> ## Content Index > Fetch the complete content index at: https://www.theaidirectory.com.au/llms.txt > Use this file to discover other available public pages before exploring further. # Airlock Digital Review Australia 2026: The Adelaide-Built Essential Eight Benchmark - URL: https://www.theaidirectory.com.au/review-airlock-digital-australia-2026/ - Published: 2026-06-06T23:00:00.000Z - Updated: 2026-10-09T06:27:06.000Z - Description: The Adelaide-built application control tool that delivers the single most effective Essential Eight mitigation. Honest about the rollout effort. Our verdict. - Author: Adam - Tags: Cybersecurity & Data Protection, #review ★ Editor’s Choice AU **22**/25 ★★★★★ Excellent Airlock Digital Verified 21 Sep 2026 Reviewed 7 Jun 2026 Value for Money**4**/5 Ease of Use**3**/5 Feature Depth**5**/5 Australian Fit**5**/5 Reliability & Support**5**/5 Pricing Quote-based pricing — see the pricing table **The gate:** Australian Fit 5/5 clears it, so five stars are permitted. [Skip to the verdict ](#verdict) > **Verdict (TL;DR):** If you're an Australian business that needs to harden endpoints against ransomware — or you're being pushed toward Essential Eight compliance by a contract, an insurer or a government tender — Airlock Digital is the benchmark local tool for the job. It's Adelaide-built, it delivers Application Control (the first and arguably most effective Essential Eight mitigation) to Maturity Level 3, and its deny-by-default model stops unapproved software from running at all. One honesty note up front: this is **not** an AI security product. Its strength is deterministic application control, not machine-learning threat detection — and we include it precisely because that determinism is what makes it effective. Skip it only if you're a solo, non-technical operator with no IT or MSP support, because application control needs careful rollout. **Score: 22/25 — ⭐⭐⭐⭐⭐** *Australian Fit: 5/5 — gate passed.* *Last reviewed: 7 June 2026 by Adam.* > > **Editorial guidance, not security advice.** This review is independent editorial opinion to help you shortlist tools. It is not cyber security, legal or compliance advice. No single product delivers Essential Eight compliance on its own, and application control in particular needs careful planning and testing. Engage a qualified IT provider, MSP or security consultant before deploying. See the caveats throughout. ## What Airlock Digital is Airlock Digital makes application control software — what the industry also calls application allowlisting or, in older language, whitelisting. The idea is simple and old-fashioned in the best way. Instead of trying to spot and block bad software (what antivirus does), Airlock flips the logic: nothing runs on a protected machine unless it has been explicitly approved. Everything else is denied by default. The company was founded in Adelaide in 2013 by David Cottingham and Daniel Schell, and it remains Australian-headquartered, with an additional office in Atlanta to serve overseas customers. That Australian origin is not a marketing detail here. Airlock was, in its own words, "created to align with the Essential Eight Mitigation Strategies" — the security framework published by the Australian Signals Directorate's Australian Cyber Security Centre (ACSC). It is a tool shaped by Australian government security doctrine, sold first to an Australian market that has to comply with it. A word on why this sits in an AI tools directory at all. We've added a Cybersecurity & Data Protection category because Australian small businesses keep asking us what to actually buy to protect themselves, and the answers matter. Airlock is our benchmark Australian-built pick for the Essential Eight's hardest control. Be clear-eyed, though: its core engine is deterministic rule-based allowlisting, **not** AI. We say more on that below, because honesty about it is the point. ## The AI angle, stated plainly Voice rule five on this publication is to be honest about limitations, and the most important honesty in this review is about the "AI" framing. Airlock Digital's core engine does not use machine learning to decide what is safe. It uses deterministic rules: a file is allowed to execute only if it matches an approved trust rule — by cryptographic hash, by publisher signature, by path, or by parent process — and is otherwise blocked. There is no probabilistic model guessing whether a file "looks malicious." That is a feature, not a gap. A deterministic deny-by-default control can't be fooled the way an ML classifier can, and the vendor explicitly markets "unique configurations" that remove "an adversary's ability to test and validate their attacks". Where cloud intelligence does come in is the allowlist-building workflow. Airlock integrates VirusTotal and ReversingLabs file-reputation lookups so that when an administrator is reviewing unknown files to approve, they get a reputation verdict — known, unknown, suspicious or malicious — and supporting metadata to inform the trust decision. That's