etc.[VisualPro Tech Brief] Why Security Project Data Can't Go Into an External LLM, Even Under a Private Contract

VisualPro Tech Brief

Dark green illustration: inside a dashed boundary marking the organization's internal network, a shield holding a padlock and a neural network (the on-premise LLM); the transfer of classified and sensitive data to an external LLM cloud outside is shown as blocked

Why Security Project Data Can't Go Into an External LLM, Even Under a Private Contract

Companies working on national security and defense projects have to ask where the computation happens before they use generative AI

VWAY Tech Brief · Oct 27, 2026 · 7 min read

On-premise LLMGenerative AI securityN²SF grades C·S·ODocument search (RAG)VisualPro MCP

Oct 27, 2026

01Summary

A private enterprise contract with an external LLM can get you a promise that "your input data will not be used for training." Your questions and documents, however, are still processed on servers outside your organization. Korea's National Intelligence Service (NIS) Security Guidelines for Generative AI (2023) state that AI used for an organization's internal work must be separated from external networks such as the internet, and that training data and user queries may not move directly outside the organization. Under the National Network Security Framework (N²SF), whose official version came out in September 2025, published deployment cases show classified (C) and sensitive (S) files being blocked from external generative AI. So if you want AI to work with the core documents of a security project, an on-premise LLM that runs the model inside the organization becomes the realistic option. This article separates what a contract can solve from what it cannot, and sets out where to start preparing an on-premise LLM.

02"Not used for training" and "never leaves the building" are different questions

The first clause security officers usually check in an external LLM contract is the ban on reusing data for training. That clause matters, but security project rules ask one more question: where is the data at the moment it is processed?

Section 4.2 of the NIS guidelines describes the use of AI models for an organization's internal work as follows.

"Internal business systems that apply and use AI models must be operated separately from external networks such as the internet."
When the organization builds the system itself, "organizational data used to train AI models, and data generated during development and operation such as user queries and outputs, may not move directly outside the organization." An exception applies when network separation safeguards are kept, such as using a secure network linkage system whose security is assured.
For internal administrative work that uses the cloud, it states that "related technologies delivered as internet-based services may not be used."
The first line of the user security rules in the appendix is "Do not enter sensitive information (non-public information, personal information, etc.)."

These guidelines are written for national and public institutions, but security projects carried out by companies also follow the security rules of the contracting agency, so companies face the same question.

A ban on training reuse is a promise about "what happens after processing." What the rules forbid is "sending data out in order to process it" in the first place. However good the contract terms are, they cannot answer the second question.

How the external LLM is used	What a contract or setting can solve	What it cannot solve
General chat service	Turning off chat history and training	Data is sent to external servers
Private enterprise contract	No training reuse, retention period and deletion, access control	Queries and documents are processed outside the organization
Dedicated cloud environment or in-country region	Processing location (country) and isolation level	Still an internet-based service outside the organization's network
On-premise LLM (run directly on the internal network)	Processing happens inside the organization	The organization is responsible for the model, servers and operation

In short, a private contract is a way to reduce the risk of an external service, while an on-premise LLM is a way to make sure the data never leaves the organization. What security project rules require is usually the latter.

Diagram comparing two cases: inside the organization's internal network, an on-premise LLM processes security project documents and user queries; under a private contract, queries and documents are sent to an external LLM server outside the organization

Where the data is processed: private contract vs. on-premise LLM

03What N²SF opened up, and what it did not

The National Network Security Framework (N²SF), whose official version the NIS released in September 2025, is meant to move beyond blanket physical network separation so that AI and cloud services can be used. It classifies business information as classified (C), sensitive (S) or open (O) and applies different security controls to each grade.

For generative AI, it is clear which door is open and which is closed. The official version treats generative AI as one of its information service models, and according to a description of a deployment case published in October 2026, even a sensitive (S) business network can connect to open (O) grade generative AI services approved by the organization. Only O-grade files may be sent, however; C- and S-grade files are blocked.

In other words, even after N²SF the division remains: work on open information can go to external AI, while work on classified or sensitive information stays inside the organization. At companies carrying out security projects, the work that most needs AI help is usually the second kind.

Reviewing and summarizing project requirements, design documents and test procedures
Finding similar cases and defects in past project documents
Querying configuration and change history and design rationale
Reviewing and documenting internal code

Where generative AI processing happens for each N²SF grade

04The defense industry is moving even more cautiously

This is not only about public-sector rules. According to a January 2026 news report, Korea's Defense Acquisition Program Administration (DAPA) sent defense companies a notice warning of hacking attacks that use generative AI, asking them to block generative AI on work computers and, where its use is unavoidable, not to enter sensitive information (this is based on the report; the notice itself has not been published).

On top of this come the security pledges signed with the contracting agency for each project, security audits and project-specific security grades. For people doing the work, it is hard to judge case by case whether "this document can go into an external AI," and the easy answer becomes not using AI at all. To keep security and still get help from AI, the realistic way is to keep the AI for classified and sensitive work inside the organization.

05Where to start preparing an on-premise LLM

Building an on-premise LLM does not start with buying GPU servers. Data and tasks come first.

01Classify your data first.

