AS/400 IBM i Cyber Security Services Australia
AS/400 (IBM i) systems run core banking operations at many Australian financial institutions but are almost never included in modern security programmes. Intrix provides specialised security assessments, system hardening, and access control auditing for IBM i environments, helping banks and credit unions close this critical gap before it becomes a breach.
Most Critical Legacy Asset is a Blind Spot
Many of Australia’s largest financial institutions still rely on the incredible stability of AS/400 (IBM i) platforms for their core banking operations. But this stability has led to a dangerous misconception: that these systems are “secure by default” or “too old to be attacked.”
This is a critical blind spot. These legacy systems are often managed by teams with diminishing specialised skills and are rarely included in modern security programs. A compromise of your core banking system would be catastrophic. Intrix provides the rare, specialised expertise required to secure these critical assets.
Our Solution: Specialised AS/400 (IBM i) Security
AS/400 Security Assessment
A full security review of your IBM i environment, including system settings, object security, user profiles, and network access controls
System Hardening & Configuration
We provide hands-on, expert guidance to harden your AS/400, applying modern security principles to a legacy environment without disrupting operations
Access Control & Auditing
We implement and audit granular access controls to ensure only authorized users can access sensitive data and core banking functions
Why AS/400 Security is Overlooked in Australia
IBM i platforms are exceptionally stable, and that stability creates a false sense of security. Many institutions have run the same AS/400 configuration for over a decade with no incidents, which leads security teams to deprioritise it. But stability is not the same as security. AS/400 systems frequently run with default profiles, overprivileged user accounts, and object-level access controls that have never been audited. The Australian Prudential Regulation Authority explicitly requires that all information assets, including legacy platforms, be classified and protected under CPS 234. An unaudited IBM i environment is a direct compliance gap.
Frequently Asked Questions
What is an AS/400 IBM i security assessment?
An AS/400 IBM i security assessment is a structured review of your IBM i environment covering system values, user profiles, object authorities, network access controls, and audit journal configuration. Intrix identifies misconfigurations and access control weaknesses that standard security tools cannot detect because they are not built to inspect IBM i environments.
Which Australian industries still use AS/400 systems?
AS/400 and IBM i platforms remain in active use across Australian banking, credit unions, superannuation funds, and insurance companies. They are also found in manufacturing and government agencies where long-running batch processing and transaction systems are critical to operations.
Does an AS/400 assessment affect production systems?
No. Intrix conducts read-only assessments that do not interrupt production workloads. All review activity is performed against live configuration data without making changes to the environment until a remediation plan has been agreed with your team.
How does AS/400 security relate to APRA CPS 234?
CPS 234 requires APRA-regulated entities to maintain security controls over all information assets commensurate with their criticality and sensitivity, including systems managed by third parties. AS/400 platforms processing core banking data are high-criticality assets and must be included in your CPS 234 compliance programme. Intrix assessments produce the evidence APRA expects to see for legacy platform assurance.
Ready to Strengthen Your Security Posture?
Don’t wait for an incident. Our experts assess your security posture and build a protection strategy tailored to your needs