ReadingResearchRadarInvestment framework
Sign in / Sign up
← Back to reading
NewsMaterial3 min readDisconfirmAI Editorial

CryptoLab CEO: AI Defense May Not Always Win Against AI Attacks; Encrypted Data Itself Is the Final Line of Defense

Cheon Jeong-hee, CEO of CryptoLab and professor at Seoul National University, argues that AI-driven automated attacks make it impossible for defenders to guarantee every interception succeeds. Therefore, security strategy should shift from preventing intrusions to protecting the data itself. He recommends using homomorphic encryption to perform queries and computations while data remains encrypted, citing attack simulation experiments conducted on his company's products to demonstrate effectiveness, while emphasizing these are vendor self-tests.

2026-10-26 13:15 GMT+8

AI is automating cyberattacks, but a frequently overlooked issue is that defensive AI does not always prevail against offensive AI. Cheon Jeong-hee, CEO of CryptoLab and Professor at the Department of Mathematical Sciences, Seoul National University, recently articulated this judgment in an interview, deriving a strategic conclusion: rather than relying on intercepting every intrusion, we should ensure that data cannot be read even if it is accessed, by keeping it encrypted.

Cheon points out that South Korea’s current security framework focuses heavily on blocking external intrusions, while offering insufficient protection for databases storing personal information. His logic is straightforward: if attackers breach perimeter defenses, any database that decrypts data during operation exposes personal information to risk. Consequently, the difficulty and cost of stealing data must be increased even after a successful intrusion.

In evaluating existing data protection solutions, he contrasts the limitations of Hardware Security Modules (HSM) and Trusted Execution Environments (TEE). HSMs excel at protecting encryption keys but are costly and difficult to apply at the application layer. TEEs, meanwhile, can still be bypassed via software vulnerabilities. As an alternative, he proposes homomorphic encryption—a technology that allows searching and computation directly on ciphertext, ensuring data never needs to be decrypted, thereby reducing the risk of plaintext exposure during processing.

Sign in / Sign up
ReadingResearchRadarInvestment framework

To illustrate its efficacy, Cheon described a simulation experiment conducted by CryptoLab using its own AI attack tool, ARTEX. Under conditions of limited query access, attackers successfully extracted the plaintext of 1,000 virtual personal records from a standard database. However, when targeting CryptoLab’s homomorphic encryption product, HEracles, attackers only obtained encrypted data and could not verify the original text. Cheon acknowledged that homomorphic encryption still faces challenges regarding the protection of decryption keys, noting that CryptoLab has used small-scale HSMs in pilot validations with multiple enterprises to prevent key leakage.

Regarding performance, Cheon stated that while homomorphic encryption was previously criticized for its slowness, this issue has been significantly mitigated. He claimed that under specific conditions, because traditional methods require decryption before searching whereas homomorphic encryption processes data directly in ciphertext form, the latter can be approximately 10 times faster. This assertion comes solely from the vendor’s own statements and has not been verified by independent third-party benchmark tests; it holds true only under specific conditions.

The core value of this argument lies not in any single product, but in the strategic assessment: as AI accelerates both offense and defense, defenders should not assume they will always succeed in intercepting attacks. Instead, focus should shift to increasing the cost and difficulty of data theft.

It is important to note that Cheon Jeong-hee is simultaneously the CEO of CryptoLab, which sells the aforementioned homomorphic encryption solutions, and the experiments were designed and executed by the company itself. This conflict of interest means that his performance claims and experimental conclusions should be understood as vendor assertions rather than independently verified results.

Sources

  • etnews.com미래를 보는 창 - 전자신문↗
Continue researching →