Cyber official plans AI testing

• By Shelley Shan / Staff Reporter

• • Add TT as Preferred Source

  • 

  • 

  • 

The government would begin black-box cybersecurity testing using agentic artificial intelligence (AI) to imitate hackers next year, the National Institute of Cybersecurity said yesterday.

The institute’s new director, Dennis Kung (龔化中), told a news conference in Taipei that this would be one of the tasks he would prioritize during his term.

Kung, who has private-sector experience in researching and developing networking equipment, smartphones and cybersecurity software, said cybersecurity research should not be limited to product development in laboratories.

A 3D-printed block with the word “Cyber” is displayed among PC motherboards in an photo illustration taken in 2017.

Photo: Reuters

The focus should be on closely linking R&D units with frontline defense units, with the experiences gained from defense units guiding the work of the R&D units, Kung said.

The products developed by R&D teams should be used by the defense units as well.

“With the addition of AI-proficient staff, we can produce a cybersecurity defense that truly meets the needs of the government and private sectors in the fast-changing AI age,” he said.

Kung said that he aims to lead the team at the National Institute of Cybersecurity in upgrading four areas of defense.

First, for the government’s annual cybersecurity exercises next year, the institute would run black-box penetration tests, using agentic AI to imitate hackers. Agentic AI would be used in the Cybersecurity Operations and Defense Exercise next year, he said.

Second, the institute would work with international AI firms to use on-premises models to conduct automated source-code scans of software used in key government and critical infrastructure projects, addressing vulnerabilities at the development stage, he said.

Third, the institute would use agentic AI and large language models to analyze millions of pieces of global cybersecurity intelligence in real time each day and turn them into blocking rules for perimeter security devices, he said.

Fourth, the institute would assist the government and the private sector in building a controlled environment for high-intensity AI-powered cybersecurity attacks, Kung said, adding that this would help build a strong, ingrained defensive response.

Kung said that he found that AI can identify vulnerabilities at least 10 times faster than traditional methods. Government agencies should first establish a comprehensive software bill of materials inventory and prioritize repair based on risk levels, he said, adding that they can deploy virtual patches as temporary measures to block threats, rather than attempting to patch every vulnerability indiscriminately.

Kung said the institute would be committed to strengthening Taiwan’s overall cybersecurity capabilities by working with its incident response center and the Administration for Cybersecurity to help domestic companies establish product security incident response teams (PSIRTs).

The initiative is introduced in line with the EU’s Cyber Resilience Act, Kung said.

This year, the institute plans to assist at least 30 companies in establishing PSIRTs to ensure that vulnerabilities can be reported and patched promptly when discovered, he added.

Regarding frequent DDoS attacks targeting media Web sites, Kung said that the institute and the Taiwan Computer Emergency Response Team/Coordination Center are always ready to provide support.