Australian organisations are moving to the cloud at pace, but security is not keeping up. Australia’s national cyber security agency received over 84,700 cybercrime reports, roughly one every six minutes, and responded to more than 1,200 critical cyber security incidents, in the ASD Annual Cyber Threat Report 2024-25,marking an 11% year-on-year increase in incident response.
According to the Australian Cyber Security Centre (ACSC), which is part of the Australian Signals Directorate (ASD), the mean financial loss suffered by Australian businesses that experienced a cyber security incident reached A$80,850 per report, rising to A$202,700 for large businesses.
The challenge is not cloud adoption itself, but the gap between moving to the cloud and properly securing it. Hybrid workforces, multi-cloud environments, and expanding third-party integrations have stretched security perimeters well beyond the traditional network boundary. At the same time, tightening compliance obligations under APRA CPS 234 and the Privacy Act 1988 mean that security gaps carry regulatory consequences, not just operational ones.
Secure cloud solutions address this gap by bringing together the controls, governance, and operational practices that protect cloud environments without slowing the organisation down. This article covers what those solutions look like, the risks they address, and how to choose the right partner to build and manage them.
Key takeaways
- Australian organisations are projected to spend A$33.6 billion on public cloud in 2026, making secure cloud infrastructure a strategically critical investment.
- Australia’s national cyber security agency received over 84,700 cybercrime reports in the latest ASD Annual Cyber Threat Report, roughly one every six minutes, with average self-reported losses reaching A$80,850 per report for businesses and A$202,700 for large businesses.
- Hybrid and multi-cloud environments introduce compounding risk: misconfiguration, identity exposure, and limited cross-platform visibility are the leading causes of cloud security failure.
- Australian compliance obligations, including the Privacy Act 1988 and APRA CPS 234, make cloud security a legal and board-level priority. The Privacy Act was amended in 2024 to introduce penalties up to A$50 million for serious breaches, and APRA CPS 234 requires APRA-regulated entities to maintain robust information security capabilities.
- Nexon partners with mid-market, enterprise, and government organisations to design and manage secure cloud environments that deliver compliance, resilience, and operational confidence.
What are secure cloud solutions?
Secure cloud solutions are how organisations protect what they have built in the cloud, not through a single product, but through a consistent set of controls applied wherever their workloads run. That means the same standards for identity, access, and monitoring whether infrastructure sits in a public cloud, a private environment, or a multi-cloud setup.
Public, private, and multi-cloud security
The cloud environment an organisation runs shapes the security controls it needs.
Public cloud (AWS, Azure, Google Cloud) offers scalability and cost efficiency, but shares physical infrastructure across tenants. That makes correct configuration and access controls the primary line of defence.
Private cloud runs on dedicated infrastructure, giving organisations tighter control over data residency and compliance, but at the cost of higher overheads and internal management responsibility.
Multi-cloud environments combine both and introduce the most complexity. Controls, visibility, and policy enforcement need to work consistently across every environment. A unified approach to these three areas is what separates a coherent security posture from a patchwork of separate stacks.
This is what effective multi- cloud security solutions deliver: consistent controls, visibility, and policy enforcement across every environment an organisation runs.
Organisations looking to connect these decisions to broader strategy can find a useful starting point in cloud strategy and cloud governance, which covers how governance frameworks support secure, scalable cloud operations.
The shared responsibility model
The shared responsibility model defines a clear boundary: cloud providers secure the underlying infrastructure, and the organisation is responsible for everything built on top of it. Cloud providers secure the physical data centres, hardware, and core network, while the organisation is responsible for data, access controls, application security, and configuration.
This shared responsibility model means a misconfigured storage bucket or an overprivileged user account is the organisation’s problem, not the provider’s. Understanding this boundary clearly is the starting point for building a secure cloud environment that holds up under scrutiny from regulators, auditors, and boards.
When an organisation engages a managed services partner, that boundary shifts again. The partner can assume the client’s burden for cloud workload security, access management, and governance where it is commissioned to do so, moving accountability from a two-party arrangement between the cloud provider and the organisation to a three-party model that includes the managed services partner. Defining who owns each control in that arrangement is what keeps the responsibility boundary clear
Why organisations need secure cloud infrastructure
Cloud security for businesses and government organisations has never carried higher stakes. Cloud environments now host the workloads, data, and applications that keep organisations running, and they are the primary target of cyber attacks. Getting security wrong carries operational, financial, and regulatory consequences that compound quickly.
