Cloud adoption has gone from a “strategic initiative” to business as usual in Australia. Government agencies, businesses, and mid-market companies are now relying on cloud platforms to power their operations, store sensitive data and grow quickly.
But when cloud security incidents happen, the same question always seems to come up.
“Wasn’t the cloud provider supposed to have handled that?”
The problem is this single misunderstanding has become one of the most common and most worrying risks in Australian cloud environments. Not because organisations aren’t doing their due diligence – but because the picture of accountability in the cloud is just not clear enough.
The result is a grey area where security vulnerabilities quietly build up until disaster strikes.
The shared responsibility model – a clear idea on paper but a mess in practice
Most major cloud providers operate under a shared responsibility model. On paper, it looks pretty straightforward:
- The cloud provider takes care of the physical data centres, the underlying infrastructure and the core platform services
- The customer is responsible for how the services are set up, who has access, how data is protected and how workloads are secured.
But in reality, the line between the two gets blurry.
Cloud providers are responsible for the physical data centres, the underlying infrastructure and the core platform services. But Australian organisations are still on the hook for how services are configured – including who has access, how data is protected and how workloads are secured.
What makes the line shift
The line changes depending on:
- What service model you’re using (IaaS, PaaS, SaaS)
- The choices you’ve made when setting up your cloud services
- How you’re managing identities, networks and data
Many Australian organisations assume that by moving more services into managed cloud platforms, their security responsibilities just magically disappear. They don’t. They just change.
How shared responsibility confusion can create real risks
Cloud security incidents don’t usually happen because the provider has failed to secure their platform. They happen because the customer doesn’t understand what they’re accountable for.
Common examples in Australian environments
- Storage buckets exposed to the internet
- Over-permissive access controls
- Lack of logging or monitoring
- Data being stored or transferred without encryption
- Insecure integrations between cloud and on-premises environments
These aren’t cloud provider failures. They’re customer responsibility failures.
What makes this especially worrying in Australia is the regulatory environment. There are privacy obligations, critical infrastructure laws and mandatory incident reporting – and none of those shift to the cloud provider just because the data is hosted off-site.
From a regulator’s perspective, accountability is still firmly with the organisation that owns the data.
Misconceptions that still plague Australian businesses and government agencies
Despite years of cloud adoption, several misconceptions are still going around.
“The cloud provider takes care of security”
Cloud providers do handle some bits of security, but not all of it. They don’t take care of access controls, data classifications or incident response for you.
“Default settings are secure enough”
Default cloud configurations are all about ease of use, not security. A lot of breaches come from services being deployed quickly without ever being properly hardened.
“Our on-prem security model still applies”
Old-school perimeter-based security just doesn’t translate to cloud environments. In the cloud, identity is the new perimeter – and many organisations struggle to adapt.
“SaaS means no security responsibility”
Even when you’re using SaaS, you’re still on the hook for user access, data governance, integrations and monitoring.
“Investing in security tools means security is sorted”
Cloud environments can be full of security tools and still have a complete lack of clarity about who’s on the hook for what.
Why accountability is more important than tools
Australian organisations often throw a lot of money at cloud security tooling – CSPM, CNAPP, identity platforms and monitoring services. But tools don’t assign accountability.
Without clear ownership:
- Alerts get ignored because nobody’s in charge
- Misconfigurations persist because teams think someone else is going to fix them
- Incidents escalate because nobody knows who’s responsible
- Reporting obligations become a nightmare under pressure
Cloud security failures are often as much about governance as they are about technology. Accountability determines whether problems get spotted early or get blown up in public.
How Kerner Norland approaches cloud security accountability
At Kerner Norland, cloud security engagements start with one simple idea: clarifying accountability before getting into controls or frameworks.
We don’t start with tools or frameworks. We start with making sure everyone knows what they’re responsible for.
Ownership mapping – who’s doing what
We explicitly define who’s in charge of:
- Identity and access management
- Network exposure
- Data protection
- Logging and monitoring
- Configuration management
- Incident response and reporting
This gives a clear line of sight about who’s accountable for what.
Environment-specific responsibility models
Accountability changes depending on what service model you’re using (IaaS, PaaS, SaaS). We tailor our responsibility frameworks to match how services are actually used, not how they’re described in vendor documentation.
Integrating security, IT and risk teams
Cloud accountability often falls between teams. We make sure the technical owners are talking to the business team so that security decisions support compliance, resilience and operational continuity.
Evidence-based assurance
We check if the responsibilities are being met in practice, not just written down. This includes configuration reviews, access analysis and recovery readiness checks.
Board-level visibility
Executives and boards need a clear sense of who’s in charge and who’s still on the hook when things go wrong. We make the technical stuff make sense in business terms.
The end result isn’t just a better security posture – it’s confidence that when a disaster strikes, you know who’s answerable.
Why this is really important for Australian businesses right now
Cloud disasters aren’t some far-off nightmare anymore. Regulators expect the same level of care and management for cloud risks as they do for on-prem systems.
So when things go wrong, you can’t just shrug and say “we thought the supplier took care of it” – that just won’t fly.
As cloud systems get more and more complicated, the gaps in accountability are costing more and more. Businesses that do well aren’t the ones with the most gadgets – it’s the ones that keep a clear picture of who’s in charge.
What leaders should really be asking
The right question isn’t “are we using cloud services that are secure?” The real question is: can we pinpoint exactly where our responsibilities kick in and where they stop – and can we prove it?
If you can’t give a clear answer, the risks are likely already there waiting.
It’s time to take action
If your business is still in the dark about who’s responsible for what across your cloud setup, now’s the time to get a handle on it.
A Cloud Security Consultation with Kerner Norland is here to help you sort out accountability, uncover any hidden risks and get your cloud security lined up with what the Aussie regulators and your business need.
And remember – in the cloud, sharing the responsibility isn’t the same as sharing the blame.