threat intelligence assisting a human decision, not an AI making the call. So: cloud-assisted allowlist building, yes; AI threat detection, no. We include Airlock as the Australian Essential Eight benchmark, not as an AI product, and you should buy it on that basis. ## What it costs in Australia Here we have to be upfront: Airlock Digital does not publish a public price. Pricing is quote-based, sold per endpoint, typically through partners and MSPs, and scaled to your environment. | Plan | Price | What you get | | ----------------------------------- | ------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Airlock Digital Application Control | Quote-based, per endpoint | Allowlisting + execution control across Windows, macOS and Linux; central console; blocklisting; OTP exclusions; VirusTotal/ReversingLabs reputation lookups; SIEM logging | The major third-party listings — G2, TrustRadius and Software Finder — all now show pricing as "custom" or "contact vendor," with no public per-endpoint figure, so there is no reliable benchmark to quote you. The only public sizing reference is Forrester's commissioned Total Economic Impact study, which modelled a composite organisation of 20,000 endpoints and reported a 224% three-year ROI on costs of US$1.7m — useful as a directional ROI signal, but a large-enterprise model, not a small-business per-seat price. The real number depends on seat count, term, and whether you buy direct or through a partner. Get a written quote before you budget. **GST note:** Airlock is an Australian company, so a quote to an Australian business will be denominated in AUD with GST applied in the normal way — 10% added, and claimable as an input tax credit if you're GST-registered and buying for business use (standard Australian B2B GST treatment). Confirm the GST-inclusive figure and deductibility with your accountant. This is general information, not tax advice. The honest read on value: you can't comparison-shop Airlock from a pricing page, which is friction. But per-endpoint application control at the rough range above is reasonable for what it does, and it is one of the few controls an insurer or auditor will actively reward you for having. ## How it works in practice Application control is more involved to deploy than installing antivirus, and you should know that going in. This is not download-and-go. The first phase is building your allowlist — the inventory of software you trust. Airlock runs in an **audit mode** first: it watches what executes across your fleet without blocking anything, so you can see your real software footprint before you start enforcing. From that baseline you approve what belongs — using bulk-add tooling that aggregates files and tags them by VirusTotal reputation so you're not approving blind. Trust can be granted by hash, by software publisher, by file path or by process, which keeps the list maintainable as software updates. Once you're confident, you switch to **enforcement mode**, and anything not on the list is blocked from running. Blocked events are centrally logged by default and can be fed to a SIEM. Day-to-day, the friction point is new software: when a staff member needs something not yet trusted, an administrator approves it, or grants a temporary exclusion via the **One Time Password (OTP)** feature so a machine can be unlocked briefly without dropping the whole policy. Deployment is flexible: you can run it on-premise or in the cloud, and it explicitly supports offline and air-gapped environments — relevant for defence, utilities and isolated OT networks. The agent covers Windows, macOS and Linux. The realistic effort: expect weeks, not hours, to move from audit to full enforcement across a real fleet, and budget ongoing administration for software changes. This is why it's almost always deployed with IT or MSP support. ## What it does well - **Delivers the hardest Essential Eight control properly.** Airlock claims to be the only allowlisting vendor that meets the ACSC's Application Control strategy at Maturity Level 3 — the top tier, covering workstations, internet-facing and non-internet-facing servers, and driver control. - **Deterministic, deny-by-default protection.** Nothing unapproved runs, full stop. That stops ransomware and unknown malware by design rather than by guessing. - **Built for Australian compliance.** It was designed around the Essential Eight from day one, so the framework mapping isn't retrofitted. - **You own the trust decisions, not a vendor cloud.** Airlock explicitly positions that "organisations themselves must decide what they do or do not trust, not a third party" — important for high-assurance and air-gapped environments. - **Cross-platform and air-gap capable.** Windows, macOS and Linux, on-prem or cloud, including offline networks. ## What it doesn't do well - **It is not AI, and it is not all-in-one security.** Airlock does application control. It is **not** antivirus or EDR, not email security, not patch management, and not multi-factor authentication. It covers one Essential Eight mitigation well; the other seven need other tools. - **Rollout is real work.