Key Takeaways
- Airlock Digital completed an independent IRAP assessment at the PROTECTED classification level, evaluated against the Australian Government Information Security Manual (ISM).
- The assessment provides Australian organisations with additional, third‑party evidence when reviewing Airlock Digital’s application‑control solutions for government, defence and critical‑infrastructure environments.
- Results reinforce confidence that Airlock Digital’s controls align with the Protective Security Policy Framework (PSPF) and support a “Deny by Default” security posture.
- The flexible deployment models (cloud‑delivered, on‑premises, hybrid, and air‑gapped) allow organisations to match application‑control capabilities to their specific infrastructure strategies.
- Airlock Digital enables organisations to retain ownership of trust decisions, maintain visibility of endpoint execution, and operationalise allowlisting as an ongoing process.
Overview of the IRAP Assessment
Airlock Digital, a global provider of application control and allowlisting solutions, announced the completion of an independent Information Security Registered Assessors Program (IRAP) assessment at the PROTECTED classification level. The review was performed by an Australian Signals Directorate (ASD)‑endorsed IRAP assessor and measured the company’s security controls against the Australian Government Information Security Manual (ISM). By achieving this benchmark, Airlock Digital supplies Australian organisations with an additional layer of independent verification that its technology meets recognised government security expectations, including those outlined in the Protective Security Policy Framework (PSPF). The assessment complements Airlock Digital’s existing security and privacy reports, certificates, and third‑party attestations, giving prospective customers a concrete data point for due diligence.
Why Independent Assurance Matters to Australian Organisations
For Australian security teams, confidence in a technology provider extends beyond feature lists; it hinges on understanding how the vendor approaches security, how its controls survive independent scrutiny, and whether it can satisfy the stringent requirements of sensitive, government, defence, and critical‑infrastructure environments. IRAP assessments are specifically designed to give organisations insight into the security strengths and weaknesses of ICT systems and services. Airlock Digital’s PROTECTED‑level IRAP result therefore offers tangible assurance that its application‑control platform can be trusted to protect high‑value assets. This is especially relevant as Australian organisations increasingly demand evidence that their technology stack has been evaluated against recognised government standards before being deployed in regulated or high‑risk settings.
Supporting Diverse Infrastructure Strategies
Modern Australian organisations rarely operate in a single, homogenous environment; they frequently blend cloud, on‑premises, hybrid, and highly constrained (e.g., air‑gapped or segmented) infrastructures. Airlock Digital’s application‑control solutions are deliberately flexible, offering cloud‑delivered, on‑premises, and hybrid deployment options that can be tailored to an organisation’s infrastructure strategy and security requirements. In environments where continuous external cloud connectivity is prohibited or impractical—such as defence networks, critical‑industry OT systems, or segmented government zones—the platform can function without relying on persistent internet access. This adaptability ensures that security controls are not forced into a single architecture but instead work within the existing operational model, preserving both security and business continuity.
What the Assessment Means for Prospective Customers
Beyond its existing security documentation, the IRAP assessment supplies independent evidence that can be incorporated into customer due‑diligence processes. Organisations evaluating Airlock Digital can use the assessment to verify that the vendor’s controls align with the ISM and PSPF, thereby supporting decisions about cloud adoption, governance, and risk management. Airlock Digital’s core capability—allowlisting—lets organisations define precisely what software is permitted to run on endpoints, shifting from reliance on generic “trusted software” lists to organisation‑owned trust decisions. The platform enables security and IT teams to:
- Prevent unauthorised software from executing.
- Establish and retain ownership of clear, organisation‑defined trust decisions.
- Maintain continuous visibility into what runs across endpoint environments.
- Apply application control uniformly across cloud‑connected, on‑premises, and constrained settings.
- Progress toward a Deny by Default posture while preserving operational stability.
These principles underscore Airlock Digital’s approach: clear ownership of trust, predictable enforcement, and controls that function effectively in real‑world, heterogeneous environments.
Operational Benefits and Strategic Alignment
The ability to retain ownership of trust decisions is a significant advantage for organisations that must demonstrate compliance with internal policies or external regulations. By allowing security teams to curate and manage their own allowlists, Airlock Digital reduces reliance on vendor‑defined whitelists that may not reflect an organisation’s unique risk profile. Continuous visibility into endpoint execution further supports incident response and threat hunting, as security personnel can quickly identify anomalous or unauthorised activity. Moreover, the solution’s compatibility with air‑gapped and segmented networks means that organisations pursuing stringent isolation strategies—common in defence and critical‑infrastructure sectors—can still enforce application control without compromising the isolation that underpins their security architecture.
Airlock Digital’s Company Profile
Founded in Australia in 2013 and now operating internationally, Airlock Digital specialises in preventative endpoint security through precision application control, allowlisting, and operating‑system hardening. The company’s technology enables customers to run only trusted software, thereby shrinking the attack surface and mitigating the risk of malware execution, ransomware, and other endpoint‑based threats. Airlock Digital serves a diverse client base spanning financial services, healthcare, manufacturing, energy, government, and education sectors. Its commitment to supporting organisations with demanding security requirements is reflected in its ongoing investments in independent assessments, such as the IRAP PROTECTED review, and in its focus on delivering flexible, deployment‑agnostic solutions that align with real‑world operational constraints.
Conclusion and Next Steps
The completion of the IRAP assessment at the PROTECTED level provides Australian organisations with an additional, credible source of evidence when evaluating Airlock Digital’s application‑control offerings. It reinforces the vendor’s alignment with national security standards, highlights the flexibility of its deployment models, and underscores the value of organisation‑owned trust decisions in achieving a robust Deny by Default stance. Security teams considering Airlock Digital can now reference this independent assessment as part of their broader risk‑management and due‑diligence processes. For further details, interested parties are encouraged to visit the Airlock Digital IRAP page or review the accompanying blog announcement, and to reach out directly to the company’s VP of Marketing, Erin Welke, via email at [email protected].
Join the conversation on LinkedIn: Information Security Community!