FSI uses AI to detect 17 vulnerabilities across 50 apps, earns spot at international conference

The Financial Security Institute has developed an AI-powered technology that detected 17 security vulnerabilities across 50 mobile apps. The system analyzes not only an app's internal code but also the flow of information generated during actual execution — an approach that has earned recognition at a leading international software conference.

The institute announced Monday that research on its AI-based mobile app security risk detection technology had been accepted as a full paper at ISSTA 2026, the International Symposium on Software Testing and Analysis.

The key advance is the technology's ability to identify security risks that emerge while an app is running. Because mobile apps draw on external libraries and operating system functions in complex combinations, analyzing internal code alone can miss vulnerabilities that only surface during actual execution.

To address this, researchers developed a technique that comprehensively tracks and analyzes the behavior and information flows occurring while an app runs. Tests on 50 real mobile apps uncovered a total of 17 security vulnerabilities, confirming the technology's effectiveness.

The paper was led by Song Seong-hyeon, a team leader in the institute's AI Security Division, as first author. After passing a multi-stage review by experts from around the world, it was accepted in June as a full paper in the main research track of ISSTA 2026. Researchers presented their findings at the conference, held in California from Tuesday to Sunday. ISSTA is considered one of the four most prominent academic conferences in software engineering worldwide.

Building on the research, the institute plans to develop an AI-based inspection framework capable of precisely analyzing mobile app security risks and deploy it for security checks on financial-sector mobile apps. It also intends to continuously incorporate accumulated analysis results and new threat cases to further refine its detection technology.

The institute has been stepping up mobile app security inspections across the financial sector this year. In February, it announced plans to conduct vulnerability analysis and assessments on 288 mobile apps from 32 financial companies. The move reflects the growing importance of mobile security as the use of "super apps" — single apps that consolidate a wide range of financial services — has expanded across the industry. The institute said it will share inspection results with each financial company and provide consulting on the causes of vulnerabilities and how to address them.

"This research demonstrates that the Financial Security Institute has the specialized capability to study security threats directly and develop its own detection technologies," institute President Park Sang-won said. "We will continue to translate outstanding research into practical security tools that can be applied in real financial settings, providing meaningful support to help financial companies raise their security standards."