Cyber Summit Korea (CSK) 2026. (Source: CSK 2026 Cyber Summit Korea Website)

APEX 2026: Enter the AI Hacking Defense Team

The emergence of an AI defense team that detects and responds to cyberattacks without human command

Recent advances in AI technology are transforming not only cyberattacks but also the methods of cyber defense.

In particular, during the international cyber exercise held in Seoul in September 2026, APEX 2026 (Allied Power Exercise), alongside traditional human-centered defense teams, an autonomous AI defense team participated in live cyberattack response training.

The name of this AI defense team is 'Project Phalanx'.

Rather than merely assisting security personnel, multiple AI agents collaborate to perform Threat Detection → Attack Analysis → Response → Recovery → Response Strategy Formulation, drawing significant attention.

1. What is APEX 2026?

First, let's look at APEX, the stage where the AI defense team made its debut.

APEX (Allied Power Exercise) is an international cyber exercise conducted to strengthen international cybersecurity cooperation and joint response capabilities.

According to the official APEX introduction, it began in 2024 and creates an environment similar to actual cyber warfare based on hypothetical inter-state conflict scenarios to train participating defense teams' response capabilities.

APEX 2026 was held in Seoul, with participation from NATO and Indo-Pacific countries.

According to public records, this exercise involved about 300 cybersecurity personnel centered around 23 countries, though there are minor differences in reporting depending on how participating institutions and countries are counted. Therefore, using the official event benchmark of '23 countries, ~300 participants' is appropriate here.

Key Changes in APEX 2026

What attracted particular attention at APEX 2026 was that, in addition to traditional human-centered defense teams, an AI-based Blue Team (Defense Team) participated.

Official APEX materials also explain that an AI-driven Blue Team was formed for the first time in 2026 to validate AI-based intelligent threat response and autonomous defense capabilities.

2. What Exactly is an 'AI Hacking Defense Team'?

To put it simply:

An AI hacking defense team is a defense system designed to move away from humans manually analyzing and responding to cyberattacks one by one, enabling AI agents to analyze security situations and perform response tasks automatically.

In traditional security operations, humans review alerts generated by various security systems.

For example,

Security Alert Generated

↓

Security Personnel Checks Logs

↓

Analyzes Whether It's an Attack

↓

Identifies Attack Path

↓

Decides Mitigation/Blocking Method

↓

Restores Systems

↓

Generates Report

—a process like this is required.

However, an AI defense team aims to automate a significant portion of this process using AI.

APEX 2026's Project Phalanx was introduced as a system where multiple AI agents collaborate to perform everything from threat detection to attack analysis, recovery, and response strategy formulation.

3. What is Project Phalanx?

The AI defense team at APEX 2026 was developed under the name 'Project Phalanx'.

According to public sources, personnel from the public, private, and military sectors—led by the National Cyber Security Center (NCSC) along with the Ministry of National Defense, National Security Research Institute, Stealien, Financial Security Institute, and others—participated, with Naver Cloud supporting the underlying development environment.

Development took approximately 4 months.

An important point here is that it does not refer to a single product from a specific company.

Project Phalanx is a collaborative project involving multiple institutions and specialists to verify autonomous cyber defense capabilities in a real training environment.

4. Why Are 'AI Agents' Important?

Let's consider the difference between traditional AI and AI agents.

Suppose you ask a standard AI the following:

"Find anything unusual in this security log."

The AI can analyze the log and present the results.

However, AI agents go one step further.

For example,

① Anomaly Detection

↓

② Further Investigation of Related Logs

↓

③ Analysis of Attack Probability

↓

④ Identification of Affected Systems

↓

⑤ Determination of Response Actions

↓

⑥ Execution of Necessary Actions

↓

⑦ Verification of Results

↓

⑧ Report Generation

—they can perform multiple tasks sequentially to achieve a goal.

This is why the AI defense team at APEX 2026 drew so much attention.

