[New Year Interview] CEO of Withnetworks: "Integrating Assets, Vulnerabilities, and History... Strengthening Security Governance Platforms"

'A Differentiation Strategy Driven by 'Security-Centric Asset Management'

Jong-up Ahn, CEO of Withnetworks

Withnetworks announced that it maintained a stable growth trend throughout 2025, centered on withVTM 3.0. The company explained that its growth was driven by the alignment of product direction and market demand, as securing asset visibility and integrated vulnerability management emerged as key market requirements.

The most representative achievement was winning the project to build the Information Security Portal for the Korea Housing Finance Corporation with withVTM 3.0. The solution was evaluated not merely as a simple vulnerability scanner but as a platform that integrates asset, vulnerability, and history information to implement a security governance system.

Withnetworks diagnosed that major security incidents in Korea during 2025 led to a widespread perception that poor asset management and failed privilege control create security blind spots. Consequently, demand for identification based on Shadow IT (hidden assets) and integrated inventory functions surged, and the proportion of solution sales in total revenue expanded significantly compared to the previous year.

On the technical side, the company emphasized a structure that automatically identifies assets on the network, maps them to CVE (Common Vulnerabilities and Exposures), and presents priorities through VRS (Vulnerability Risk Score) by synthesizing CVSS, EPSS, KEV, and the business importance of the asset. Furthermore, the architecture that implements automated security governance by interlocking with SIEM and SOAR to respond systematically starting from the most dangerous threats received a positive response from customers.

■ Interview with Withnetworks CEO Jong-up An

Q. What were the key achievements of your company in 2025?

2025 was a meaningful year for Withnetworks, achieving stable growth centered on withVTM 3.0. As asset visibility and integrated vulnerability management emerged as core requirements in the security market, the direction of the withVTM 3.0 solution and market needs aligned perfectly, which served as the engine for growth.

The most representative achievement was winning the withVTM 3.0 project within the Korea Housing Finance Corporation's Information Security Portal construction project. This was an instance where withVTM 3.0 was recognized as a solution capable of integrated management of assets, vulnerabilities, and history and implementing a security governance framework, rather than being a simple vulnerability scanner.

Additionally, following major security incidents in Korea in 2025, there was an increased awareness that inadequate asset management and privilege control failures act as security blind spots, leading to a surge in market demand for the Shadow IT-based asset identification and integrated inventory functions of withVTM 3.0. As a result, the share of the solution sector in total sales expanded significantly year-on-year, and securing references in the financial and public sectors became a key driver of growth.

Q. What was the most meaningful representative reference in 2025 and the decisive reason for selection?

A representative reference for 2025 was the implementation of withVTM 3.0 in the Korea Housing Finance Corporation's Information Security Portal project. The customer was looking for ways to integrate dispersed information security tasks and automate inefficient management processes to effectively respond to tightening security regulations. In particular, the top priority was to establish standards and systems to filter out practically important risk factors among numerous IT assets and threats.

withVTM 3.0 automatically identified all IT assets and applications on the network, visualized Shadow IT that managers were unaware of, and integrated them into a single database. It also automatically mapped identified asset information with global security threat information (CVE) and calculated VRS, a proprietary risk assessment index, by synthesizing various vulnerability indicators such as CVSS, EPSS, KEV, and the business importance of assets. Through this, it was possible to derive the priority of threats to be handled first objectively and quantitatively.

Furthermore, by flexibly interlocking with commercial and open-source scanners, it escaped specific vendor dependency and improved compliance response tasks by digitalizing audit evidence and automating report generation. Consequently, the Korea Housing Finance Corporation obtained a clear answer to the question "What should be protected first?" and completed a data-based security decision-making system.

Q. Which products or services launched or advanced in 2025 received the strongest market response?

The product with the strongest market response in 2025 was withVTM 3.0, and specifically, the customer response to the Shadow IT-based asset identification function was the most significant. Existing customers often managed assets manually using Excel or ITSM, making it difficult to grasp the exact number and status of assets actually in operation. This lack of visibility was a fundamental limitation that prevented security teams from answering the basic question of what to protect.

In an actual case where a customer provided information on about 200 assets, applying the Shadow IT scan not only discovered additional missing IP assets but also identified cases where the role, OS, and service information of previously managed assets were being managed incorrectly. withVTM 3.0 identifies the operating system, installed software, running services, and open ports of each asset in detail and supports the establishment of a trusted asset inventory that reflects new device connections or configuration changes in real-time.

