RedCastle V6.0 Common Criteria EAL4 for Windows Server 2025 R3 Security

SGA Solutions said on June 24, 2026, that its RedCastle V6.0 for Windows Server 2025 R3 server security product earned Common Criteria certification at Evaluation Assurance Level 4, positioning the Korean vendor for public-sector, defense, finance, and AI infrastructure security projects. The certification is not just another compliance badge; it is a signpost for where server security is moving as governments try to reconcile cloud adoption, generative AI, and zero-trust architecture with old assumptions about network separation. RedCastle’s pitch is that security policy belongs closer to the operating system kernel, not merely at the network edge. That is a familiar claim in security marketing, but in Korea’s current public-sector moment, it has unusually concrete policy consequences.

RedCastle Wins a Badge That Matters Because the Perimeter Is Losing Authority​

Common Criteria certification can sound like the driest possible product milestone: a vendor, an evaluation level, a version number, and a government-facing acronym soup. But EAL4 is meaningful in markets where procurement depends on formal assurance, especially when the buyer is a national or public institution that cannot simply accept a vendor’s word that access controls and audit mechanisms behave as advertised.
The product at the center of the announcement, RedCastle V6.0 for Windows Server 2025 R3, is not being sold as a general-purpose antivirus or a dashboard-first security suite. It is a server security product built around SGA Solutions’ secure OS technology, with functions including server access control, account and privilege management, audit logging, and tamper prevention. Its key architectural claim is that it controls access permissions at the operating system kernel level and applies server-specific security policies to block unauthorized access to important assets.
That kernel-level positioning is the interesting part. Security buyers have spent the last decade buying network appliances, endpoint agents, identity platforms, cloud posture scanners, and detection products that promise to see everything. RedCastle’s message is more old-school and more intimate: protect the server where the sensitive workload actually runs, and make unauthorized movement difficult even after a user, credential, or network path has been compromised.
For WindowsForum readers, the Windows Server 2025 angle is not incidental. Windows Server remains deeply embedded in regulated enterprise and government estates, and new server releases create a familiar lag between platform availability and validated security tooling. SGA Solutions is explicitly saying its certified release operates stably in the latest Windows Server 2025 environment while meeting Korea’s National Security Requirements V3.0. In public procurement, that combination can be more valuable than a splashy feature demo.

EAL4 Is Not Magic, But It Changes the Procurement Conversation​

Common Criteria has always lived in the uneasy space between engineering assurance and bureaucratic necessity. It does not prove that a product is invulnerable, and it does not mean a deployment will be configured well. What it does provide is a structured evaluation against a declared security target, giving risk-sensitive buyers a basis for saying that a product’s claims were examined under a recognized scheme.
EAL4, in particular, is often described as “methodically designed, tested, and reviewed.” That phrase matters less as a slogan than as a signal of evaluation depth. It suggests the product was not merely scanned or self-attested, but subjected to a documented review of design and testing evidence. For national agencies and enterprises operating under formal security requirements, that can be the difference between a product being interesting and a product being purchasable.
This is why SGA Solutions’ announcement is less about RedCastle suddenly becoming secure on June 24 and more about RedCastle becoming easier to justify inside tightly governed environments. Public-sector security teams rarely lack awareness of threats; they lack permission to adopt tools that do not fit recognized assurance pathways. A CC EAL4 certificate helps translate a vendor’s technical story into the language of audits, procurement committees, and compliance reviews.
There is a limit to that translation. Certification evaluates a defined version and configuration, not every future patch, deployment pattern, or integration choice. A certified server control product can still be undermined by poor policy design, excessive administrator exceptions, unmanaged service accounts, or a logging pipeline nobody reviews. But in government and defense, the absence of certification can stop a product before those operational questions are even asked.

