Ransomware that can’t start
If it’s not on your list, it doesn’t run. Most ransomware and unapproved software is stopped before it executes, so there’s nothing loose to chase.
Application controlInternal research
Only what you approve can run.
Most endpoint tools catch threats after they run, so there's always a window. Application control closes it, and it's one of the Essential Eight.
Free. No fit, no obligation.
The problem
Detection always arrives a step late.
Traditional endpoint security is default-allow. Anything runs unless it's already known to be bad, and your detection tools raise the alarm once something starts. That leaves a window between the moment code runs and the moment someone acts on the alert. Attackers work inside it.
Application control inverts the model. It's default-deny: nothing runs unless it's on your approved list. In a living-off-the-land attack, Office launches PowerShell to copy files to the cloud. A detection tool often won't flag it in time. Deny-by-default closes that path before it opens.
One of eightApplication control is one of the Essential Eight strategies the ASD asks every organisation to apply.
Architecture
Three jobs people put in one basket.
Sort these out before you shop for a tool.
- 01
Device management
Tools like Intune and Jamf deploy and manage software across your fleet. Useful, but they don’t decide what is allowed to run.
- 02
Application control
Deny-by-default execution. Only approved software runs, and approved software is fenced in so it can’t be misused. This is the page you’re on.
- 03
Vulnerability management
Finding and fixing the weaknesses in the software you do run. A different job again, and the hygiene layer of the endpoint.
Application control
Application control has two halves.
Blocking the bad is only one side of it.
- 01
Allowlisting
Only the software you approve is allowed to run. Everything unknown is denied by default, so ransomware and unsanctioned tools never get to start.
- 02
Ringfencing
Approved software is fenced in: which applications it can call, which files and registry keys it can reach, and whether it can go online. Ringfenced, a SolarWinds-style agent reaches its update address and nothing else.
What you get
What deny-by-default gives you.
Judge any option against what it actually prevents.
An Essential Eight control you can evidence
Application control is one of the eight. Done properly it maps to the maturity levels, and the same controls produce the audit evidence to prove it.
Less noise to chase
Deny-by-default shrinks what your detection layer ever has to look at, so your team spends less time triaging things that should never have run.
What to look for
What makes modern allowlisting workable.
The old objection to allowlisting was the admin load: approving every application by hand looked like a full-time job. That objection has largely dissolved, and how far each tool dissolves it is where the real difference sits. These are the capabilities that let a lean team run deny-by-default.
A maintained built-in catalogue
A deep, vendor-maintained library of known-good software with tracked file hashes, so a routine update doesn’t suddenly get blocked.
Learning mode
The tool watches your environment and auto-builds the baseline of what already runs, so your first list reflects your real fleet.
Self-service approval
Users request an unlisted application and get a fast, controlled decision, so the long tail doesn’t pile onto IT.
Ringfencing
Boundaries around what an approved application can touch, so a trusted tool can’t be turned against you.
Elevation control
Local admin rights removed and granted just for the specific task, so users aren’t running as admin all day.
Storage and device control
Rules for what can read from and write to removable media and network storage.
Maturity
Where most teams sit today.
Application control maturity, tier by tier.
Focused
Built-in tools like WDAC or AppLocker configured once and rarely revisited, or nothing at all. The rules drift as software changes and nobody updates them. Many mid-market teams sit here.
Typical features
- Built-in WDAC or AppLocker, set once
- Rules rarely updated as software changes
- Local admin rights left in place
- Gaps found when something gets through
Broad
Deny-by-default allowlisting with a maintained catalogue and learning mode, ringfencing on the applications that matter, and local admin clawed back. It maps to the earlier Essential Eight maturity levels.
Typical features
- Deny-by-default allowlisting
- A maintained catalogue of known-good software
- Learning mode before enforcement
- Ringfencing on the riskiest applications
- Local admin clawed back
- Approval requests handled in hours, not days
Best fit if you’re being targeted
Comprehensive
Everything Broad does, plus full ringfencing, storage and elevation control across the fleet, and the driver control the top Essential Eight level asks for. Demanding to reach, and worth it if ransomware is a live concern or the top level is your target.
Everything in Broad, plus
- Ringfencing across the whole fleet
- Storage and USB control
- Elevation on request, not standing admin
- Kernel-level driver control
- Evidence mapped to the top Essential Eight level
Application control
Prevention is one layer of three.
Prevention, detection and response, and hygiene share the same endpoint. Each makes the others' job smaller.
- 01
Prevention
Deciding what is allowed to run at all. This is the layer you’re on now.
- 02
Detection and response
Catching and containing whatever operates inside what you have allowed. Prevention shrinks its workload, and it backstops what prevention lets through.
Explore detection and response - 03
Hygiene
Closing the doors before anyone tries them. Patching and remediation shrink the surface both other layers watch.
Explore vulnerability management
Tekspace Research
We research the application control field.
Internal research
Application Control
Stops unapproved software running, and limits what approved apps can touch.
Vendors assessed
- Airlock Digital
- Carbon Black App Control
- Ivanti Application Control
- ManageEngine
- Microsoft App Control
- ThreatLocker
- Trellix Application Control
What we test
- Default-deny allowlisting
- Ringfencing trusted apps
- Maintained known-good catalogue
Same tests on every product. The scores publish with the benchmark.
The Tekspace Fit Method
How we’d help you choose.
Five steps from the problem you have to the product that fits, each leaving you with something you keep.
- 01
Understand
For application control
Agree what must never run, which apps carry the most risk, and the Essential Eight level you’re aiming for.
What you get
Problem brief. The agreed problem and what success looks like.
- 02
Map
For application control
Your fleet, the software it actually runs, who holds local admin, and how new software gets approved today.
What you get
Environment map. Your tools, identity, users and constraints.
- 03
Narrow
For application control
Platforms judged on catalogue depth, learning mode and ringfencing against your own estate.
What you get
Shortlist with reasons. Why each option made it, and why the rest did not.
- 04
Prove
For application control
Learning mode on a pilot group shows what would be blocked before anything is enforced.
What you get
Proof-of-value results. How each option did against your problem.
- 05
Enable
For application control
Move from audit to enforce in rings, train whoever approves requests, and hand the policy to your team to own.
What you get
Handover plan. Deployment, training and who owns what.
Questions we hear most.
Even where we have a product we like, we’ll recommend something else if your context calls for it.
- No consulting fee
- If nothing fits, we say so
- Vendor-independent
- Operating since 2006