Airlock Allowlisting and Execution Control
Blocks anything not explicitly trusted from running, with tools to build and keep the trusted list current as software changes.
Configuration Management
Application allowlisting
Any program that reaches a computer can run, including ransomware and the remote-access tools attackers bring with them.
Addresses 127 stories in our coverage in the last 90 days 4 products that provide it
What it is
Only software you have approved is allowed to run, and everything else is blocked by default. Modern tools learn what each machine already uses, so the approved list can be built without months of manual work. Some also limit what approved programs may do, for example stopping a document editor from starting PowerShell.
How to value it
Most ransomware and hands-on-keyboard attacks need to run something new on the victim's computers: a malware file, a remote-access tool, a network scanner. Blocking unapproved software stops that whole class of attack, instead of trying to recognise each new variant, which is why the Australian Signals Directorate lists application control in its Essential Eight. The real cost is the approval process: if approving new software takes days, people will look for ways around it.
Questions to ask a vendor
- 1How is the first approved list built, and how long does learning take before blocking starts?
- 2How quickly can a blocked user get a legitimate program approved, and who approves it?
- 3Can it also control scripts and libraries, and limit what approved programs may do, such as starting PowerShell or reaching the network?
- 4How does it handle software updates without breaking the approved list?
For your risk register
- Risk
- Ransomware or attacker tools running on workstations and servers.
- Control
- Application allowlisting in blocking mode on servers and endpoints, with a fast approval process for new software.
- Owner
- Endpoint or IT operations lead.
- Measure
- Share of endpoints in blocking mode and median approval time for new software.
A starting point: set the owner and measure to fit your organisation.
Products that provide it
Listed alphabetically by vendor. A listing is not a recommendation: use the questions above to compare them, or tick up to 3 to see them side by side.
App Control for Business
Application control built into Windows, formerly Windows Defender Application Control, with AppLocker as the older option. Policies can be managed through Intune.
Allowlisting
Blocks any software that has not been approved, including ransomware and unapproved remote-access tools. A learning period builds the approved list first.
Ringfencing
Limits what approved applications may do, such as which files, network locations and other programs they can reach, so a compromised application cannot be turned against you.
Recent stories it addresses
156 stories in total- 12 Nov 2026Hackers Abuse Cruciferra Malware-as-a-Service to Conceal Infostealers and Remote Access Trojans
Cruciferra MaaS tool used by hackers to hide infostealers and RATs via encryption.
- 12 Nov 2026Huntress uncovers SCKit: rogue ScreenConnect toolkit hits 288 hosts in 90 minutes
Huntress uncovers SCKit: rogue ScreenConnect toolkit hits 288 hosts in 90 minutes.
- 12 Nov 2026GhostMap Android Flaw Can Leave Phones Stuck in Crash Loop
Android GhostMap flaw allows malformed APKs to cause crash loops, potentially requiring factory reset.
- 10 Nov 2026Binance Warns iPhone Users of Major iOS Flaw That May Expose Crypto Wallet, Private Keys
Binance warns iPhone users of iOS flaw worse_query exposing crypto wallet data.
- 9 Nov 2026Attackers Crash Claude's 'Office Party' Flaw to Run Malicious Code on Linux
Claude document-processing flaw allows attackers to execute malicious code on Linux systems.
- 9 Nov 2026New Abe Office Malware Bypasses Chrome App-Bound Encryption to Steal Browser Passwords and Cookies
Abe Office malware bypasses Chrome's encryption to steal passwords and cookies.
- 9 Nov 2026Hackers Deploy ArmorSteal Malware Through Fake Software Downloads to Steal Credentials and Mine Crypto
ArmorSteal malware spreads via fake software downloads, stealing credentials and mining crypto.
- 9 Nov 2026Fake GitHub Security Tools Infect Over 2,000 PCs With Malware
Fake GitHub security tools are spreading malware that disables defenses and steals data from over 2,000 PCs.
How we list vendors
- A product is listed because it provides the control. Nobody pays to be listed, and on story pages the examples rotate, so no vendor is always first.
- Vendor pages show both the vendor's own research and the incidents involving its products, from our own coverage. We do not leave either out.
- Our summaries are written by us, based on the vendors' own pages. Text in quotation marks or marked "in their own words" is the vendor's own, quoted from its website.
- Logos, product names and quoted text belong to the vendors and are shown to identify them.
- Something wrong? Use "Suggest a correction" on the vendor's page. A product we should look at? Email support@threatnoir.com.