Work out which documents fall under C, S or O, and what the project security grade and the contracting agency require. There is no need to run O-grade work on the on-premise LLM. The scale is set only once the scope that stays inside is set.

02Narrow the tasks you give to AI.

Instead of "AI for every task," start with two or three tasks whose effect you can measure, such as document search and summarization, checking requirements against test items, or code review.

03Choose the model and license.

Among open-weight models that can run inside the organization, look at Korean-language performance, commercial use terms and the compute they need together. This is also when you decide how model files and updates are brought into the internal network (network linkage and inbound inspection).

04Add document search (RAG) and access rights.

The value of an on-premise LLM comes less from the model itself than from finding internal documents and answering with evidence. Each document's access rights must apply to the answers as well. If content from documents outside a user's rights leaks into an answer, you have added one more internal leakage path.

05Validate against the same criteria.

Fix an evaluation set built from real work data and compare the on-premise LLM with an external reference model on the same dataset and the same criteria. People will only use it once you show in numbers that it is "not worse than the external model."

06Prepare operations and the security review.

Decide how query and response logs are kept, how access is controlled and how the model is updated; for public projects, check whether the system is subject to the NIS prior security review (National Information Security Basic Directive, Article 15(1)19).

06What to check tomorrow

Who	What to check
Security officer	Which of our project documents cannot go into external AI? Is that line written down?
Security officer	Beyond "no training reuse," what does our current external AI contract guarantee about "where data is processed"?
Business and engineering leads	Which three tasks would AI save the most time on, and what data grade do those tasks handle?
IT and infrastructure	Do we have space, power and an inbound process for compute servers on the internal network? How will model update files come in?
Executives	Is "not using AI" our security policy, or just the result of having no alternative?

07Closing

A contract that promises not to train on your data only makes external AI safer; it cannot replace the rule that classified and sensitive data must stay inside the organization. For companies carrying out security projects, the starting point for generative AI is not "which service should we sign up for" but "which data has to stay inside."

VWAY has built on-premise LLMs with document search (RAG) on customers' internal networks and validated their performance against external reference models on the same dataset and the same criteria. We also connect our safety analysis tool VisualPro to an on-premise LLM through MCP, so that engineers can ask about design rationale and change impact in natural language. If you want to start by sorting out data grades and target tasks together, ask us for an on-premise LLM consultation.

08Frequently asked questions

Q1If we have a private contract with an external LLM, can't we put security project data into it?

You can get a ban on training reuse, but the data is still processed on servers outside the organization. The NIS guidelines require AI for internal work to be separated from external networks and queries and training data not to move directly outside the organization. Classified and sensitive data therefore needs a separate decision regardless of contract terms, and most security projects do not allow it. Follow your project's security rules and the contracting agency's standards for the final decision.

Q2Once N²SF is in force, can't we use generative AI freely?

N²SF opened the use of approved generative AI for open (O) grade information. It blocks classified (C) and sensitive (S) information from being sent to external generative AI. To use AI for classified or sensitive work, you still need a setup that processes it inside the organization.

Q3Isn't an on-premise LLM much weaker than the latest external models?

General conversational ability can differ. But when you narrow the task and add internal document search (RAG), it can match or beat external models on specific tasks. What matters is comparing the on-premise model and an external reference model on the same criteria, using an evaluation set built from real work data.

Q4Once we build an on-premise LLM, can we use it on classified documents right away?

Running it inside the organization is not the end of it. You also have to decide whether each document's access rights apply to the answers, how query and response logs are kept, and how model update files are brought in. For public projects, you also need to check whether it is subject to the NIS prior security review.

Q5Where should we start?

Classifying data grades and choosing target tasks come first. Once you separate open work that external AI can handle from classified and sensitive work that must stay inside, the scope and the scale of the on-premise LLM follow.

References
· National Intelligence Service and National Security Research Institute, Security Guidelines for the Use of Generative AI such as ChatGPT (in Korean), distributed June 29, 2023 (Section 4.2, considerations when adopting generative AI by deployment type, pp. 40-41; appendix security rules, p. 52)
· National Intelligence Service, National Network Security Framework (N²SF) Security Guidelines 1.0, official version released September 30, 2025 (reported by Byline Network, September 30, 2025) — Byline Network article
· AhnLab, "Business Network Security in the AI Era: Deployment Cases under the N2SF Adoption Support Program" (in Korean), October 12, 2026 — description of information service model 2 (generative AI)
· Herald Business, "[Exclusive] DAPA Sends Defense Companies a Notice Warning of 'Generative AI Hacking'" (in Korean), January 27, 2026 — article

※ This article is general information based on published guidelines and news reports. Whether AI may be used on a specific project depends on that project's security rules and the contracting agency's decision. Quotations from Korean-language guidelines and reports are VWAY's translations.

An on-premise LLM that fits your security projects

We can help from classifying data grades and choosing target tasks to building an on-premise LLM with document search (RAG) and connecting VisualPro through MCP.

VWAY Co., Ltd. | sales@vwaycorp.com

Website | On-premise AI (RAS AI) | VisualPro AI (MCP connection)

Back to list

Newsroom

Technical Resources