Korea’s N2SF Shift Gives Server Controls a New Job​

The timing of SGA Solutions’ announcement is what turns a certification item into a broader industry story. Korea’s National Network Security Framework, known as N2SF, is part of a shift away from treating physical network separation as the default answer to sensitive public-sector computing. The new model classifies information and systems by importance and sensitivity, then applies differentiated controls instead of assuming that isolation alone can satisfy modern demands for cloud, AI, and data collaboration.
That is a profound policy change. Traditional network separation was simple to explain and hard to live with: keep important systems apart, reduce connectivity, and accept the operational friction as the cost of security. AI and cloud adoption stress that model because value increasingly comes from controlled connection, not permanent disconnection. Data needs to move, models need to query it, analysts need to collaborate, and public institutions want access to modern services without treating every integration as an exception.
N2SF does not eliminate the need for segmentation. It changes the basis of segmentation from physical topology to risk, identity, data sensitivity, and policy enforcement. In that world, a server control product such as RedCastle is no longer just a hardening tool; it becomes part of the machinery that makes differentiated trust possible.
Microsegmentation is the vocabulary SGA Solutions is reaching for, and that choice is deliberate. The phrase is used broadly enough in the security industry to cover workload isolation, host-level controls, east-west traffic restrictions, and policy-defined access boundaries. RedCastle’s server-level enforcement does not, by itself, replace network microsegmentation. But it speaks to the same problem: once environments become more connected, the blast radius of any compromised account, system, or service must shrink.

AI Makes the Old Server Security Story Newly Urgent​

The company’s explicit link between RedCastle and AI security is not just opportunistic branding, though there is certainly some of that. Generative AI and large language models change the economics of data exposure. A database, file server, training corpus, model host, or inference endpoint may now contain material that is not merely sensitive in isolation but valuable because it can be aggregated, mined, summarized, or used to improve a model.
That makes server-level access control more important, not less. Many AI security conversations focus on prompt injection, model theft, data leakage through chat interfaces, and governance over what employees can paste into public tools. Those are real issues. But the less glamorous layer is still the server estate where source data, embeddings, logs, vectors, credentials, and model artifacts live.
If an organization is building AI workflows on top of Windows Server workloads, SQL databases, file shares, internal APIs, and hybrid cloud connectors, the question becomes brutally practical: who or what can touch the data, under which privilege, from which process, and with what audit trail? A network rule may say a subnet can talk to a server. A server-level policy can decide whether that connection should result in meaningful access.
SGA Solutions’ CEO, Choi Young-cheol, framed the issue around the rising value of data in AI- and cloud-centered IT environments, arguing that server-level security control and microsegmentation are becoming essential rather than optional. That is exactly the market narrative many security vendors are now chasing. The difference is that RedCastle’s CC certification gives SGA Solutions a more procurement-friendly way to make that claim in Korean public and regulated markets.

Windows Server 2025 Becomes the Test of Security Vendor Readiness​

Windows Server 2025 is not merely a version label in this story. It is the compatibility boundary that separates vendors still tuned for yesterday’s government server baseline from those trying to stay aligned with the next refresh cycle. Enterprises do not jump server operating systems casually, but public and regulated sectors eventually need validated tooling before they can plan migrations with confidence.
Security software that operates close to the kernel has a harder compatibility problem than products that sit outside the operating system and observe from a distance. Kernel-level enforcement can be powerful, but it must coexist with platform changes, driver models, patching behavior, and Microsoft’s own security architecture. A product that claims to control access at that layer must prove not only that it blocks what it should block, but also that it does not destabilize the systems it is meant to protect.
That is why the “operates stably in the latest Windows Server 2025 environment” claim deserves attention. Stability is not glamorous, but it is often the first buying criterion for server-side controls. A sysadmin will forgive a security product for having an ugly console before forgiving it for taking down a domain controller, database server, or line-of-business application.
For Windows shops, this also revives a familiar tradeoff. The deeper a product integrates with the OS, the more precise its enforcement may become, but the greater the burden on testing, change management, and vendor trust. A CC-certified release helps with assurance, but IT teams still need staged rollouts, rollback plans, performance baselines, and policy simulations before putting kernel-adjacent controls in front of mission-critical workloads.

