A 2027 U.S.–China conflict with Australia aligned to the U.S. China trade stops immediately, Taiwan exports are slowed/limited, and China launches large-scale cyber disruption in waves. This is a planning scenario, not a forecast. Planning scenario, not a forecast. No end date is set.
Australia is the buyer. In 2023-24, imports of licences to reproduce and/or distribute computer software were 8,006 million dollars inside total digital-services imports of 18,499 million dollars. The calculated software-licence share of those digital-services imports is 43.3 percent. The ABS column is a licence category, often supplied by non-resident multinationals, and it is not a count of Australian software publishers.
The local MSP resells that foreign software as agent. Data#3 gross sales were 3,385,279 thousand dollars and the adjustment for sales recognised as agent was 2,478,297 thousand dollars in the year ended 30 June 2026. The calculated agent adjustment is 73.2 percent of gross sales. Software Solutions gross sales were 2.3 billion dollars and statutory software revenue was 78.1 million dollars.
The foreign product Australian firms run is still the vendor's cloud. Microsoft Cloud revenue was 168.9 billion dollars in the year ended 30 June 2025, and Australia appears on Microsoft's list of largest leased international locations. That lease is a site, not an Australian software-export industry.
When the foreign agent fails, Australian IT teams follow the vendor. The ACSC advisory's dated headings are 20 July 2024 and 21 July 2024. The calculated span between the two ACSC update headings is 1 day. The advisory does not print an Australian device count. CISA quotes 8.5 million Windows devices for the same update.
Data residency and support hours are local constraints on a foreign subscription. Data#3 is investing in a sovereign security operations centre in Australia to supplement the hybrid centre in Brisbane, and it describes an upgrade toward a 24x7 sovereign centre. Back-office operations are in Manila, and offices include Fiji. The annual report does not name a China office.
The buyer is already on imported licences. Software-licence imports were 8,006 million dollars in 2023-24. Total digital-services imports were 18,499 million dollars. Audiovisual services were 3,851 million dollars and advertising services were 6,642 million dollars in the same row. The calculated software-licence share of those digital-services imports is 43.3 percent.
A China trade stop does not replace that import with a domestic hyperscale publisher. Digital-services exports over 2009-10 to 2023-24 were 5 billion dollars and 1 percent of Other services exports. Annual digital-services imports in 2023-24 were 18.5 billion dollars in the prose, matching the table's 18,499 million dollars. The export total is a different, multi-year period.
The product fails in Australia when the foreign vendor pushes a bad update. The ACSC wrote the advisory for IT teams of organisations and government that use CrowdStrike. CrowdStrike's advice on that page is that the issue is not a cyber security incident or malicious activity. Remediation is the CrowdStrike customer portal.
The device the MSP cannot refresh is a second constraint. Closing inventory was 73.4 million dollars at 30 June 2026, up from 18.4 million dollars at 30 June 2025, because larger hardware orders were held ahead of price increases and supply constraints from global memory shortages. The report does not name Taiwan or China as the source of that shortage. All inventory was committed to customer orders.
Government buying concentrates the foreign product. In March 2026 the Digital Transformation Agency appointed Data#3 sole panel provider of Microsoft products and services to the Australian Government, for an initial five-year term with an option to extend one year. Data#3 has been the sole provider under the Volume Sourcing Arrangements since 2008.
The cloud under sensitive government systems has a hosting screen. The Hosting Certification Framework currently only applies to data centre providers and cloud service providers. That limit keeps this note on the software subscription and the MSP, not on data-centre construction.
Short-horizon outage analog: the calculated span between the two ACSC update headings is 1 day. The headings are 20 July 2024 and 21 July 2024. This is a public-note gap. It is not a measured restoration time, and the page does not print 19 July.
The same week’s foreign-product breadth, from CISA, is 8.5 million Windows devices. Use it as the scale of the update Australian teams were remediating. Do not relabel it as an Australian installed base.
Half-year commercial analog: Microsoft incentive changes from 1 January 2025, with the first half of the year ended 30 June 2026 most affected. No first-half dollar is printed. The staffing rate beside that half is the FY2024-25 hotline average of 116 calls per day.
The calculated decline in margin on gross sales is 0.6 percentage points. The full-year prints are 9.6 percent and then 9.0 percent. Closing inventory was 73.4 million dollars at the same year-end, against 18.4 million dollars. The inventory figure is a stock, not a 90-day price index.
Wave 1 direct is the foreign SaaS product on Australian Windows hosts. The observed analog is the ACSC CrowdStrike advisory, a 1-day gap between the 20 July 2024 and 21 July 2024 headings, and CISA's quote of 8.5 million Windows devices. ACSC says that event is not malicious activity. Device refresh inventory is Wave 1 indirect because the crashed host is a device the MSP ships or refreshes. Putting a future PRC campaign on this week-1 path is a planning inference.