Increasing cyber threats
The threat environment has shifted materially. Australia’s national cyber security agency responded to more than 1,200 critical incidents in the latest ASD Annual Cyber Threat Report 2024-25, an 11% increase year-on-year. Ransomware, state-sponsored attacks, and AI-driven intrusion attempts are all on the rise, with cloud infrastructure frequently the entry point.
Attackers target misconfigured environments, unsecured APIs, and overprivileged accounts, which are attack patterns common for organisations that moved to the cloud without a structured security approach. The consequences extend beyond data loss: operational disruption, regulatory penalties, and reputational damage tend to follow quickly.
Remote and hybrid workforce demands
Today, employees access cloud environments from home networks, personal devices, and third-party applications, and each access point is a potential exposure. Controls built for a centralised office no longer apply in the same way.
Secure cloud infrastructure needs to extend protection to every user and location without creating friction that pushes staff toward unsecured workarounds. Shadow IT and shadow AI, where employees adopt unauthorised applications or AI tools to get work done, remain one of the most persistent and underestimated risks in hybrid work environments.
Compliance and regulatory expectations
Australian organisations face a growing set of compliance obligations tied directly to how they manage data in the cloud. The Privacy Act 1988 governs the handling of personal information. APRA CPS 234 sets mandatory information security requirements for regulated financial institutions.
Non-compliance carries penalties, but the more immediate risk is being unable to demonstrate that controls are working. Regulators and boards increasingly expect continuous, evidence-based assurance, not point-in-time attestation. Compliance needs to be built into the cloud environment from the start, not layered on after the fact.
Business continuity requirements
When cloud environments are compromised, operations stop. Secure cloud infrastructure includes backup, disaster recovery, and resilience capabilities that allow organisations to keep operating during an incident and recover quickly when one occurs. Continuity is a direct outcome of getting security right, not a separate consideration.
Organisations seeking to understand what an end-to-end cloud-based solutions approach looks like in practice can use that framework as a foundation for continuity planning across their cloud environment.
Core components of a secure cloud environment
A secure cloud environment is built from interdependent components, each addressing a specific attack surface: identity and access management, data encryption, multi-factor authentication, endpoint protection, network segmentation, backup and disaster recovery, and continuous monitoring. No single control is sufficient on its own. Together, they create a layered defence that limits exposure across the entire environment. Removing any one of them creates a gap that attackers can exploit through the others.
Nexon adopts an end-to-end strategy for this reason, providing security and cloud services as a unified, integrated solution rather than as disjointed projects managed by different teams.
Component
What it does
Why it matters
Identity and access management
Controls who can reach which systems and data, and under what conditions.
Overprivileged accounts and compromised credentials are among the most common cloud attack vectors.
Data encryption
Converts data into unreadable content without the correct decryption key.
Limits the impact of a breach. Attackers reach files they cannot read.
Multi-factor authentication
Requires a second verification factor beyond a password.
Significantly reduces the risk of account compromise from stolen or phished credentials.
Endpoint protection
Secures devices connecting to the cloud environment against malware and unauthorised access.
Every connected device is a potential entry point, particularly in hybrid work environments.
Network segmentation
Divides the environment into separate zones to contain lateral movement.
Prevents a single compromised account from reaching the entire environment.
Backup and disaster recovery
Creates isolated, versioned copies of data and defines how operations are restored.
Enables recovery from ransomware, hardware failure, or accidental deletion without extended downtime.
Continuous monitoring
Tracks activity in real time and surfaces anomalies that indicate a threat.
Reduces detection lag. The longer a threat goes undetected, the higher the cost of response.
Identity and access management
Identity is the new perimeter. In cloud environments, there is no physical boundary to defend; access is granted based on who someone is and what they are authorised to do. Identity and access management (IAM) controls who can reach which systems and data, and under what conditions.
Without strong IAM, overprivileged accounts and compromised credentials become open doors. Effective IAM enforces least-privilege access, meaning users and systems receive only the permissions required to perform their function, nothing more.
Data encryption
Encryption protects data by converting it into unreadable content that can only be accessed with the correct decryption key. In a secure cloud environment, encryption applies to data at rest (stored on servers or in databases) and data in transit (moving between systems or users). Without encryption, a breach that reaches stored data becomes an immediate exposure.
Multi-factor authentication
A password alone is not sufficient to protect cloud access. Multi-factor authentication (MFA) requires users to verify their identity through a second factor, such as an authenticator app, a hardware key, or a biometric prompt, in addition to their password.