** Building and tuning an allowlist takes weeks and ongoing administration. A non-technical operator will struggle without help. - **Pricing is opaque.** No public price means you can't quickly compare it against alternatives without a sales conversation. - **Operational friction on new software.** Deny-by-default means legitimate new apps are blocked until approved. Done badly, that frustrates staff; the OTP feature mitigates but doesn't eliminate it. - **Best suited to organisations with IT maturity.** It rewards businesses that already manage their fleet centrally. A five-person shop with unmanaged laptops should expect to lean heavily on an MSP. ## Australian fit **Australian-built and Australian-headquartered.** Airlock was founded and is headquartered in Adelaide, South Australia. For a tool whose entire purpose is implementing an Australian government security framework, that local origin is genuine substance, not flag-waving. **Essential Eight alignment.** Application Control is the first of the eight ACSC mitigation strategies, and the ACSC rates it among the most effective because it neutralises whole classes of attack — ransomware, unknown malware, "living off the land" abuse — by preventing unapproved code from executing at all. Airlock implements it to Maturity Level 3 and also assists adjacent mitigations such as user application hardening and restricting Microsoft Office macro execution by controlling what can run. Be precise about the limit: it delivers Application Control directly and supports those adjacents; it does not by itself deliver the patching, MFA or backup mitigations. **Data residency and control.** Because Airlock can be deployed on-premise or in the cloud, and supports fully air-gapped operation, an Australian organisation can keep all execution and policy data onshore and under its own control. The vendor's design philosophy that the organisation, not a third party, owns trust decisions reinforces this. One honest caveat: if you opt for a vendor-hosted cloud console rather than an on-prem or self-hosted deployment, Airlock does not publish the geographic region in which that console and its data reside. The public Security and Privacy page lists SOC 2 and ISO 27001 but states no hosting location, and the Privacy Policy only says service providers "may be based in Australia or overseas" — so onshore residency for the vendor-hosted option cannot be assumed. For strict onshore requirements, choose the on-prem or air-gapped path and you stay fully in control. If you use the VirusTotal/ReversingLabs reputation lookups, file metadata is checked against those external services as part of allowlist building — worth noting for the strictest air-gapped deployments, where those lookups can be omitted. **AUD pricing and GST.** As an Australian vendor, quotes are in AUD with GST handled the standard way (worth confirming the exact GST treatment on your quote). **AU support and partners.** The Adelaide headquarters (Unley, South Australia) publishes an Australian support line (1300 798 925) and a support email, plus a local partner and MSP channel, and the vendor describes "around-the-clock assistance" from global teams. So Australian-timezone support and local implementation help are clearly available. What Airlock does not publish is any support-hours table or contractual SLA — the FAQ and support portal describe tailored support but commit to no specific response times, so request the SLA and hours in writing from the vendor or partner before relying on them. **The caveat that matters most:** application control is powerful but unforgiving if rushed. Deployed without proper audit-mode baselining it can block legitimate business software and disrupt operations. Plan it, test it in audit mode, and roll it out with qualified IT or MSP support. No single tool — Airlock included — makes you "Essential Eight compliant" on its own. Australian Fit score: 5/5. ## Alternatives - **Microsoft Defender Application Control (WDAC) / AppLocker** — built into Windows, so no extra licence if you're on the right Microsoft tier. Consider this if you're a Microsoft-centric shop with strong IT and want to avoid a new vendor — but it's harder to manage at Maturity Level 3 and is Windows-only. - **ThreatLocker** — a global application-control competitor with a strong allowlisting and ringfencing feature set. Consider this if you want an international vendor with a broad zero-trust endpoint suite, but check its Australian support and data-residency position against Airlock's local footprint. - **A managed Essential Eight service (e.g. via an MSP or a provider like CyberCX)** — consider this if you'd rather buy the outcome than run the tool, and want application control bundled with the other seven mitigations under one managed contract. ## Bottom line Airlock Digital is the benchmark Australian-built tool for the single most effective thing a business can do