Tungsten Unlocks Secure AI for Australia’s Public Sector

SYDNEY, Australia – July 22, 2026 – In a move that significantly redraws the map for digital transformation in the Australian public sector, Tungsten Automation today announced it has achieved IRAP Assessed – PROTECTED level status. This milestone, the result of a rigorous independent assessment against Australia's highest data security standards, effectively gives a green light to federal, state, and territory government agencies to deploy the company's AI-powered automation platforms for handling sensitive national data.

The certification applies to Tungsten Automation's flagship TotalAgility® and InvoiceAgility® Cloud Platforms, which are designed to automate document-heavy, complex workflows. For government leaders, this development addresses a long-standing paradox: the urgent need to modernize legacy systems versus the non-negotiable mandate to protect citizen and state information. With this verification, the choice is no longer between innovation and security; it's a clear path toward achieving both.

The IRAP Gauntlet: A New Standard for Trust

For those outside the sphere of government cybersecurity, the term "IRAP Assessed – PROTECTED" may seem like arcane jargon. In reality, it represents one of the most stringent benchmarks for technology providers seeking to partner with the Australian government. The Infosec Registered Assessors Program (IRAP) is governed by the Australian Cyber Security Centre (ACSC), the nation's lead authority on cybersecurity. It is not a simple certification but a deep, independent assessment that validates a system's security controls against the Australian Government Information Security Manual (ISM).

Achieving the PROTECTED level signifies that a platform is deemed capable of handling data whose compromise could cause "damage to the national interest, organisations or individuals." This isn't theoretical; it covers tangible, high-stakes information, from personal data gathered for social services and healthcare to sensitive legal evidence, commercially sensitive procurement details, and critical national infrastructure information. An independent IRAP assessor, endorsed by the ASD, scrutinizes hundreds of security controls, from data encryption and access management to physical data center security and incident response protocols.

As one cybersecurity consultant specializing in government compliance noted, "IRAP is the commercial gating factor. It provides a common language for agencies to review a vendor's security posture. Without it, you're not even in the conversation for workflows that handle anything beyond unclassified data."

From Legacy Logjam to Automated Workflow

The practical implications for Australian government agencies are immediate and profound. For decades, public sector bodies have been caught in a digital tug-of-war, constrained by aging infrastructure and manual, paper-based processes that are both inefficient and inherently risky. Tungsten Automation's new status provides a verified pathway to break this logjam.

"Government agencies are under constant pressure to modernize while protecting sensitive data — those two priorities used to pull in opposite directions," said Hoa Lam, Regional Vice President for Australia & New Zealand at Tungsten Automation. "IRAP Assessed – PROTECTED status means Australian agencies no longer have to choose. They get a proven path to automation with the security assurance that this kind of work demands."

Consider the potential applications:

• Social Services and Healthcare: Agencies can now automate the intake and processing of applications for benefits or health services, which often contain highly sensitive personal and medical information. TotalAgility® can intelligently classify documents, extract critical data, and route it through secure, automated workflows, reducing manual handling and the risk of human error.
• Law Enforcement and Justice: The platform can be used to manage the secure ingestion and redaction of evidence, witness statements, and other legal documents related to criminal investigations, where data integrity and confidentiality are paramount.
• E-Invoicing and Procurement: With InvoiceAgility® already offering PEPPOL Access Point connectivity for compliant e-invoicing, the added IRAP assessment creates a powerful combination. Agencies can now automate the entire procure-to-pay lifecycle for sensitive government contracts, ensuring that both the invoice exchange and the internal approval workflows meet the highest security standards.

This shift allows agencies to not only enhance efficiency and reduce operational costs but also to build greater public trust by demonstrating a commitment to safeguarding citizen data through independently verified measures.

A Global Blueprint for Compliance

While this achievement is a significant win in the Australian market, it also reveals a much broader, systemic strategy by Tungsten Automation. This is not a one-off effort to crack a single market. Instead, it is the latest execution of a global compliance blueprint designed for a world of increasingly stringent and fragmented data regulations.

Earlier this year, the company's TotalAgility® Cloud platform achieved FedRAMP® High Authority to Operate (ATO) in the United States—the highest security bar for cloud services serving the U.S. federal government. This was followed by GovRAMP Authorized status, extending that same assurance to U.S. state, local, tribal, and education (SLED) organizations. Together, IRAP PROTECTED, FedRAMP High, and GovRAMP represent a trifecta of top-tier government security validations across two of the world's most highly regulated regions.

"Achieving IRAP Assessed – PROTECTED level status is a milestone years in the making, and it reflects the same discipline we've applied to every security certification we pursue globally," explained Greg Crowl, Vice President of Solutions Engineering for Asia Pacific & Japan. The strategy is to build a single, repeatable security foundation that can be mapped to the specific requirements of different national frameworks, whether they are based on Australia's ISM or the U.S. NIST standards.

This systems-based approach to compliance is a powerful competitive differentiator. It tells government buyers that the company's commitment to security is foundational, not opportunistic. As Lam put it, "Whether it's Washington or Canberra, government buyers are asking the same question: can you prove it, independently, to our standard? Our answer is the same everywhere - yes, and here's the assessment that backs it up."

In a Crowded Field, Verification is the Differentiator

Tungsten Automation enters a competitive Australian government market where other major technology players, including Microsoft, UiPath, and Appian, have also secured IRAP assessments. However, the presence of competitors only underscores the significance of the certification. In the modern public sector IT landscape, robust, third-party security validation is no longer a nice-to-have; it is the price of entry for any serious contender.

With over four decades of experience serving public sector clients globally, including more than 350 U.S. government agencies, the automation leader is positioning this IRAP milestone as the logical extension of its long-term commitment to the sector. The company's solutions are designed to integrate with existing government systems, enabling modernization without the high cost and disruption of a complete overhaul.

For Australian government leaders tasked with navigating the next phase of digital service delivery, the message is clear. The tools to build a more efficient, responsive, and secure public sector are available. The key is to build this future on a foundation of verifiable trust, where security is not an afterthought but the verified starting point for all innovation.