Wave 2 direct is the local control room and the large or government tenant: the sovereign centre, the government Microsoft panel, and large paid-cloud buyers. Wave 2 indirect is the commercial channel: imported licences and agency resale. ACSC's statement that state-sponsored actors target government, critical infrastructure, and businesses is the reason those tenants are in this wave. The order is a planning inference.
Wave 3 direct is the distributed buyer: small and medium paid-cloud users, where 2019-20 adoption was 49 percent and 76 percent in the bands used here and where ACSC prints average report costs of 56,600 dollars and 97,200 dollars. Wave 3 indirect is Manila and Fiji support. The order is a planning inference. The cost figures are self-reported averages per report.
origin sharepercent
The calculated software-licence share of those digital-services imports is 43.3 percent.
ABS digital services in the balance of paymentsThe calculated agent adjustment is 73.2 percent of gross sales.
Data#3 FY2026 annual reportoutage daysdays
The calculated span between the two ACSC update headings is 1 day.
ACSC CrowdStrike outage advisorymargin changepercentage points
The calculated decline in margin on gross sales is 0.6 percentage points.
Data#3 FY2026 annual reportau msp headcountpeople
Headcount at year-end was 1,427 people.
Data#3 FY2026 annual reportratespercent
Total margin on gross sales was 9.0 percent.
Data#3 FY2026 annual reportau inventorymillion dollars
Closing inventory was 73.4 million dollars.
Data#3 FY2026 annual reportFollow the vendor portal and ignore unofficial code. The calculated span between the two ACSC update headings is 1 day. The hotline on the advisory is 1300 CYBER1 (1300 292 371).
Separate committed hardware from the subscription. Closing inventory was 73.4 million dollars and was committed to customer orders. The filing does not name Taiwan as the source.
Check the agency book. The calculated agent adjustment is 73.2 percent of gross sales. Statutory software revenue of 78.1 million dollars is the revenue line, and 2.3 billion dollars is gross sales.
Staff the buyer desk to the printed daily load. The hotline averaged 116 calls per day in FY2024-25. That average is a planning baseline, not a forecast of a war week.
Watch margin on gross sales against 9.0 percent. The calculated decline in margin on gross sales is 0.6 percentage points from the prior year print of 9.6 percent. Microsoft incentives changed from 1 January 2025.
For government tenants, confirm the hosting level under the cloud, not a new data-centre project. The framework currently only applies to data centre providers and cloud service providers, and registration of prospective providers was paused from 3 November 2025 until reforms are done. Already certified providers are not affected by that pause.
Days between official ACSC remediation headings. Act when a foreign SaaS update is still on unofficial workarounds more than 1 day after the first official warning. One day is the calculated span between the 20 July 2024 and 21 July 2024 ACSC headings. This is a planning line. ACSC does not publish it as a restoration standard.
Software-licence imports, million dollars. Act when annual software-licence imports print below 8,006 million dollars. That figure is the 2023-24 licences-to-reproduce-and-distribute-computer-software column. This is a planning line at the latest opened year. ABS does not publish it as a minimum.
MSP closing inventory, million dollars. Act when Data#3 closing inventory prints above 73.4 million dollars. That figure is the 30 June 2026 stock, already up from 18.4 million dollars and fully committed to orders. This is a planning line. The annual report does not publish it as a covenant.
Margin on gross sales, percent. Act when margin on gross sales prints below 9.0 percent. That figure is the year ended 30 June 2026. The prior year was 9.6 percent. This is a planning line at the latest print, not a banking covenant.
Australian Cyber Security Hotline, calls per day. Act when the hotline average holds above 116 calls per day. That figure is the FY2024-25 average, up from 100. This is a planning line for desk staffing. ACSC does not publish it as a crisis threshold.
Keep gross sales and statutory revenue apart. The agent adjustment is the larger number.
Remediate from the vendor portal named by ACSC, and reject unofficial code.
Treat 73.4 million dollars of inventory as committed hardware, not as a Taiwan-origin reserve.
Map paid-cloud dependence with the 2019-20 size shares until a newer size table is opened.
Staff the first week to a 1-day official-note gap and the year to 116 hotline calls per day.
Keep self-reported cyber costs by size separate from the reseller's 2.3 billion dollars of software gross sales.
Use the five-year Microsoft panel as the procurement path.
Apply the hosting framework only to the data centre and cloud providers under that software, and note the certification pause from 3 November 2025.
Treat Australia as a leased site and a customer market. Microsoft names Australia among leased international locations and does not print an Australia revenue line.