MFA significantly reduces the risk of account compromise from stolen or phished credentials and is one of the most effective and straightforward controls an organisation can deploy across its cloud environment.
Endpoint protection
Every device that connects to a cloud environment is a potential entry point. Endpoint protection secures laptops, mobile devices, and workstations against malware, ransomware, and unauthorised access, which is particularly important in hybrid work environments where devices operate outside the traditional network perimeter.
Endpoint protection works alongside cloud security controls to ensure that a compromised device cannot serve as a pathway into the broader environment.
Network segmentation
Network segmentation divides a cloud environment into separate zones, limiting how far an attacker can move if they gain access. Rather than a flat network where a compromised account can reach everything, segmentation contains the impact of a breach to the zone where it occurred.
For organisations running complex multi-cloud environments, segmentation prevents a single point of failure from becoming a full environment compromise.
Backup and disaster recovery
Backups create independent copies of data at specific points in time. Disaster recovery plans define how an organisation restores operations after an incident. Together, they enable recovery from a ransomware attack, hardware failure, or accidental deletion without losing critical data or facing extended downtime.
Backup and disaster recovery
are not the same as cloud storage. Synced files replicate changes across devices, including those that are corrupted or encrypted. A true backup is isolated, versioned, and tested regularly.
Continuous monitoring and threat detection
Continuous monitoring tracks activity across cloud environments in real time, looking for anomalies that signal a threat: unusual login patterns, unexpected data transfers, attempts at privilege escalation, and API misuse.
Without it, threats can persist undetected for extended periods. Organisations that rely on periodic security reviews are operating with a blind spot. Effective threat detection surfaces incidents early, when the cost and complexity of response are at their lowest.
Essential security capabilities of secure cloud solutions
Secure cloud solutions must deliver six core security capabilities: phishing-resistant multi-factor authentication, encryption at rest and in transit, role-based access controls, tested backup and disaster recovery, real-time threat monitoring, and ransomware detection with verified restore points. The following outlines what each capability requires in practice and the gaps to watch for when assessing your current environment.
Capability
What it requires in practice
Gaps & Risks to watch for
Multi-factor authentication (MFA)
Enforce phishing-resistant hardware keys. Apply consistently across admins, remotes, and third-party integrations.
SMS codes and basic authenticator apps remain vulnerable to interception and proxy attacks.
Data encryption
Apply AES-256 for data at rest. Enforce TLS protocols for data in transit.
Securing only one state leaves data exposed during movement or storage.
Role-based access controls
Bind permissions strictly to job function. Automate access updates during role changes or offboarding.
Manual, account-by-account permissions create overprivileged profiles and permit unchecked lateral movement.
Backup & disaster recovery
Define and test exact RTO and RPO targets. Protect data with unalterable, immutable backups.
Untested recovery targets fail under pressure. Ransomware can wipe out unprotected backups simultaneously.
Real-time threat monitoring
Deploy automated behavioural analysis to catch unusual locations, privilege spikes, or mass data transfers.
Log collection without analysis creates a detection lag that attackers actively exploit.
Ransomware detection & recovery
Flag immediate signatures like rapid file encryption. Maintain isolated restore points.
Treating ransomware as a generic threat. Lacking a tested plan leaves actual recovery times unknown.
Multi-factor authentication (MFA)
Not all MFA’s are equal. SMS-based codes are vulnerable to SIM-swapping attacks. Authenticator apps are significantly more secure. Hardware security keys provide the strongest protection and are resistant to phishing.
When evaluating MFA, look for solutions that support phishing-resistant authentication methods and apply MFA consistently across all cloud access points, including administrative accounts, third-party integrations, and remote access.
Data encryption at rest and in transit
The distinction between encryption at rest and in transit matters in practice. Data at rest is vulnerable when stored on servers, databases, or backup systems. Data in transit is vulnerable as it moves between users, applications, and cloud services. A secure cloud environment applies AES-256 encryption to data at rest and TLS protocols to data in transit. Covering only one state leaves the other exposed.
Role-based access controls
Role-based access control (RBAC) extends identity and access management by assigning permissions based on job functions rather than individual accounts. A finance team member receives access to financial systems. A developer receives access to development environments. Neither can reach the other’s domain without explicit authorisation.
RBAC limits the impact of a compromised account and simplifies access management at scale. When an employee changes roles or leaves the organisation, permissions are updated based on role rather than through manual account-by-account adjustment.