The Public Sector Is the Beachhead, but Finance and Enterprise Are the Prize​

SGA Solutions is clear about its route to market: use certification to strengthen public-sector sales, respond to N2SF and zero-trust requirements, and then expand into finance and large enterprise data-server security as generative AI and LLM adoption widens. That is a sensible sequence. Public and defense customers create credibility, and regulated industries often follow once a security architecture is validated in demanding environments.
Finance is a particularly logical target. Banks, insurers, securities firms, and payment companies already operate under layered access controls, audit requirements, and strict data governance. They also have strong incentives to adopt AI for fraud detection, customer service, software development, risk modeling, and internal knowledge retrieval. Every one of those use cases creates pressure to connect more data to more systems without relaxing control over privileged access.
Large enterprises face a similar problem but often with messier estates. They may have legacy Windows Server workloads, Linux fleets, cloud-native applications, outsourced operations, fragmented identity systems, and multiple generations of security tooling. In that environment, a server security product must do more than enforce a rule. It must fit into an operating model that includes IAM, PAM, SIEM, EDR, vulnerability management, change control, and business continuity.
This is where SGA Solutions’ opportunity and challenge converge. RedCastle’s feature set maps neatly onto the needs of regulated environments: access control, account management, privilege control, audit logs, and tamper prevention. But the broader enterprise market will ask whether it integrates cleanly, scales predictably, and reduces operational risk rather than adding another policy silo.

Microsegmentation Is Becoming a Workload Problem, Not Just a Network Design​

Security teams once talked about segmentation primarily in terms of VLANs, firewall zones, and routed boundaries. That model still matters, but it does not map cleanly onto hybrid cloud, containerized services, remote administration, SaaS integrations, and AI pipelines that move across traditional network lines. The attack surface has become more fluid than the network diagrams.
Microsegmentation emerged as a response to that mismatch. Instead of assuming that everything inside a segment can trust everything else, organizations define narrower trust relationships around workloads, identities, applications, and data flows. The goal is not to make the network beautiful. The goal is to prevent one compromise from becoming an estate-wide incident.
RedCastle’s role in that conversation is host-centric. If policies are enforced on or near the server, access decisions can become more granular than a network path alone. That matters when the same server may host sensitive services, administrative interfaces, scheduled jobs, and data repositories used by AI workflows. A firewall can limit who reaches the machine; server controls can limit what they are allowed to do once they arrive.
The risk is that microsegmentation becomes a magic word pasted onto every control product. True microsegmentation requires discovery, policy modeling, exception handling, monitoring, and continuous maintenance. A server agent can be a critical enforcement point, but it is not a strategy by itself. The strongest version of SGA Solutions’ argument is not that RedCastle is zero trust, but that zero trust cannot work if important servers remain governed by broad, static, administrator-heavy access assumptions.

The Kernel-Level Claim Cuts Both Ways​

Kernel-level control is a serious architectural promise. It suggests that RedCastle can mediate access below ordinary application logic and resist some forms of bypass that would defeat higher-level controls. For privileged access management and tamper prevention, that lower vantage point can be valuable.
But deep control also increases the stakes. Kernel-adjacent security software must be exceptionally well engineered, because defects can affect availability and because attackers prize weaknesses in privileged components. The history of endpoint and server security is full of products that improved protection in one dimension while expanding the trusted computing base in another.
That does not undercut RedCastle’s certification; it explains why certification matters. Evaluation is especially important when a product is designed to sit in a powerful position. Buyers need confidence not only that the product can block unauthorized activity, but that it will behave predictably under load, during patching, and when administrators make inevitable mistakes.
For sysadmins, the practical questions are straightforward. How are policies tested before enforcement? How are emergency access scenarios handled? How are logs protected from tampering? How does the product interact with Microsoft security features, domain policies, and existing privilege management systems? A certificate opens the door, but these deployment questions decide whether the product becomes a control plane or a future outage report.