to stop ransomware: stop unapproved software from running. It's Adelaide-built, it implements the Essential Eight's Application Control mitigation to the top maturity level, and its deterministic, deny-by-default model is genuinely hard for attackers to beat. For an Australian business facing Essential Eight obligations — from a government tender, a cyber-insurance requirement, or a supply-chain contract — it's the first name to put on the shortlist. We're putting it in our AI directory honestly: it is not an AI product. Its engine is rule-based, not machine-learning, and that's exactly why it works. The only "intelligence" in the loop is the VirusTotal and ReversingLabs reputation data that helps a human build the allowlist faster. If you came looking for AI-powered threat detection, this isn't that, and we'd rather tell you than dress it up. The honest hesitations are about effort and fit, not effectiveness. Pricing is quote-only, so you'll have to talk to a partner. Rollout takes weeks and real administration. And a solo, non-technical operator will need an MSP to do it properly. But for any Australian organisation with even modest IT support that has to take endpoint hardening seriously, Airlock earns its place — and its perfect Australian Fit score. It holds our Top Pick for application control in the Cybersecurity & Data Protection category, on the strict understanding that it's one strong mitigation, not a whole security program. ## Score | Criterion | Score | Why | | --------------------- | --------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Value for Money | 4/5 | Strong per-endpoint value for the hardest E8 control and the kind insurers reward, but quote-only pricing means no fast comparison | | Ease of Use | 3/5 | Audit-mode baselining and OTP help, but building and maintaining an allowlist is weeks of work and needs IT/MSP support — far more involved than download-and-go AV | | Feature Depth | 5/5 | Hash/publisher/path/process trust, cross-platform, air-gap support, blocklisting, SIEM logging, reputation integrations, Maturity Level 3 — comprehensive for its purpose | | Australian Fit | 5/5 | Adelaide-built and headquartered, designed around the ACSC Essential Eight, on-prem/air-gap deployment keeps data onshore and under your control | | Reliability & Support | 5/5 | Deterministic deny-by-default by design, used in high-assurance and air-gapped environments, local partner/MSP support — no published SLA/support-hours table (request in writing) | | **Total** | **22/25** | **⭐⭐⭐⭐⭐ Excellent** | *Australian Fit gate: 5/5 — gate passed. Excellent rating stands.* Update history - **21 Sep 2026 🇦🇺 Currency verified by browser** — no public price to check. `airlockdigital.com/pricing` returns **404** and no figure appears anywhere on the site, confirming the review’s quote-only account. The AUD reasoning rests on the Australian entity rather than a published figure, which is the right way to write it. `aud_native: true` set explicitly. No score change. - **2 Sep 2026** — Re-verified pricing and compliance claims against airlockdigital.com: unchanged. Pricing remains quote-based per endpoint with no public figure, and the Essential Eight claims stand — Application Control to Maturity Level 3, still stated as the only allowlisting vendor at ML3, across Windows, macOS and Linux. One development to watch: Airlock has launched an "Agentic AI Usage Control" capability (2026) that extends its deny-by-default model to commands run by AI agents — an extension of the same deterministic engine, not machine-learning detection, so our "not an AI product" framing of the core engine stands. [Source](https://www.airlockdigital.com/essential-eight-compliance?ref=theaidirectory.com.au) - **7 Jun 2026** — First reviewed. ## Frequently asked questions ### Is Airlock Digital available in Australia? Yes — and it's Australian to its core. The company was founded in Adelaide in 2013 and remains Australian-headquartered (Unley, South Australia), with a local support line (1300 798 925) and an Australian partner and MSP channel. It was built around the ACSC Essential Eight. ### Does Airlock Digital charge in AUD? Yes. As an Australian vendor, quotes to Australian businesses are in AUD with GST applied the standard way — 10% added, claimable as an input tax credit if you're GST-registered and buying for business use. Pricing is quote-based per endpoint, with no public figure. ### Is there a free plan or free trial? The review doesn't list a free plan or trial. Airlock is sold on a quote-based, per-endpoint basis, typically through partners and MSPs. Get a written quote before you budget. ### Can Australian businesses keep their data onshore? Yes, if you deploy on-premise or air-gapped — execution and policy data stays onshore and under your control. But the vendor-hosted cloud console doesn't publish its hosting region, so don't assume onshore residency for that option. For strict onshore needs, choose the on-prem or air-gapped path. ### Is Airlock Digital actually an AI