Materials, Korea Institute of Energy Research and Korea Electrotechnology Research Institute. All 23 institutes received approval for their requested information security budgets without cuts.

The National Institute of Green Technology and Korea Institute of Oriental Medicine had no separate budget line for acquiring or maintaining server antivirus in either 2025 or 2026. At the oriental medicine institute, just two of 141 servers had antivirus installed.

The institute estimated a cost of 500,000 won per server, putting coverage for its remaining 139 servers at 69.5 million won. Lee's office contrasted that sum with information security spending of 43 million won on network line fees, 28 million won on cloud services and 22 million won on equipment used to erase magnetic storage media.

Those three categories totalled 93 million won. The comparison focuses scrutiny on what security budgets purchase, alongside how much money institutions receive. Some antivirus installations were scheduled for 2027 or 2028, prompting Lee to call for earlier completion.

Research files also left on a hard drive

The Board of Audit and Inspection identified a physical information security failure at the Korea Aerospace Research Institute. A researcher who moved to another institution removed a hard drive without authorization. It contained 60,956 research files, including material associated with four national security projects.

The incident brings storage devices into the same debate as servers. Protecting research information also requires rules governing who can remove a drive, who approves that removal and how the movement is recorded.

Several outcomes remain unresolved: the accounts give no confirmed research data disclosure from the malware findings or drive removal, no completed investigation of those events, and no firm date for finishing all vulnerability repairs. The next stated milestones concern the ministry's inspection criteria and the review demanded by lawmakers.

The ministry faces a deadline for inspection priorities

The ministry plans to establish common priority criteria by the end of 2026 and apply them from 2027. It has also described collecting the institutes' existing criteria and reflecting essential priority items during 2026, creating an earlier step before the broader framework takes effect.

Priority rules would identify which machines receive attention first when staff and tools are limited. Lee argued that deciding an inspection order must preserve the annual obligation to inspect and address vulnerabilities across all servers.

Lee also urged a complete server security review before the end of the year. Addressing the ministry's responsibility for equipment that cannot support antivirus, he said:

"The ministry must also verify that servers where antivirus installation is not feasible have equivalent alternative protections in place, and it must strengthen its supervisory responsibility to ensure that institute heads take direct charge of information security," he said.

The combined findings put inspection coverage, repair work, malware protection and management accountability on the same agenda. For the institutes, the practical test is whether every server has an assigned inspection schedule, identified weaknesses receive corrective action, and specialized equipment has protections suited to its operation.

Key Points

• The 23 research institutes selected 3,025 of 19,041 servers for vulnerability checks in 2026, a rate of 15.9%.
• They recorded 34,536 vulnerabilities through October 16, with corrective work still under way.
• Antivirus was absent from 17,387 servers, including 372 connected directly to the internet.
• An earlier audit detected 38 malware types on 21 of 251 examined servers.
• Six institutes citing funding constraints had received a combined security budget increase of 46.3%.
• The ministry plans common inspection priorities by year end for application in 2027; lawmakers are seeking a complete review sooner.