Expect the local partner to recognise most software gross sales as agent. Data#3's calculated agent share is 73.2 percent of gross sales.
Days between a bad foreign update and the official remediation note The calculated span between the two ACSC update headings is 1 day. The page does not give an Australian device count.
Hotline calls per day The FY2024-25 average was 116 calls per day, up from 100. Over 42,500 calls were received.
Margin on gross sales Total margin on gross sales was 9.0 percent. The calculated decline in margin on gross sales is 0.6 percentage points.
Closing inventory committed to orders Closing inventory was 73.4 million dollars, against 18.4 million dollars a year earlier, and all of it was committed.
Software-licence imports The calculated software-licence share of those digital-services imports is 43.3 percent. The level is 8,006 million dollars.
The unpublished primary for the vendor home market, which this buyer report does not invent, is Microsoft revenue from customers located in China. Australia's own unpublished primary on the buyer side is a Taiwan share of the devices in the 73.4 million dollar inventory and a partner-country split of the 8,006 million dollar software-licence import. Computers from Taiwan were 423.5 million dollars on the national goods-and-services sheet. That line is not the inventory split and not the licence split.
Also unpublished: an Australian CrowdStrike device count; support-hour overlap between Manila or Brisbane and a U.S. vendor roster; China or Taiwan dollars inside CrowdStrike's rule that no country other than the United States was 10 percent or more of revenue; a 2024-25 paid-cloud percentage by business size; and an MSP purchase that names Taiwan. Computers from Taiwan were 423.5 million dollars. That national import is not a foundry share. The memory-chip shortage is not relabelled as Taiwan.
cyber.gov.ausec.govcompany-announcements.afr.comabs.gov.audfat.gov.au
Calculated figures use two numbers from the cited page and are labeled. The 43.3 percent licence share is 8,006 divided by 18,499. The 73.2 percent agent share is 2,478,297 divided by 3,385,279. The 0.6 percentage-point margin move is 9.6 minus 9.0. The 1-day span is the gap from 20 July 2024 to 21 July 2024. The 5 billion dollar export total is not the same period as the 18,499 million dollar import year.
ACSC cost averages are self-reported costs per report. They are not Data#3 revenue and not Microsoft Cloud revenue. Gross sales are non-IFRS. The Hosting Certification Framework pause and the three certification levels apply to data centre and cloud providers. Wave order is a planning model. The 9 July 2024 APT40 advisory is not the 19 July 2024 content update.
cyber.gov.aucyber.gov.aucompany-announcements.afr.comhostingcertification.gov.au
| Node | Primary impact | Time horizon | Cyber wave | Evidence |
|---|---|---|---|---|
| Imported software licences | Australia buys software licences from non-resident firms, and the supplying country is unpublished. | 1-6 months | Wave 2 (indirect) | ABS digital services |
| Foreign SaaS used by Australian firms | Australian IT teams recover the foreign product from the vendor portal when an update fails. | 0-3 months | Wave 1 (direct) | ACSC CrowdStrike advisory; CISA device quote |
| Software resale on an agency basis | Most software gross sales are not statutory revenue because the reseller is the agent. | 1-6 months | Wave 2 (indirect) | Data#3 FY2026 annual report |
| Managed services and the sovereign SOC | The local centre is the control room, and the Falcon fix still comes from the vendor portal. | 1-6 months | Wave 2 (direct) | Data#3 FY2026 annual report; ACSC advisory |
| Government Microsoft panel | Federal Microsoft buying sits on one reseller panel, and hosting certification screens the cloud under it. | 1-6 months | Wave 2 (direct) | Data#3 FY2026 annual report; Hosting Certification Framework |
| Device refresh inventory | Hardware held for customer orders is the refresh constraint, and the filing does not name Taiwan. | 0-3 months | Wave 1 (indirect) | Data#3 FY2026 annual report |
| Small paid-cloud buyers | The smallest employers are the least dense paid-cloud users and the distributed later target. | 12+ months | Wave 3 (direct) | ABS 2019-20; ACSC 2024-25 |
| Medium paid-cloud buyers | Mid-size employers are already majority users of paid cloud. | 12+ months | Wave 3 (direct) | ABS 2019-20; ACSC 2024-25 |
| Large paid-cloud buyers | The largest employers are the densest paid-cloud users, and the reseller software book is the enterprise channel. | 1-6 months | Wave 2 (direct) | ABS 2019-20; Data#3; ACSC 2024-25 |
| Manila and Fiji support | Back-office hours sit in Manila and a Fiji branch, not in a China site. | 1-6 months | Wave 3 (indirect) | Data#3 FY2026 annual report |