Certification Gives SGA Solutions a Domestic Advantage, Not a Global Guarantee​

SGA Solutions is playing to a market it understands. Korea’s public and defense sectors value domestic references, formal assurance, and alignment with national policy. A Korean vendor that can speak directly to N2SF, national security requirements, and local procurement structures has an advantage that a global vendor may struggle to match without a local partner.
That advantage is not automatic outside Korea. In global enterprise markets, RedCastle would face competitors from privileged access management, endpoint privilege management, workload protection, zero-trust segmentation, and cloud security posture categories. International buyers may care less about Korean CC certification unless it maps to their own compliance needs. They may also already be committed to security platforms from Microsoft, CrowdStrike, CyberArk, Illumio, Akamai, Palo Alto Networks, or other entrenched vendors.
Still, the domestic advantage is strategically meaningful. Security markets often globalize from a strong regulated base. A vendor that proves itself in public-sector deployments gains references, operational lessons, and credibility that can later be translated into adjacent markets. If N2SF adoption accelerates as expected, vendors that solved early implementation pain may become disproportionately influential.
The open question is whether RedCastle remains a specialized server hardening product or becomes part of a broader zero-trust control fabric. The former can be a durable business in regulated markets. The latter is a much bigger ambition and requires partnerships, integrations, policy orchestration, and visibility across heterogeneous infrastructure.

The AI Security Market Is Crowded, but the Server Layer Is Under-Discussed​

The phrase “AI security” is now stretched almost beyond usefulness. It can mean securing models, securing data, securing prompts, securing AI-generated code, securing AI agents, or using AI to secure everything else. Vendors have noticed the budget momentum and are racing to attach their products to the category.
SGA Solutions’ framing is stronger than many because it does not depend on pretending that RedCastle is an AI model firewall. It argues that AI raises the value and mobility of data, and therefore makes server-level access control more important. That is a grounded claim. AI systems do not float above infrastructure; they consume data from servers, databases, storage systems, and APIs that still need old-fashioned protection.
The enterprise risk is not only that an AI model leaks sensitive information to a user. It is that the data feeding the model was overexposed in the first place, or that the systems hosting AI-related assets inherited loose administrator privileges from earlier eras. LLM adoption can expose every shortcut in an access model because it rewards broad data availability. The more useful an internal AI system becomes, the more dangerous its underlying permissions can be.
This is why security teams should be skeptical of AI-branded products while still taking AI-driven infrastructure risk seriously. The right question is not whether a vendor says “AI” on the slide. It is whether the control reduces unauthorized access to the data, workloads, identities, and administrative surfaces that AI projects increasingly depend on.

Microsoft’s Platform Gravity Shapes the Opportunity​

Any server security vendor working in the Windows ecosystem must contend with Microsoft’s gravitational pull. Microsoft is not just the OS vendor; it is also the identity provider, endpoint security vendor, cloud provider, SIEM vendor, device management vendor, and compliance platform for many organizations. In Windows Server environments, third-party security products must either complement Microsoft’s stack or justify why native controls are not enough.
That can be hard, but it is not impossible. Microsoft’s native tools are broad and increasingly integrated, yet regulated organizations often still need specialized controls, certified products, local support, or policy mechanisms tailored to national requirements. A product like RedCastle can survive if it provides enforcement depth, compliance alignment, or operational assurance that buyers cannot get from a generic platform bundle.
The Windows Server 2025 certification angle helps here because it narrows the claim. SGA Solutions is not saying it replaces Microsoft’s security architecture. It is saying it can provide certified server-level controls for a current Windows Server environment under Korean national requirements. That is a more defensible market position than trying to out-platform the platform owner.
The challenge will be integration. Security teams do not want yet another isolated console with its own account model and log format. They want events flowing into existing monitoring, policies aligned with identity governance, and exceptions managed through auditable workflows. RedCastle’s long-term enterprise credibility will depend on whether it feels like a precision control or another operational island.