Rather than being a simple 'AI Security Analysis Tool', it verified in an operational environment a model where multiple AI agents collaborate to execute the entire cyber defense process.

5. What Did the AI Defense Team Actually Do?

At APEX 2026, the AI defense team participated in exercises to defend against real-time cyberattacks under the exact same conditions as other allied defense teams.

Its primary roles can be summarized as follows:

① Threat Detection

Analyzes various system events and detects anomalies suspected to be attacks.

For instance, if an unusual access pattern is detected on a specific server, it can analyze additional related data.

② Attack Analysis

It doesn't stop at simply determining that "an attack has occurred."

It analyzes where the attack originated, which systems were affected, and more.

③ Response

Executes necessary defensive measures according to the attack scenario.

One crucial concept here is automation.

Instead of humans manually verifying and responding to every event, the goal is for AI to rapidly analyze and respond to the situation.

④ Recovery

The process of restoring systems affected by attacks to a normal state is also included in its scope.

⑤ Response Strategy Formulation

It includes analyzing the likelihood of future attacks and developing mitigation strategies, rather than just stopping the current attack.

In other words,

Detection → Analysis → Response → Recovery → Strategy Formulation

—the entire cycle is designed to be executed by AI.

6. Collaboration Among Multiple AI Agents is Key

One key characteristic of Project Phalanx is that multiple AI agents collaborate.

It is easier to understand if you don't think of it as a single AI handling everything.

Instead, it is similar to multiple security experts dividing up roles.

Conceptually, you can think of a structure like this:

Detection Agent

→ Identifies anomalies

Analysis Agent

→ Analyzes attack type and root cause

Response Agent

→ Executes required defense measures

Recovery Agent

→ Restores affected systems

Reporting Agent

→ Summarizes response results

In this setup, these AIs exchange information with each other and operate as a unified defense team.

Media coverage of APEX also highlighted Project Phalanx executing the full defense process through collaboration among multiple AI agents.

7. What Kinds of Attacks Were Defended Against?

The scenarios at APEX 2026 did not involve simple attacks on a single computer.

Set against a backdrop of a hypothetical inter-state geopolitical conflict, critical national infrastructure was targeted.

Major targets included:

• Power Grids

• 5G Telecommunication Networks

• Healthcare Networks

• Subway Systems

• Maritime Vessels

In short, it simulated cyberattack scenarios targeting the essential infrastructure required for real-world society to function.

8. Why is AI Defense for Infrastructure Important?

The scope of impact differs dramatically between attacks on standard websites and those on critical national infrastructure.

For example, issues in the power system can disrupt electricity supply.

Issues in healthcare systems can impact hospital operations.

If transportation systems are compromised, the potential for physical accidents must also be considered.

APEX 2026 reflected these real-world conditions by utilizing an environment that simulated protocols and control systems used in actual industrial settings.

Therefore, the significance of the AI defense team in this exercise goes beyond simply "Can AI stop hacking?".

The more critical question is:

How quickly and reliably can AI defend complex, interconnected national infrastructure?

.

9. How APEX Differs from Traditional Hacking Competitions

APEX differs in nature from competitions that simply judge who defended more systems.

In a report by Boan News, an APEX official stated that the goal of the exercise was sharing real-world experience and strengthening international coordination capabilities.

For example, when one defense team discovered a threat, the exercise included sharing related information with other allied defense teams to execute a joint response.

This aligns directly with the characteristics of real-world cyberattacks.

Cyberattacks easily transcend international borders.

Information on an attack discovered in one country can help inform cyber defenses in another.

Therefore, in future cyber defense,

individual organizational defense capabilities

as well as

cross-border threat intelligence sharing and joint response

will become increasingly essential.

10. APEX 2026 Also Included 'Non-Technical Response'

Another notable aspect of this exercise was that it did not focus solely on technical hacking responses.

