Application controlInternal research

Only what you approve can run.

Application control closes the window that detection leaves, and it’s one of the Essential Eight.

Scope your allowlistingSee the research

Free. No fit, no obligation.

The problem

Detection always arrives a step late.

Traditional endpoint security is default-allow. Anything runs unless it's already known to be bad, and your detection tools raise the alarm once something starts. That leaves a window between the moment code runs and the moment someone acts on the alert. Attackers work inside it.

Application control inverts the model. It's default-deny: nothing runs unless it's on your approved list. In a living-off-the-land attack, Office launches PowerShell to copy files to the cloud. A detection tool often won't flag it in time. Deny-by-default closes that path before it opens.

One of eightApplication control is one of the Essential Eight strategies the ASD asks every organisation to apply.

Architecture

Three jobs people put in one basket.

Sort these out before you shop for a tool.

  1. 01

    Device management

    Tools like Intune and Jamf deploy and manage software across your fleet. Useful, but they don’t decide what is allowed to run.

  2. 02

    Application control

    Deny-by-default execution. Only approved software runs, and approved software is fenced in so it can’t be misused. This is the page you’re on.

  3. 03

    Vulnerability management

    Finding and fixing the weaknesses in the software you do run. A different job again, and the hygiene layer of the endpoint.

Application control

Application control has two halves.

Blocking the bad is only one side of it.

  1. 01

    Allowlisting

    Only the software you approve is allowed to run. Everything unknown is denied by default, so ransomware and unsanctioned tools never get to start.

  2. 02

    Ringfencing

    Approved software is fenced in: what it can call, reach and connect to. Ringfenced, a SolarWinds-style agent reaches only its update address.

What you get

What deny-by-default gives you.

Judge any option against what it actually prevents.

Ransomware that can’t start

If it’s not on your list, it doesn’t run. Most ransomware and unapproved software is stopped before it executes, so there’s nothing loose to chase.

What to look for

What makes modern allowlisting workable.

These capabilities let a lean team run deny-by-default without approving every application by hand.

  • A maintained built-in catalogue

    A deep, vendor-maintained library of known-good software with tracked file hashes, so a routine update doesn’t suddenly get blocked.

  • Learning mode

    The tool watches your environment and auto-builds the baseline of what already runs, so your first list reflects your real fleet.

  • Self-service approval

    Users request an unlisted application and get a fast, controlled decision, so the long tail doesn’t pile onto IT.

  • Ringfencing

    Boundaries around what an approved application can touch, so a trusted tool can’t be turned against you.

  • Elevation control

    Local admin rights removed and granted just for the specific task, so users aren’t running as admin all day.

  • Storage and device control

    Rules for what can read from and write to removable media and network storage.

Maturity

Where most teams sit today.

Application control maturity, tier by tier.

  1. Focused

    Built-in WDAC or AppLocker set once and left to drift as software changes, or nothing at all. Many mid-market teams sit here.

    Typical features

    • Built-in WDAC or AppLocker, set once
    • Rules rarely updated as software changes
    • Local admin rights left in place
    • Gaps found when something gets through

  2. Broad

    Deny-by-default allowlisting with a maintained catalogue and learning mode, ringfencing on key applications and local admin removed. Maps to the earlier Essential Eight levels.

    Typical features

    • Deny-by-default allowlisting
    • A maintained catalogue of known-good software
    • Learning mode before enforcement
    • Ringfencing on the riskiest applications
    • Local admin clawed back
    • Approval requests handled in hours, not days

  3. Essential Eight’s top level starts here

    Comprehensive

    Everything Broad does, plus fleet-wide ringfencing, storage and elevation control, and Essential Eight’s top-level driver control. Worth it if ransomware is a live concern.

    Everything in Broad, plus

    • Ringfencing across the whole fleet
    • Storage and USB control
    • Elevation on request, not standing admin
    • Kernel-level driver control
    • Evidence mapped to the top Essential Eight level

Application control

Prevention is one layer of three.

Prevention, detection and response, and hygiene share one endpoint, and each shrinks the others’ job.

  1. 01

    Prevention

    Deciding what is allowed to run at all. This is the layer you’re on now.

  2. 02

    Detection and response

    Catching and containing whatever operates inside what you have allowed. Prevention shrinks its workload, and it backstops what prevention lets through.

    Explore detection and response
  3. 03

    Hygiene

    Closing the doors before anyone tries them. Patching and remediation shrink the surface both other layers watch.

    Explore vulnerability management

Tekspace Research

We research the application control field.

Internal research

Application Control

Stops unapproved software running, and limits what approved apps can touch.

Vendors assessed7 vendors assessed

  • Airlock Digital
  • Carbon Black App Control
  • Ivanti Application Control
  • ManageEngine
  • Microsoft App Control
  • ThreatLocker
  • Trellix Application Control

Examples of what we test

  • Default-deny allowlisting
  • Ringfencing trusted apps
  • Maintained known-good catalogue

Same tests on every product. The scores publish with the benchmark.

Questions we hear most.