Airlock Digital clears IRAP assessment at PROTECTED level
Airlock Digital has completed an independent Information Security Registered Assessors Program (IRAP) assessment at the PROTECTED classification level, the Adelaide-based application control vendor announced on 19 August 2026. The assessment was conducted by an Australian Signals Directorate (ASD)-endorsed assessor working against the Australian Government Information Security Manual (ISM), the primary security framework for Commonwealth agencies and their technology partners.
The outcome gives Australian public-sector buyers, defence contractors and critical infrastructure operators an additional independent evidence base when evaluating Airlock Digital's controls against the ISM and the Protective Security Policy Framework (PSPF). The company said the assessment covers both its cloud-delivered and on-premises deployment models, including configurations designed for air-gapped or otherwise connectivity-constrained environments.
What the assessment covers
IRAP is administered under the ASD's Cyber Security Partnership Program and is designed to provide independent scrutiny of ICT systems and services against government security expectations. PROTECTED is the second of four Australian Government security classifications, sitting below SECRET and TOP SECRET, and is the threshold at which organisations handling sensitive government business typically need to demonstrate control assurance. Completing an assessment at this level is a prerequisite consideration for many federal agency procurement decisions rather than a formal certification in itself; it produces a report that informs risk acceptance rather than a pass-or-fail accreditation.
Airlock Digital's platform centres on application allowlisting, a security control that restricts endpoint execution to a predefined set of trusted software. This approach is the first mitigation in the Australian Cyber Security Centre's Essential Eight framework, which the federal government requires agencies to implement at maturity levels calibrated to their risk profile. Application control has historically been difficult to operationalise at scale, and several vendors compete in the space with differing approaches to trust management, policy enforcement and exception handling.
Market context and competitive positioning
The Australian government cybersecurity market has grown markedly since the 2023 Cyber Security Strategy committed to lifting national resilience, and the Essential Eight has become a de facto procurement filter across state governments, defence primes and regulated industries including energy and financial services. Vendors seeking a foothold in those sectors increasingly pursue IRAP assessments as a commercial differentiator, positioning the report as evidence of security rigour beyond standard certifications such as ISO 27001 or SOC 2.
Airlock Digital competes with a mix of global endpoint security platforms that offer application control as a feature alongside broader EDR and XDR capabilities, as well as specialist allowlisting vendors. The company's argument for specialisation is that dedicated application control delivers cleaner policy management and a lower operational burden than broad-platform implementations, particularly in constrained or highly segmented environments where continuous cloud connectivity cannot be assumed. Whether that positioning holds as larger vendors deepen their native allowlisting capabilities is a question the market has not yet settled.
The company was founded in Adelaide in 2013 and serves customers across financial services, healthcare, energy, government and education. It has not disclosed revenue, headcount or investor backing in this announcement. The next visible milestones for the business are likely to be named government or defence contract wins that demonstrate the IRAP assessment translating into procurement outcomes.