tool? No, and the review is upfront about it. Its engine is deterministic, rule-based application control — not machine learning. The only cloud intelligence is VirusTotal and ReversingLabs reputation data that helps a human build the allowlist. It's included as the Australian Essential Eight benchmark, not an AI product. ## Read next - Category guide: [Best AI Cybersecurity Tools for Australian Small Businesses (2026)](https://www.theaidirectory.com.au/roundup-best-ai-cybersecurity-smb-australia-2026/) ## Sources 1. Airlock Digital — Home (core product: application control/allowlisting, deny-by-default, cross-platform, on-prem/cloud) — https://www.airlockdigital.com/ — Wayback: http://web.archive.org/web/20260607212917/https://www.airlockdigital.com/ — checked 7 June 2026 2. Airlock Digital — Essential Eight compliance (Application Control as first E8 strategy, Maturity Level 1–3, only vendor at ML3, Windows/macOS/Linux, organisation owns trust) — https://www.airlockdigital.com/essential-eight-compliance — Wayback: http://web.archive.org/web/20260308033300/https://www.airlockdigital.com/essential-eight-compliance — checked 7 June 2026 3. Airlock Digital — Practical Allowlisting and Execution Control (hash/publisher/path/process trust, OTP, on-prem or cloud, air-gapped support, deterministic unique configurations) — https://www.airlockdigital.com/practical-allowlisting-and-execution-control — Wayback: http://web.archive.org/web/20260607134825/https://www.airlockdigital.com/practical-allowlisting-and-execution-control — checked 7 June 2026 4. Airlock Digital — Audit and Enforcement Modes (audit-mode baselining before enforcement) — https://www.airlockdigital.com/airlock-blog/audit-and-enforcement-modes — Wayback: http://web.archive.org/web/20260212195749/https://www.airlockdigital.com/airlock-blog/audit-and-enforcement-modes — checked 7 June 2026 5. Airlock Digital — VirusTotal partnership (reputation-based bulk add, known/unknown/suspicious/malicious tagging, VT Augment metadata) — https://www.airlockdigital.com/airlock-blog/virustotal-and-airlock-digital-join-forces-to-strengthen-cybersecurity-capabilities — Wayback: http://web.archive.org/web/20260212191903/https://www.airlockdigital.com/airlock-blog/virustotal-and-airlock-digital-join-forces-to-strengthen-cybersecurity-capabilities — checked 7 June 2026 6. ReversingLabs — Airlock & ReversingLabs partnership (integrated file-reputation lookups for trust decisions) — https://www.reversinglabs.com/newsroom/news/airlock-reversinglabs-make-cybersecurity-easier-and-more-effective-australia — Wayback: http://web.archive.org/web/20250711212719/https://www.reversinglabs.com/newsroom/news/airlock-reversinglabs-make-cybersecurity-easier-and-more-effective-australia — checked 7 June 2026 7. Airlock Digital — Leadership (Adelaide HQ, founders) — https://www.airlockdigital.com/leadership — Wayback: http://web.archive.org/web/20260118195157/https://www.airlockdigital.com/leadership — checked 7 June 2026 8. Tracxn — Airlock Digital company profile (founded 2013, Adelaide, David Cottingham & Daniel Schell, Atlanta office) — https://tracxn.com/d/companies/airlockdigital/\_\_POloLlKlC-zMWdNbx49ERP\_SlZNGWqjWnN9E1Rv9afw — Wayback: no archive available (Tracxn blocks automated archiving); these founding facts are corroborated by the primary airlockdigital.com/about source above — secondary, checked 7 June 2026 9. Software Finder — Airlock pricing (lists pricing as "Custom"/quote-based, no public per-endpoint figure) — https://softwarefinder.com/cybersecurity/airlock — Wayback: https://web.archive.org/web/20260607213213/https://softwarefinder.com/cybersecurity/airlock — secondary, checked 8 June 2026 10. Airlock Digital — Forrester TEI (commissioned) financial-impact summary (20,000-endpoint composite, 224% three-year ROI, US$1.7m costs) — https://www.airlockdigital.com/airlock-blog/airlock-digitals-financial-impact-quantified — Wayback: http://web.archive.org/web/20260118203454/https://www.airlockdigital.com/airlock-blog/airlock-digitals-financial-impact-quantified — commissioned/vendor-hosted, checked 8 June 2026 11. Airlock Digital — About (HQ Unley, South Australia; Atlanta US office; AU support line 1300 798 925; "around-the-clock assistance") — https://www.airlockdigital.com/about — Wayback: http://web.archive.org/web/20260120215545/https://www.airlockdigital.com/about — checked 8 June 2026 12. Airlock Digital — Privacy Policy (service providers "may be based in Australia or overseas"; no stated hosting region) — https://www.airlockdigital.com/privacypolicy — Wayback: http://web.archive.org/web/20260212194622/https://www.airlockdigital.com/privacypolicy — checked 8 June 2026 *The AI Directory Australia is an independent editorial publication. We don't accept payment for positive reviews. This review is editorial guidance, not security, legal or compliance advice. Read our* [*Methodology*](https://www.theaidirectory.com.au/methodology/) *and* [*Affiliate Disclosure*](https://www.theaidirectory.com.au/affiliate-disclosure/)*.*