Scaled for assets, US banks' cybersecurity staffing lead over Korea's big four drops from 47 times to under 5

According to en.sedaily.com, the staffing disparity stays substantial after accounting for a 10- to 12-fold gap in asset size between banks in the two countries ^[4]. Dividing the lowest multiple, 34, by the widest asset gap, 12, and the highest, 47, by the narrowest, 10, gives a lead of 2.8 to 4.7 times ^[15]. Spending shrinks the same way. The raw gap is 22 to 37 times ^[16] (the low end is the 940 billion won bottom of the US range ^[5] over KB Kookmin's 43.3 billion won, the high end the 1.34 trillion won top over Woori's 36.4 billion won ^[6]), and scaled for assets it is 1.8 to 3.7 times ^[17].

Two measures need no asset adjustment, and both come out lower. Security staff are 1.5% to 1.6% of employees at Citi and Bank of America against an average 0.69% at the four Korean banks ^[7], a ratio of 2.2 to 2.3 ^[18]. The Korea Internet & Security Agency puts security at 9.6% of IT investment across 31 Korean financial and insurance firms in 2024, against a 12% average in a survey of US and Canadian financial firms that year ^[9], a ratio of 1.25 ^[19]. That sample spans banks and insurers and the comparison group is North American, so it does not test Citi and Bank of America directly.

The report adds that counting only in-house staff, with outsourced personnel excluded, the share falls to 0.3% to 0.4% ^[8]; it does not say which group that describes. If it is the Korean banks, the share gap widens to 3.8 to 5.3 times ^[20], overlapping the 2.8 to 4.7 from headcount.

KB Kookmin has budgeted about 86.075 billion won for security this year ^[10], 1.99 times the 43.3 billion won it invested last year ^[22], so the two figures may not count the same things. Analysts cited in the report say that even raising it above 100 billion won next year would leave a considerable gap with large US banks ^[14]. At 100 billion won the gap to the US range is 9.4 to 13.4 times ^[21], about the size of the asset gap itself. Woori is considering a budget increase of more than 20% and more than 10% more specialist staff ^[11]. A 10% rise takes its 101 staff ^[2] to about 111, and Citibank's 3,400 ^[1] would still be 30.6 times that ^[23].

In our view the evidence supports an underinvestment of roughly 2 to 5 times on staff and spending once size is counted ^[15][17], and about 1.25 times on share of IT budget ^[19], not 34 to 47 times. It does not support the AI part of the thesis. The report says calls are growing to move past network separation as AI-powered hacking intensifies ^[26], but it does not describe the incident it calls the latest or any AI-driven attack. Its explanation comes from an unnamed industry official, who attributed the incident to financial firms depending on network separation by itself while being passive about information security investment ^[25].

Two things would move that view in opposite directions. If security work has fixed costs (a monitoring team is needed whatever the balance sheet), scaling by assets overcorrects and the true shortfall exceeds 2.8 to 4.7 times. If network separation cuts the staff a bank needs, the shortfall is smaller: major US banks built their frameworks on firewalls and continuous authentication, with zero trust the best-known example, while Korean firms reduced risk by severing links between external and internal networks ^[24]. Bank-level incident and loss figures would show which case holds.