The Real Test Will Be Policy Quality, Not Product Claims​

The most common failure mode for segmentation and privilege control projects is not that the technology cannot enforce rules. It is that nobody knows what the rules should be. Legacy environments accumulate undocumented dependencies, shared accounts, fragile batch jobs, vendor maintenance paths, and emergency administrator habits that become visible only when enforcement begins.
A product that can block unauthorized access is useful only after an organization can distinguish unauthorized access from ugly but necessary legacy behavior. That requires discovery, stakeholder negotiation, phased enforcement, and a tolerance for uncomfortable truths. AI adoption makes this harder because new data flows may be experimental, fast-moving, and driven by business units that do not want to wait for traditional security review.
This is where N2SF’s classification model could help. If institutions classify systems and information by sensitivity, they can tie security controls to an explicit risk model instead of arguing case by case. Server-level products can then enforce policies that reflect data importance, not merely network location.
But classification is labor. It requires knowing what data exists, who owns it, who uses it, and what happens if it leaks or is altered. Vendors can assist, but they cannot fully automate the institutional judgment. RedCastle’s certification may win attention; successful deployments will depend on whether customers do the policy work that makes enforcement rational.

A Korean Certification Story With Global Lessons for Windows Estates​

The lesson for Windows administrators outside Korea is not that they should immediately evaluate RedCastle. The more useful lesson is that server security is being pulled back into the center of zero-trust architecture. For years, the industry’s attention swung toward identity, cloud control planes, endpoint detection, and network overlays. Those layers matter, but they do not erase the need to control what happens on the server itself.
Windows Server estates are especially prone to accumulated privilege. Administrators change, applications age, service accounts persist, and exceptions become tradition. When AI projects arrive and ask for access to data, those old assumptions suddenly become strategic risk. The organization may discover that its most valuable AI inputs live behind controls designed for a slower, less connected era.
SGA Solutions’ announcement is a reminder that regulated markets often reveal the next mainstream security problem early. Public-sector frameworks such as N2SF force agencies to confront how to connect systems without returning to blind trust. Finance and large enterprises will face the same pressure for different reasons: competitiveness, automation, data monetization, and AI adoption.
The practical implication is that server access control, privilege management, tamper-resistant logging, and workload-level segmentation should not be treated as legacy hardening chores. They are becoming prerequisites for safely exposing data to more dynamic systems. The more organizations depend on AI, the less they can afford vague server permissions.

RedCastle’s Certificate Turns a Buzzword Into a Buying Signal​

The announcement leaves several concrete points for IT leaders watching Windows Server security, AI infrastructure, and Korea’s public-sector security market.

• SGA Solutions’ RedCastle V6.0 for Windows Server 2025 R3 has received Common Criteria certification at EAL4, giving the product a stronger footing in assurance-driven procurement.
• The certified product focuses on server access control, account and privilege management, audit logging, tamper prevention, and kernel-level access enforcement.
• The timing aligns with Korea’s N2SF shift, which is pushing public institutions toward classified, risk-based, zero-trust-oriented controls rather than relying only on traditional network separation.
• The AI security angle is credible insofar as generative AI increases the value, movement, and exposure of server-held data.
• The product’s real-world value will depend on deployment discipline, integration with existing security operations, and the quality of customer policy design.
• The broader signal for Windows Server administrators is that workload-level enforcement is becoming a necessary complement to identity, network, and cloud security controls.

The RedCastle certification is not a revolution by itself, and no serious security team should mistake EAL4 for immunity from failure. But it lands at a moment when governments and enterprises are being forced to connect more systems, expose more data, and trust fewer assumptions. If AI turns data into the most contested asset in the enterprise, the server becomes contested ground again — and the vendors that can prove disciplined control at that layer will matter more in the next procurement cycle than they did in the last one.

