Project Plasma, a non-profit organization, has unveiled 'Project Canopy,' a public interest initiative aimed at spreading AI-based vulnerability defense throughout society. With the goal of strengthening the defense capabilities of public and livelihood infrastructure that lacks security capacity, 27 companies and organizations, including Dunamu and LG Uplus, have confirmed their participation as launch partners.

Project Plasma announced on the 17th that it officially launched Canopy.

This is based on the judgment that while the emergence of high-performance AI models has rapidly improved vulnerability detection capabilities, AI security threats are difficult for a single organization to respond to alone.

Canopy explained that it would extend the benefits of its AI-based vulnerability detection technology to the open source ecosystem and public infrastructure such as hospitals, schools, and public utilities.

Prior to the launch, inspections were conducted on the e-Government Standard Framework, internal school systems, Linux, and major database software as a pilot activity.

As a result, hundreds of high-severity vulnerabilities were discovered and reported to the relevant organizations and developers, and it is reported that patches are currently in progress.

Regarding the operational structure, the core operating entity, the Stewards Group, was composed of five or fewer companies and organizations.

Dunamu, LG Uplus, POSCO DX, Theory Korea, and Hanwha General Insurance are participating in Steward.

In addition, national and private CERTs, security vendors, and academia have joined as Defending Partners and Research Affiliates.

Canopy announced that it has secured AI security analysis credits worth approximately 3 billion won (USD 2 million) and will operate them entirely as donations.

We plan to transparently disclose and report the details of the execution.

Funding sources include: △open source programs that provide free vulnerability scan credits to open source project maintainers; and △public institutions, hospitals, schools, etc.It is used for the defense of public infrastructure that supports the public sector, as well as for the cooperation disclosure and patch reward program that rewards maintainers and white-hat hackers who participated in the vulnerability verification and patching process.

Chairman Park Se-jun stated, “While the speed at which AI finds vulnerabilities is the same for both attackers and defenders, the capacity to defend against and patch them varies unequally from organization to organization,” adding, “Canopy is a breakwater that combines technology, capital, and people from a public interest perspective to bridge that gap.”

Canopy added that it will enter a first governance process in mid-June to select targets for inspection and share reports and patches, and plans to open a public sign-up page for companies and organizations worldwide in early July.