Backup and disaster recovery
Effective backup and disaster recovery go beyond storing copies of data. It defines how quickly an organisation can restore operations (recovery time objective, or RTO) and how much data it can afford to lose (recovery point objective, or RPO). Both targets must be defined, tested, and aligned with operational requirements before an incident occurs.
Immutable backups, which are copies that cannot be altered or deleted, even by administrators, are a critical defence against ransomware that specifically targets backup repositories. Without them, ransomware can encrypt both primary data and backups simultaneously, leaving no clean restore point.
Real-time threat monitoring
Real-time monitoring goes beyond logging activity. It applies behavioural analysis to identify threats as they develop rather than after they have caused damage. Effective monitoring surfaces anomalies such as unusual login locations, privilege escalation, lateral movement across systems, and large data transfers at unexpected hours.
The faster a threat is detected, the smaller the window for damage. Organisations relying on periodic reviews or manual log analysis are operating with a detection lag that attackers exploit.
Ransomware detection and recovery
Ransomware warrants specific treatment as a capability, not just a general threat category. Detection must identify the behavioural signatures of an attack, such as rapid file encryption, mass permission changes, and unusual process activity, before encryption is complete and the window for intervention closes.
Recovery requires clean, isolated restore points and a tested plan. An organisation that has never tested its ransomware recovery process does not know how long recovery will actually take. Regular testing under realistic conditions is what separates a theoretical plan from an operational one.
Common cloud security risks organisations face
Cloud security for businesses at every scale tends to break down in the same places: configuration gaps, governance failures, and inconsistent operational practices. The following risks are the most common and the most preventable.
Misconfigured cloud environments
Misconfiguration and human error remain among the most common and most preventable causes of cloud security incidents. Cloud platforms offer significant flexibility in how access, storage, and permissions are configured, and that flexibility creates room for error. Publicly accessible storage buckets, overly permissive IAM policies, and open network ports are common examples that expose sensitive data without requiring any sophistication from the attacker.
As organisations scale their cloud environments and add services, the surface area for misconfiguration grows. Without continuous monitoring and automated configuration checks, errors can persist undetected for extended periods.
Ransomware attacks
Ransomware encrypts an organisation’s files and demands payment for the decryption key. In cloud environments, attackers increasingly target backup repositories and virtual machines alongside primary data, eliminating the restore points organisations rely on for recovery. ASD’s ACSC responded to 138 ransomware incidents in the ASD Annual Cyber Threat Report 2024-25. In 39% of those cases, the agency contacted the affected organisation first to warn of a potential compromise, signifying that many organisations are unaware that an attack is underway until after significant damage has occurred.
Insider threats
Insider threats come from two sources: malicious intent and human error. Both carry serious consequences. An employee with excessive access privileges who makes an honest mistake can expose sensitive data just as effectively as one acting deliberately.
Cloud environments amplify this risk because access is remote, often broad, and not always well-documented. Organisations with unclear access governance, infrequent access reviews, and no monitoring of privileged account activity are particularly exposed. Least-privilege access policies and regular access audits are the primary controls.
Unsecured APIs
Application programming interfaces (APIs) allow applications, services, and third-party tools to communicate across cloud environments. Unsecured APIs are a significant and growing attack vector. Poorly authenticated APIs, APIs with excessive permissions, and undocumented or forgotten APIs all create entry points into cloud infrastructure.
API security requires the same rigour applied to user access: authentication, authorisation, rate limiting, and continuous monitoring for anomalies.
Data loss and downtime
Data loss in cloud environments occurs through accidental deletion, ransomware encryption, provider outages, and failed migrations. The consequences range from temporary disruption to permanent loss of critical information. For regulated organisations, data loss also carries compliance implications that compound the operational impact.
The ASD Annual Cyber Threat Report 2024-25 recorded average self-reported losses of A$80,850 per cybercrime report for organisations. That figure reflects direct losses only. It does not capture the downstream cost of recovery, remediation, and reputational damage.
Shadow IT and shadow AI risks
Shadow IT refers to applications, services, and tools adopted by employees without IT or security team approval. In practice it is widespread: a team uses an unapproved file-sharing service to move large files, or an individual connects a personal cloud storage account to a work device for convenience.
Each unauthorised connection is a potential gap in the security perimeter. Shadow IT applications have not been assessed for compliance, do not sit within the organisation’s monitoring framework, and may store sensitive data outside approved environments. As hybrid work has normalised, shadow IT has grown alongside it.
