Generative AI Breaks Through the Network Segmentation Barrier: KB Financial’s Real-World Model

A case study showing how a generative AI architecture overcame barriers in the financial sector has been unveiled. The main hurdles in finance are cited as network segmentation regulations and the complexity of cloud operations.

KB Securities and KB Kookmin Bank presented related cases at the "AWS Financial Services Forum Seoul 2026" on the 27th. The cases address network segmentation and cloud operations issues, long seen as major constraints in the financial sector, through a generative AI-based structure.

The two companies pointed to AWS infrastructure and the latest AI protocols as key enablers. Based on this, KB Securities and KB Kookmin Bank shared a case of building an internal developer coding assistant environment inside a closed network.

They also shared a case of introducing an agentic AI operating framework for multi-account cloud infrastructure. In other words, they explained how closed-network development support and multi-account cloud operations can be connected, respectively.

The presentation was delivered by Bae Jun-hyeok, manager in KB Securities' Infrastructure Systems Department. KB Securities presented a safe way to use coding assistants in a development environment subject to network segmentation regulations, introducing a "proprietary MCP hub" architecture as the solution. Photo credit: Reporter Kwon Young-seok.

Under Article 15, Paragraph 1 of the Electronic Financial Supervision Regulations, business networks in the financial sector are divided into "Type 3," which covers general financial tasks, and "Type 5," which covers computer rooms and information processing systems access. Developer PCs belong to the highly secure "Type 5" terminals, and direct calls from "Type 5" terminals to external LLM endpoints are strictly prohibited.

To respond to growing demand for in-house developer AI tools, KB Securities built its own AI utilization framework inside a closed network. The technical and legal review process before implementation took about 1 year, and there had been no precedent for building an AI utilization framework inside a closed network. As a result, KB Securities received a "suitable" determination in a security measures evaluation by the Financial Security Institute in June, the first in the domestic financial sector, and was also designated as an innovative financial service in June.

The core architecture of the system consists of the open standard protocol "MCP" announced by Anthropic and a "centralized hub structure." This structure blocks direct N:N connections between the client (Claude Code) and in-house tools (MCP servers), with all requests mediated and controlled by the central hub.

KB Securities combined integration with "Amazon Bedrock Agent Core" and an intermediary "LLM gateway" to establish a security-oriented structure. The structure includes establishing a token authentication system based on in-house AD accounts, fundamentally blocking user impersonation at the prompt level, branching the list of MCP servers accessible by user permissions, and implementing the "least privilege principle."

KB Securities also adopted a four-step verification process through the "LLM gateway." The four-step verification consists of 1) injecting in-house security policy and coding standard system prompts, 2) unified user authentication, 3) automatic routing to approved models, and 4) PrivateLink-based audit logging and cost management.

The system was designed to prevent impersonation and allow access only within the scope of permissions, and its effectiveness was also validated through in-house beta testing. In the beta test, a 12,000-line spaghetti legacy codebase that had been neglected for years was fully refactored in one month, confirming a 28% reduction in code volume.

Bae Jun-hyeok, manager in KB Securities' Infrastructure Systems Department, said the past 1 year was not easy, but that completing the innovative financial service designation and security evaluation process laid the groundwork for safe AI use. He added that KB Securities' MCP hub is core infrastructure for accelerating development capabilities, not for replacing developers.

The photo shows Park Jeong-min, manager in the IT Operations Department at KB Kookmin Bank, speaking at the event. Photo credit: Reporter Kwon Young-seok.

KB Kookmin Bank applied agentic AI to multi-cloud operations covering more than 150 accounts and more than 2,000 servers. The application was driven by the increasing scale of accounts and servers, which had made multi-cloud operations more complex.

After analyzing 4 years of cloud incident data, KB Kookmin Bank found that 50.9% of total response time was spent identifying the cause. In addition, in a network-segmented environment, delays in night and weekend response, human error in direct console access, and differences in performance depending on the competence of the person in charge were cited as issues.

Accordingly, KB Kookmin Bank built 4 specialized AI agents to improve cloud operations efficiency. These 4 specialized AI agents operate in a collaborative structure, aiming to replace manual work across operations and improve work speed and accuracy.

Agent 1, incident issue management, analyzes logs as soon as an incident occurs, identifies the cause, and proposes step-by-step solutions. Agent 2, technical support, responds in real time to questions about internal rules and technical inquiries.

Agent 3, infrastructure as code (IaC), helps prevent mistakes by supporting configuration code writing and pre-analyzing the risk level of change tasks. Agent 4, governance, continuously checks compliance with security policies and cost policies.

As a result of the introduction, the company saw an effect in removing the bottleneck of manually checking each of the distributed monitoring tools, and also confirmed reduced variation due to differences in staff capability and reduced human error.

In the course of reliability verification conducted under the assumption of a real operating environment, tests were carried out by injecting hundreds of virtual failure scenarios. In this verification, the system demonstrated the ability to immediately identify the root cause of a system outage caused by server memory overload.

It was also confirmed that no AI hallucination occurred in abnormal situations with insufficient analysis data, and when data was insufficient, the system correctly determined that "analysis is not possible due to lack of data." Through this, the company verified both the accuracy required for financial system analysis and the stability required for financial systems.

Park Jeong-min, manager in KB Kookmin Bank's IT Operations Department, said the bank plans to further enhance organic collaboration among the 4 established agents and gradually introduce Self-Healing capabilities, starting with low-risk failure domains, beyond simple inquiries. He also outlined plans to migrate to Bedrock Agent Core in the future and the goal of continuously maximizing operational efficiency and stability in a large-scale multi-cloud environment.

Source: IT DAILY · Kwon Young-seok
Original: https://www.itdaily.kr/news/articleView.html?idxno=241257

References

• https://www.itdaily.kr/news/articleView.html?idxno=241257