Why we're taking cloud off the internet

Since June 2025, Vocus has carried Starlink traffic into customers' networks without touching the public internet. Now we're extending that private path all the way to the cloud. Here's why it matters.

According to the Australian Signals Directorate (ASD), the first sign of an impending cyber attack is usually threat actors sweeping an organisation's internet protocol (IP) addresses to see what answers back.

Across 1200 incidents in FY25, ASD found that sort of sweep preceded a successful attack 41 per cent of the time. Denial of service attacks, where a target IP address is flooded with traffic, were the first sign 31 per cent of the time.

Both techniques need a front door they can reach from the internet. A connection with no internet address gives an attacker nothing to knock on. Taking critical workloads off the internet is possibly the single most effective thing any organisation can do to shield itself.

This is not a theoretical risk – just last month in the United States, water utilities in seven states discovered threat actors had taken control of their Programmable Logic Controllers and degraded water operations. The FBI has now issued advice to take operational technology controllers off the public internet.  

The question customers asked us

Last June we launched Starlink Ethernet Access, an Australian first, handing satellite traffic straight into the Vocus private network at peering points in Sydney and Perth.

It means that traffic stays off the public internet, and gets delivered directly into customer networks or cloud services using the Vocus private network, which switches traffic at the hardware MAC address level, not internet protocol. 

This then enable customers to then use their own private network addressing scheme, separate to the internet's.

Demand has been strong from critical infrastructure operators: water and sewerage, energy, defence, food distribution and healthcare.

However, these customers asked the obvious next question. Their applications sit in a data centre or a hyperscaler cloud – AWS, Azure, Google Cloud or Oracle – and the stretch between our network and that compute often still crossed the public internet inside an encrypted tunnel.

The Australian Signals Directorate now warns against trusting encryption alone. Traffic captured today can be stored and decrypted later, once computing power catches up. Every major power is working on quantum computing, and a breakthrough could hand a nation state the keys to your traffic.

Built for Starlink, ready for others

Vocus Satellite Private Cloud closes that gap. Traffic runs from the Starlink terminal on the ground, up to space, down into our private national network and on to our private cloud data centre, without ever carrying an internet address. From there we connect customers to the hyperscalers over a private link.

Nothing in the path touches the internet, from a mine site terminal to a virtual machine in Perth, or from an energy substation in the Mallee to a data centre in Melbourne. It is another Australian first, delivered as a single managed service.

A mine site, a remote depot, a vessel or a defence facility now gets the same private route to compute that a city office reaches over fibre.

Amazon Leo is being designed around the same idea, and we are glad it is coming. In the meantime, Vocus customers can run this model in Australia today, over Starlink.

Critical infrastructure operators are equally focused on diversity, and recent outages have shown what happens when a business depends on one network or one provider. Vocus will provide Telesat Lightspeed services as they come online, and the private model we built for Starlink is designed to run over other constellations as they arrive.

The Australian Defence Force treats this as a priority, allocating up to $7.2 billion for multi-orbit satellite communication over the next decade. Private connectivity that avoids the internet is an essential ingredient of that.

The ASD’s new ‘three month’ recommendation

ASD's CI Fortify guidance asks critical infrastructure operators to prove they can isolate their operational technology from every other network for three months and keep running.

It is an extremely high hurdle to clear, and taking the internet out of the network path is a large step in the right direction.

Ask your provider how much of the route between your remote sites and your cloud servers they can take off the internet today. If the answer is anything other than "all of it", talk to us.