APEX 2026 introduced a non-technical track incorporating cognitive warfare and legal response for the first time.

For example, in a simulated attack scenario accompanied by disinformation campaigns, defense teams were required not only to analyze technical attack causes but also to address media relations and legal considerations.

This approach reflects the reality that modern cyberattacks do not target computer systems alone.

11. Why We Need AI Defense Teams

So why leverage AI for cyber defense?

One of the main reasons is speed and scale.

It is difficult for humans to inspect every event occurring across countless systems simultaneously.

However, AI systems can analyze large volumes of data extremely fast.

Particularly when attacks are automated, defense needs to be automated as well.

For instance, if an attacker uses AI to quickly scan for numerous vulnerabilities, human-only analysis will leave defenders with insufficient response time.

South Korea's National Intelligence Service (NIS) also explained that AI accelerates attackers' ability to identify vulnerabilities and launch attacks, posing limits to traditional security systems alone.

12. Will AI Completely Replace Humans?

Based on the stated goals of APEX 2026, the emphasis is on validating a human-AI collaboration model rather than replacing humans entirely.

The NCSC similarly explained that the objective is to overcome defenders' structural limitations through zero-trust-based AI automated response, while identifying the optimal human-AI collaboration model for future cyber battlefields.

To put it simply:

Human

• Overall situational judgment

• Critical decision-making

• Policy and accountability assessment

• Final judgment in complex scenarios

AI

• Large-scale data analysis

• Anomaly detection

• Repetitive investigation

• Rapid response

• Response process automation

In short,

this showcases a shift from humans commanding AI or AI assisting human judgment toward a structure where AI carries out actual defense operations while humans provide oversight and critical judgment

.

13. The Relationship Between 'Zero Trust' and AI Defense

An important concept frequently mentioned alongside Project Phalanx is Zero Trust.

Put simply, Zero Trust is a security philosophy that means:

"Do not trust blindly just because something is internal."

.

Instead of automatically trusting users or devices simply because they are on the internal network, it applies necessary verification and the principle of least privilege every time access is requested.

When combined with an AI defense team, it can evolve into a framework where AI continuously verifies access and activity while analyzing security events to automate necessary responses.

APEX officials explained that combining AI automated response with zero-trust defense aims to overcome defenders' structural limitations.

14. Why This Exercise Matters

Understanding the AI defense team at APEX 2026 simply as "AI stopped hacking" misses the core point.

The more significant takeaway is that AI has begun entering operational, real-world cyber defense.

Prior use of AI in security primarily looked like this:

Before AI

Security System
↓
Alert Generated
↓
Human Analysis
↓
Human Response

AI-Assisted Security

Security System
↓
AI Analysis
↓
Human Judgment
↓
Human Response

Direction of Autonomous AI Defense

Security System
↓
AI Detection
↓
AI Analysis
↓
AI Response
↓
AI Recovery
↓
Human Oversight and Critical Decision-Making

Project Phalanx can be seen as an example of validating this third direction in a real-world international cyber drill environment.

15. However, New Challenges Emerge in AI Defense As Well

Just because AI stops attacks doesn't mean all problems are solved.

Rather, once AI starts directly accessing networks and systems to perform response actions, the security and control of the AI itself becomes critical.

For example, issues like the following can arise:

What if the AI misjudges?

It could mistake legitimate users for attackers and block their access.

What if the AI is manipulated by attackers?

We must consider the possibility that attackers could feed false information to the AI, leading it to make wrong decisions.

What if we grant the AI too much authority?

If the AI is compromised, the scope of damage could expand significantly.

What if the AI is connected to multiple systems?

We must also manage the risk of an issue in a single AI agent spreading to other systems.

Therefore, the key to AI defense is not simply "granting broad permissions to the AI."이 아닙니다.

Instead,

least privilege

verification

audit logging

behavioral restrictions

human oversight

and similar safeguards must be designed together.

