Gaming / Game development
Krafton: Automating evidence collection, threat assessment and investigation reporting for security alerts
- Company
- Krafton
- Country
- South Korea
- Adoption stage
- In operation
- Source published
- Date basis
- The date the source was published. It can differ from the date adoption started.
- How the source was checked
- Read the full source text
The work problem
The Microsoft customer story says security events grew in scale and complexity as Krafton let employees freely use generative AI and coding tools. Staff had to distinguish development and testing from real threats. Investigating dozens of daily alerts manually took 20 to 30 minutes per incident, sometimes an hour.
Technology and data
When Defender XDR detects suspicious activity, Power Automate notifies staff through the internal messenger. Krafton's internal AI system collects network and process evidence and retrieves additional data around the incident when needed. AI roles representing attack, defense and neutral analysis debate findings, and multiple models cross-check results to distinguish threats from false positives. Security Copilot translates natural language into KQL queries. Humans decide final actions such as device isolation and blocking.
Results
According to Microsoft's story, alert recognition fell from 15 to 20 minutes to under one minute, and investigations fell from tens of minutes to about three. Report creation, previously about 30 minutes per case, became approximately 95% automated through an internal security operations dashboard. Security staff could focus on genuine threats and decisions rather than repetitive evidence gathering.
Limits and open questions
The measurement period, investigation count and threat-classification accuracy are undisclosed. The automation share does not establish a reduction in security staffing or total incidents.
Sources
- The platform approach to becoming FrontierMicrosoft, Accessed
- Krafton Achieves AI-Powered SecOps Automation with Microsoft Defender XDR and Security CopilotMicrosoft, Accessed
Compiled from public sources. These are not results from ATF Works customers.