From AI Portal to Security Monitoring, kt cloud's 3 Cases of Internalizing AI

Before proposing AI to customers, kt cloud built and operated three in-house cases—AI Portal, AI Security Monitoring, and AI Incident Monitoring—using a dog-fooding approach, applying AI to internal work first. The core focus wasn't technical demonstration but solving real bottlenecks and, first, establishing an evaluation framework to verify outcomes numerically.

AI Portal unified knowledge scattered across Jira/Wiki, Salesforce, and internal document servers into a single search bar. It has a 3-Layer structure divided into Data Sources, Application(Docker/VM), and LLM Layer, connecting a pre-indexing pipeline that parses and vectorizes documents in advance with a LangGraph-based AI-Portal Core, a Slack Bot, and a Vector DB. By pre-processing instead of searching at query time, it achieved near-real-time response speed, and based on the judgment that RAG quality heavily depends on the quality of retrieved documents, time was invested in document parsing and indexing strategy. For areas like legal documents requiring text-centric, Korean-specialized handling, Solar Pro 2 was used, while GPT-4o was used in parallel for areas requiring multimodal capability. As a result, Ask AI Portal has become a standard workflow.

AI Security Monitoring started from the problem that the difficulty of writing Splunk's SPL was blocking monitoring quality. When a monitoring agent queries in natural language, Claude Agent identifies the intent, and a custom-built MCP Server converts this into SPL to search Splunk, then analyzes the results again to return insights. By combining attack event response, threat blocking recommendations, and history-based analysis into a single flow, even junior monitoring agents can now perform complex log analysis immediately.

AI Incident Monitoring was designed as a 5-stage workflow based on User Stories to reduce variance in response quality caused by differences in skill level. RAG presents similar cases and guidance at each stage: situation awareness, situation sharing, situation judgment/response, anomaly/incident notification, and incident response. Mock training scenarios evaluated Down Events, NW failures, event collection failures, and Cloud console access failure VoCs, and the group with 1-3 years of experience (less skilled) saw scores rise by 23-24% after using RAG. The accuracy gap between experienced and less-experienced responders also decreased by 40%.

The common lessons from these three cases are clear.

• Evaluation framework comes first.
• AI should be woven into already-familiar environments like Slack, Splunk, and monitoring workflows.
• It's more efficient to use different models depending on the use case—Solar Pro 2, GPT-4o, and Claude.

kt cloud is now expanding this in-house experience to customer environments through AI Foundry.