16. The Race Between AI Attacks and AI Defense

This is a key aspect to understand regarding cybersecurity in the AI era.

Attackers can use AI, and defenders can use AI as well.

Attacking Side

Using AI to

• Vulnerability scanning

• Exploit code analysis

• Phishing text generation

• Target system analysis

• Attack automation

They can execute these tasks rapidly.

Defending Side

Using AI to

• Anomalous behavior detection

• Log analysis

• Attack vector analysis

• Threat intelligence analysis

• Automated response

• Incident report generation

They can automate these processes.

Ultimately, future cybersecurity

is likely to evolve from a human-versus-human structure into a security environment where humans and AI, as well as AI and AI, participate together.

으로 발전할 가능성이 있습니다.

The debut of the AI defense team at APEX 2026 is meaningful in that this shift is moving beyond lab experiments and being validated in actual international cyber exercises.

17. The Future of Cyber Defense Demonstrated by APEX 2026

This case can be summarized in one sentence as follows:

"We are moving from an era where AI analyzes security to an era where AI directly executes security operations."

In the past, we asked AI,

"Is this log anomalous?"

라고 물었다면,

In the future, we will assign operational goals to AI, saying,

"Securely defend this system, and if anomalies are detected, take the necessary response actions."

This marks a shift toward delegating actionable tasks to AI.

This is precisely AI agent-based cybersecurity's core takeaway.

18. What Does This Mean for Everyday Users?

Although APEX 2026 is a national cyber defense exercise, it also holds significance for everyday users.

This is because AI-based security technologies are increasingly likely to be applied to the everyday services we use.

For example,

• Automated detection of login anomalies

• Blocking suspicious account activity

• Automated detection of phishing messages

• Behavioral analysis of malware

• Detection of abnormal access to personal data

• Automated security monitoring for internal enterprise systems

AI can be utilized in these areas.

Conversely, users must remember that when using AI, the AI itself can become a new attack target.

Particularly as AI agents gain access to emails, files, work systems, and cloud services, what privileges we grant to the AI becomes a critical security issue.

19. What to Focus On Going Forward Isn't Just the 'AI Defense Team'

Understanding the significance of Project Phalanx simply as

"AI blocked hacking attacks."

is not enough.

The more important shift is that the level of security operations automation is rising.입니다.

In the future, the following stages may unfold:

Stage 1

AI analyzes security data.

↓

Stage 2

AI assesses the likelihood of an attack.

↓

Stage 3

AI proposes response strategies.

↓

Stage 4

AI automatically executes limited responses.

↓

Stage 5

Multiple AI agents collaborate to operate as a unified defense team.

↓

Stage 6

Humans oversee the AI defense team and handle critical decisions.

APEX 2026 is a real-world exercise that tested the feasibility of these advancements in an international cyber drill environment.

20. Conclusion

Unveiled at APEX 2026, Project Phalanx serves as a case validating whether AI can move beyond a passive assistant tool to perform cyber defense duties itself.

Developed over roughly four months through a public-private-military collaboration led by the NIS National Cyber Security Center, the AI defense team was designed to carry out threat detection, attack analysis, response, recovery, and strategy formulation through multi-agent collaboration.

Furthermore, the international exercise utilized simulated cyberattack scenarios targeting critical national infrastructure, including power grids, 5G networks, healthcare, subways, and maritime vessels.

The core takeaway from this case is simple.

AI is no longer just a technology for generating cyberattacks, but is evolving into a technology for defending against them.

And going forward, the key question

"Will AI be better at security than humans?"

is not likely to be that, but rather,

"How will humans and AI divide roles to build a safer cyber defense system?"

가 될 가능성이 큽니다.

The AI defense team at APEX 2026 can be seen as a real-world experiment aimed at finding the answer to this very question.

Please refer to the Cyber ​​Summit Korea (CSK) 2026 website (https://cybersummit.kr)