It also provides intelligent risk assessment that considers asset importance and actual threat levels by linking secured asset information with a TI-based CVE database in real-time. Additionally, it automatically performs vulnerability checks during the asset identification process. It integrates not only its own scan engines but also the results of domestic and foreign external vulnerability scanners used by customers to provide a bird's-eye view of the vulnerability status and risk of enterprise-wide assets. Notably, in 2025, the architecture for building an enterprise-wide security automation system by linking withVTM 3.0 with SIEM and SOAR gained customer popularity.

Q. What were the biggest security threat trends in 2025?

The core trends of security threats in 2025 were diagnosed as poor asset management and internal personnel or privilege management issues. It was noted that the absence of basic internal management systems led directly to large-scale accidents rather than sophisticated external hacking techniques. In larger organizations, cases continued where unidentified assets or excessive privileges led to security blind spots because actual operating assets and access privileges were not accurately identified.

Mentioning major security incidents at various Korean companies, it was stated that these cases showed how inadequate asset management, access control failures, and limitations of internal management systems could lead to large-scale security accidents. It was added that these incidents left a lesson that even if organizations invest in security, the defensive line can collapse if the foundations of asset visibility and privilege management are shaken. In this context, 2025 was evaluated as a turning point where government policies and regulations were discussed and strengthened around asset management, internal privilege control, and strengthening security governance.

Q. Was AI applied to your products in 2025? If so, where and what were the results?

AI technology was fully applied to two key areas of withVTM 3.0: the asset scanner (Shadow IT identification) and intelligent risk scoring. In Shadow IT scanning, AI was used to analyze the IP, OS, and open port information of unidentified assets on the network to automatically identify discrepancies between existing asset management information and the actual operating environment, thereby increasing the accuracy and reliability of the asset status.

In the vulnerability management area, an intelligent scoring system was built where AI comprehensively analyzes CVSS, EPSS, KEV, and the business importance of assets to automatically calculate the VRS. As a result, rather than a simple listing of vulnerabilities, it clearly presented the priorities of core threats that must be handled immediately and completed a decision-making system that allows security personnel to perform effective responses with limited resources.

Q. What are the three priority management tasks for 2026?

2026 will be a year of change and opportunity for Withnetworks. As asset and vulnerability management emerge as core tasks of security due to the government's strong security policy promotion, the market paradigm is shifting. First, the company aims to leap forward as a standard solution that complies with government security policies. Policies such as the Pan-Government Comprehensive Information Protection Measures and the N2SF guidelines all commonly emphasize the systematic management of IT asset identification and vulnerabilities. withVTM 3.0 can identify enterprise-wide assets including Shadow IT and integrate asset details and vulnerability information by automatically linking vulnerability checks.

Second, the company aims to expand its base in the public and enterprise markets through procurement registration. In the public sector, it will enhance customer accessibility through registration with the Public Procurement Service. In the enterprise market, it will strengthen its position as an integrated security management solution optimized for complex IT environments. The synergy between SIEM/SOAR operational expertise and withVTM 3.0 was put forward as a core competency. Additionally, plans to launch a new Threat Exposure Diagnosis service in 2026 were announced to support data-based security investment decision-making.

Third, the foundation for global advancement will be established, focusing on the Asian market. Based on the technology and success experience accumulated in Korea, the company will expand overseas customer contact points through channels such as cooperation with partners in the Asian region and participation in global conferences.

Q. What is the biggest change in the 2026 product and technology roadmap?

In 2026, Zero Trust and Security AI have been set as core focus areas. It was stated that withVTM 3.0 provides the foundation for Zero Trust implementation through asset identification and visibility including Shadow IT, and in 2026, the focus will be on implementing an asset-centric Zero Trust system that reflects the real-time security status and vulnerability information of assets. AI technology will also have its scope of application expanded in 2026 toward further advancing risk analysis and derivation of response priorities based on asset importance and vulnerability information.

Q. What is the most concerning security threat in 2026?

The most concerning threat in 2026 was identified as the expansion of intrusion risks due to a lack of asset visibility and inadequate internal privilege management. It was explained that as IT environments become more complex with cloud, containers, and remote work, the possibility of unidentified assets or excessive privileges acting as security blind spots increases. The core message of consecutive government policy announcements in late 2025 is to accurately identify IT assets and systematically manage their vulnerabilities.

Accordingly, companies and institutions must proactively build management systems centered on assets, privileges, and history beyond simply introducing individual solutions. It was emphasized that they must be able to make priority-based decisions by comprehensively understanding the vulnerabilities, exposure threats, and business impacts of each asset. Finally, it was explained that withVTM 3.0 provides integrated asset identification including Shadow IT, AI-based risk assessment, and evidentiary management. Furthermore, to meet the demand for checking the attack surface before solution introduction, the company will provide TEM services from 2026 to quickly identify externally exposed assets and vulnerabilities.

---

Original

DailySecu