Shadow AI is the same risk applied to artificial intelligence. It refers to the use of AI tools, models, or features within an organisation without the approval, knowledge, or oversight of the IT and security teams. As staff adopt, test, and pilot AI to accelerate productivity, they risk exposing sensitive and confidential information in AI platforms that sit outside the organisation’s governance and monitoring. Bringing both shadow IT and shadow AI into a clear governance framework is what turns unmanaged risk into controlled adoption.
Best practices for securing cloud environments
Securing a cloud environment is not a one-time project. It is an ongoing operational discipline. Organisations that manage cloud security well are those that execute foundational controls consistently and build security into their processes from the start.
Adopt a zero-trust security model
Zero trust operates on a single principle: no user, device, or system is trusted by default, regardless of whether it sits inside or outside the network. Every access request is verified. Every session is authenticated. Permissions are granted based on context: who is asking, from where, on what device, and at what time.
In cloud environments where the traditional network perimeter no longer exists, zero trust is the appropriate security model. Identity becomes the primary control point, and continuous verification replaces one-time authentication.
Enforce least-privilege access across all accounts
Every user account, service account, and third-party integration should carry the minimum permissions required to perform its function. Overprivileged accounts are one of the most common causes of cloud security incidents. When an account is compromised, the damage is proportional to the access it holds.
Least-privilege enforcement requires regular access reviews not just at onboarding but also when roles change, when projects end, and on a scheduled cadence. Permissions that are not actively needed should be removed.
Implement continuous monitoring
Continuous monitoring provides real-time visibility into activity across cloud environments. It surfaces anomalies such as unusual access patterns, unexpected data movements, and attempts at privilege escalation that indicate a developing threat. Monitoring must cover all layers of the environment: infrastructure, applications, APIs, and user activity.
Periodic audits are not a substitute. The gap between reviews is the window in which attackers operate.
Apply encryption as a baseline
Encryption should be the default, not a configuration decision made on an environment-by-environment basis. Data at rest and data in transit should both be encrypted as standard. Encryption keys should be managed securely and rotated regularly. Treating encryption as optional or applying it selectively creates predictable gaps.
Test backup and recovery regularly
Organisations should test their recovery process under realistic conditions, such as simulating a ransomware event, a data loss scenario, or a provider outage, to confirm that recovery time and recovery point objectives are actually achievable. Testing also validates that backups are complete, uncorrupted, and isolated from primary systems.
Train staff consistently
Human error drives the majority of cloud security incidents. Technical controls reduce exposure but cannot eliminate the human factor. Consistent training that covers phishing recognition, secure access practices, acceptable use of cloud tools, and reporting suspicious activity is one of the highest-leverage investments an organisation can make.
Training should be ongoing. The threat environment changes, and so should the training that prepares staff to navigate it.
Establish clear governance
Governance defines who is responsible for cloud security decisions, how cloud resources are provisioned and decommissioned, and how compliance obligations are met. Without it, cloud environments grow organically and unevenly, creating sprawl, shadow IT & Shadow AI, and inconsistent security standards.
A clear governance framework, supported by policy, monitoring, and accountability, enables security controls to scale as the environment grows. Security without governance is difficult to sustain at scale.
How to choose the right secure cloud solutions provider
Choosing the right secure cloud solutions provider depends on four core requirements, with security at the centre: continuous monitoring rather than periodic reviews, governance embedded from the outset, clear accountability through an incident, and proven experience with Australian compliance obligations.
Look for a partner, not a product vendor
The risks covered in this article (misconfiguration, identity exposure, insider threats, shadow Ai & IT) are operational problems as much as they are technical ones. The right partner takes shared responsibility for the outcome, working continuously across your environment rather than just responding when something goes wrong. That means support across security, continuity, and efficiency, not just incident response.The right partner will assess your environment, understand your needs and future state, and deliver a cloud environment aligned to your outcomes.
Require 24/7 coverage with named, local accountability
Cyber threats do not operate on a 9-to-5 schedule, and neither should your security coverage. Look for a provider with a dedicated, Australia-based Security Operations Centre that monitors your environment around the clock. The location of your MSP matters for two reasons: response time and data sovereignty.
