Downer tightens endpoint security as tenders demand cyber controls

Downer Group is increasing its use of endpoint security controls as cyber security requirements become more common in tenders and requests for information, according to a 28 September 2026 report by iTnews.

Downer's head of security engineering and platforms Aidan Turner told Gartner’s IT Symposium/Xpo that the company had invested in ThreatLocker endpoint security this year, after a proof of concept in 2025.

According to reporting in iTnews, Turner said the adoption was not prompted by a major incident, but by contract compliance and risk associated with local administrator access. The report said Downer is using the software for application control, elevation control and management of privileged access.

Turner was reported as saying cyber security and zero trust requirements are now appearing in customer bid documents, making them part of Downer’s tender process and its work to meet customer and regulator expectations.

The iTnews report said Downer’s investment in ThreatLocker was partly linked to a new contract won at the start of 2026 that included strict Essential Eight maturity level two requirements, which required application control. The Essential Eight is the Australian Signals Directorate’s baseline cyber mitigation framework.

Primary material from Downer does not identify the specific contract referenced in the iTnews account. In a separate company announcement dated 11 September 2025, Downer said it had been awarded a new Australian Department of Defence base and estate services contract valued at about $3.05 billion over an initial six-year term.

Downer’s website says the company provides integrated Defence base and estate management services across Australia and New Zealand, supporting critical infrastructure and facilities. The company also says it is listed on the Australian Securities Exchange and the New Zealand Exchange and employs more than 26,000 people.

According to iTnews, Turner said Downer previously had more than 1000 users with local administrator rights when he joined the company five years ago, and that the number is now well under 100, particularly since the introduction of ThreatLocker.

The report attributed the historical level of administrator access partly to Downer’s operational technology environments, where staff may need to use older proprietary software and hardware. Turner was reported as saying the company had been uncomfortable giving users full control over devices, but had to manage that requirement in some settings.

ThreatLocker’s elevation control module allows standard users to run specified applications with local administrator privileges without granting the user standing local administrator rights, according to the iTnews report, citing ThreatLocker.

Turner was reported as saying the software allowed Downer to remove local administrator privileges while still enabling staff who interact with operational technology systems to do their work.

The report said Downer now analyses new privileged access requests rather than granting them by default. Turner was reported as saying only one in every 50 people who request privileged access ultimately receives it, while other requests are rejected or handled by creating a ThreatLocker policy to remove the need for standing local administrator privilege.

Separately, a StockAnalysis transcript of Downer’s H1 2026 earnings call, dated 18 February 2026, said the company’s work in hand grew 8.9 per cent to $38.2 billion, with growth in facilities, energy and utilities, and new wins, renewals and extensions across areas including defence.