---

References​

1. Primary source: 디지털투데이
   Published: Thu, 25 Jun 2026 05:25:10 GMT
   
   

   SGA Solutions' RedCastle earns CC certification EAL4, targets AI security with microsegmentation

   SGA Solutions said on Wednesday it obtained CC certification at the EAL4 level for its server security solution, RedCastle V6.0 for Windows Server 2025 R3. The product provides key functions including server access control, account and privilege management, audit logs and tamper prevention. The...

   www.digitaltoday.co.kr
2. Related coverage: inews24.com
   
   

   SGA솔루션즈, 서버 보안 솔루션 'RedCastle V6.0' CC인증 EAL4 획득

   국제 인증체계 통과…높은 수준 보안성 인정 SGA솔루션즈(대표 최영철)는 서버 보안 솔루션 'RedCastle V6.0(이하 레드캐슬)'이 CC인증의 'EAL4' 등급을 획득했다고 23일 밝혔다. CC인증은 보안 기능이 있는 IT 제품의 안전성을 평가하는 제도로, 국제적으로 통용되는 정보보호 제품의 평가·인증 체계다. 정보보호제품이 구현한 보안 기능이, 해당 보증 등급에서 요구하는 보안요구사항을 충족하는지를 평가·인증한다.

   www.inews24.com
3. Related coverage: enki.co.kr
   
   

   10 Myths and Truths about the National Network Security Framework (N2SF) | Enki White Hat

   Check out the concept and policy changes of the National Network Security Framework (N2SF), network separation improvement directions, and security measures.

   www.enki.co.kr
4. Related coverage: igloo.co.kr
   
   

   N2SF(National Network Security Framework) 관련 기술 - Security & Intelligence 이글루코퍼레이션

   💌 후속 콘텐츠, 계속 받아보세요 ▶ 최근 COVID-19로 인한 재택근무 증가, WFA(Work From Anywhere) 확산 등 최근 업무 환경의 변화와 접근 단말의 다양화로 보안 패러다임이 변화하고 있으며, 이에 대응하기 위한 노력들이 활발하게 이루어지고 있다. 2006년부터 현재 20년 가까이 시행되어온 망 분리 정책은 보안 강화 측면에서 효과성을 나타내고 있으나, 획일적인 망 분리 규제의 한계점은 지속적으로 대두되고 […]

   www.igloo.co.kr
5. Related coverage: zdnet.co.kr
   
   

   "보안 시장 새 질서"...N2SF 지침 1.0 발표 눈앞 - ZDNet korea

   국가정보원이 발표하는 국가망보안체계(N2SF, National Network Security FRAMEwork) '지침(가이드라인) 1.0' 정식 버전 발표가 임박했다. N2SF는 공공데이터 활용 촉진과 보안성 확보를 위한 국가망보안체계를 말한다. 국정원은 작년 ...

   zdnet.co.kr
6. Related coverage: ictleader.tistory.com
   
   

   국가망 보안체계(N2SF) 완전 정복 – 개념·구조·적용 대상 한 번에 총정리

   "망분리는 아는데, N2SF는 뭔가요?"라는 질문, 공공기관 보안 담당자라면 요즘 꽤 자주 듣고 계시지 않나요?이 글을 끝까지 읽으시면 N2SF의 탄생 배경부터 등급 구조, 실무 적용 방법, 그리고 기존 망분리와의 핵심 차이까지 한 번에 정리할 수 있습니다.안녕하세요, ICT리더 리치입니다! 솔직히 말씀드리면, 저도 처음 'N2SF'라는 단어를 접했을 때 "또 새로운 약어 하나 나왔구나" 싶었습니다. 그런데 자료를 파고들수록 이건 단순한 명칭 변경이 아니라, 우리나라 공공 보안 패러다임이...

   ictleader.tistory.com

Spoiler: Additional references (2)

1. Related coverage: ncsi.com
   
   

   Endnotes

   PDF document

   www.ncsi.com
2. Related coverage: sitic.org
   
   

   A Proposal for a Zero-Trust-Based Multi-Level Security Model and Its Security Controls

   PDF document

   sitic.org