For highly regulated industries, protecting data is critical and must remain visible. Support models, including onshore or offshore SOCs, should be evaluated based on organisational needs, risk profile and regulatory requirements. Named accountability is equally critical, with a dedicated analyst team owning your environment from detection through to containment, rather than responsibility shifting between teams during an incident.
Verify credentials across both cloud and cyber security
Cloud and cyber security capabilities are not the same. A provider strong in one but weak in the other creates gaps where your environment is most exposed. Look for a partner with specialised expertise in both areas, supported by dedicated resources and relevant accreditations across cloud platforms and security frameworks.
Australian compliance credentials (ISO/IEC 27001, ISO 42001:2023, CREST, government accreditation) reflect whether a provider has the operational depth to work within Australian regulated environments.
Expect independence in their recommendations
Independent providers take the time to understand your organisation, assess your current state and map a secure cloud roadmap aligned to your needs. Providers tied to a single platform tend to recommend that platform, regardless of fit.An agnostic provider starts with an assessment, builds a clear understanding of your workloads, and aligns recommendations to your organisation’s needs.
That independence is what “right cloud for the right workload” means in practice, and it is the difference between a cloud environment that serves your organisation and one that serves a vendor’s margin.
Choose scale and experience that match your complexity
Mid-market, enterprise, and government organisations face different security challenges than small organisations: more complex environments, more compliance obligations, more at stake operationally. A provider whose client base and capability match your scale brings relevant experience.
Why choose Nexon Asia Pacific (Nexon)
Nexon is an Australian digital and IT services provider for mid-market, enterprise and government organisations. Our Australia-based SOC delivers monitoring across your network, endpoints and cloud.
Our approach to cloud security is integrated by design. Cloud and security are not separate engagements at Nexon; they are delivered as a single managed capability through our end-to-end managed services offering.
For organisations assessing their security posture against Australian standards, Nexon delivers Essential 8 assessments and strategic guidance aligned to the ACSC framework. The goal is measurable advancement in cyber security maturity, not a point-in-time audit. Our CREST-certified penetration testing team identifies vulnerabilities before threat actors do.
Our security partner ecosystem includes Palo Alto Networks, Microsoft, SentinelOne, Fortinet, F5, and many more
Nexon supports over 1,000 organisations across highly regulated sectors. Our cyber security advisory team assesses your cloud security posture and identifies risks & vulnerabilities before they become incidents.
Talk to our cloud security team for a personalised consultation today.
FAQs
How do secure cloud solutions help prevent cyber attacks?
Secure cloud solutions reduce the attack surface by layering controls across the environment: identity management limits access, encryption protects data in the event of a breach, and continuous monitoring detects threats as they develop. No single control is sufficient. The combination, applied consistently, is what makes an environment meaningfully harder to compromise.
How often should cloud environments be monitored and updated?
Monitoring should be continuous. Patches should be applied as soon as they are available. Delayed patching is one of the most common and preventable causes of cloud security incidents.
How do backup and disaster recovery improve cloud resilience?
Backup and disaster recovery determine whether an organisation can restore operations after an incident, and how quickly. Both the recovery time objective (RTO) and recovery point objective (RPO) must be defined, tested, and validated before an incident occurs.
How can organisations securely migrate to the cloud?
A secure migration starts before a single workload moves: assess the existing environment, map compliance requirements to the target environment, and build security controls from day one rather than layering them on afterwards.
What is the difference between end-to-end encryption and zero-knowledge privacy?
End-to-end encryption ensures data is encrypted from the moment it leaves the sender’s device and can only be decrypted by the authorised recipient. The provider cannot read the data in transit. Zero-knowledge privacy goes further: the provider holds no encryption key at all, meaning they cannot access your data under any circumstances.
References
- Australian Signals Directorate. (2025). Annual cyber threat report 2024–2025. Australian Cyber Security Centre. https://www.cyber.gov.au/about-us/view-all-content/reports-and-statistics/annual-cyber-threat-report-2024-2025
- Information Commissioner’s Office. (n.d.). Errors: Learning from the mistakes of others — a retrospective review. https://ico.org.uk/about-the-ico/research-reports-impact-and-evaluation/research-and-reports/learning-from-the-mistakes-of-others-a-retrospective-review/errors/
- Gartner. (2026, May 11). Gartner forecasts Australian organisations will spend more than A$33 billion on public cloud in 2026 [Press release]. PR Wire. https://prwire.com.au/pr/128509/gartner-forecasts-australian-organisations-will-spend-more-than-a-33-billion-on-public-cloud-in-2026
More articles to explore
