[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"control:application-allowlisting":3},{"control":4,"products":25,"stories":55,"lessons":99,"related":124,"compare":145},{"slug":5,"name":6,"problem":7,"summary":8,"business_value":9,"vendor_questions":10,"risk_register":15,"framework_refs":16,"area":21,"updated_at":24},"application-allowlisting","Application allowlisting","Any program that reaches a computer can run, including ransomware and the remote-access tools attackers bring with them.","Only software you have approved is allowed to run, and everything else is blocked by default. Modern tools learn what each machine already uses, so the approved list can be built without months of manual work. Some also limit what approved programs may do, for example stopping a document editor from starting PowerShell.","Most ransomware and hands-on-keyboard attacks need to run something new on the victim's computers: a malware file, a remote-access tool, a network scanner. Blocking unapproved software stops that whole class of attack, instead of trying to recognise each new variant, which is why the Australian Signals Directorate lists application control in its Essential Eight. The real cost is the approval process: if approving new software takes days, people will look for ways around it.",[11,12,13,14],"How is the first approved list built, and how long does learning take before blocking starts?","How quickly can a blocked user get a legitimate program approved, and who approves it?","Can it also control scripts and libraries, and limit what approved programs may do, such as starting PowerShell or reaching the network?","How does it handle software updates without breaking the approved list?","Risk: ransomware or attacker tools running on workstations and servers. Control: application allowlisting in blocking mode on servers and endpoints, with a fast approval process for new software. Owner: endpoint or IT operations lead. Measure: share of endpoints in blocking mode and median approval time for new software.",[17,18,19,20],"CIS Controls 2.5 to 2.7: allowlist authorised software, libraries and scripts","ASD Essential Eight: application control","NIST SP 800-167: guide to application whitelisting","ISO\u002FIEC 27001:2022 A.8.19: installation of software on operational systems",{"name":22,"slug":23},"Configuration Management","configuration-management","2026-10-16T16:05:05.104475+00:00",[26,34,42,50],{"vendor_slug":27,"vendor_name":28,"vendor_logo":29,"product_slug":30,"product_name":31,"url":32,"description":33},"airlock-digital","Airlock Digital","\u002Fvendor-logos\u002Fairlock-digital.png","airlock-allowlisting","Airlock Allowlisting and Execution Control","https:\u002F\u002Fwww.airlockdigital.com\u002F","Blocks anything not explicitly trusted from running, with tools to build and keep the trusted list current as software changes.",{"vendor_slug":35,"vendor_name":36,"vendor_logo":37,"product_slug":38,"product_name":39,"url":40,"description":41},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","app-control-for-business","App Control for Business","https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fwindows\u002Fsecurity\u002Fapplication-security\u002Fapplication-control\u002Fapp-control-for-business\u002F","Application control built into Windows, formerly Windows Defender Application Control, with AppLocker as the older option. Policies can be managed through Intune.",{"vendor_slug":43,"vendor_name":44,"vendor_logo":45,"product_slug":46,"product_name":47,"url":48,"description":49},"threatlocker","ThreatLocker","\u002Fvendor-logos\u002Fthreatlocker.png","allowlisting","Allowlisting","https:\u002F\u002Fwww.threatlocker.com\u002Fcapabilities\u002Fallowlisting","Blocks any software that has not been approved, including ransomware and unapproved remote-access tools. A learning period builds the approved list first.",{"vendor_slug":43,"vendor_name":44,"vendor_logo":45,"product_slug":51,"product_name":52,"url":53,"description":54},"ringfencing","Ringfencing","https:\u002F\u002Fwww.threatlocker.com\u002Fcapabilities\u002Fringfencing","Limits what approved applications may do, such as which files, network locations and other programs they can reach, so a compromised application cannot be turned against you.",{"total":56,"last_days":57,"recent":58},156,127,[59,64,69,74,79,84,89,94],{"slug":60,"title":61,"published_at":62,"brief":63},"hackers-abuse-cruciferra-malware-as-a-service-to-conceal-infostealers-and-remote-7f29ea","Hackers Abuse Cruciferra Malware-as-a-Service to Conceal Infostealers and Remote Access Trojans","2026-11-12T12:48:24+00:00","Cruciferra MaaS tool used by hackers to hide infostealers and RATs via encryption.",{"slug":65,"title":66,"published_at":67,"brief":68},"huntress-uncovers-sckit-rogue-screenconnect-toolkit-hits-288-hosts-in-90-minutes-b71e75","Huntress uncovers SCKit: rogue ScreenConnect toolkit hits 288 hosts in 90 minutes","2026-11-12T11:34:07+00:00","Huntress uncovers SCKit: rogue ScreenConnect toolkit hits 288 hosts in 90 minutes.",{"slug":70,"title":71,"published_at":72,"brief":73},"ghostmap-android-flaw-can-leave-phones-stuck-in-crash-loop-bd3291","GhostMap Android Flaw Can Leave Phones Stuck in Crash Loop","2026-11-12T07:33:29+00:00","Android GhostMap flaw allows malformed APKs to cause crash loops, potentially requiring factory reset.",{"slug":75,"title":76,"published_at":77,"brief":78},"binance-warns-iphone-users-of-major-ios-flaw-that-may-expose-crypto-wallet-priva-3f4627","Binance Warns iPhone Users of Major iOS Flaw That May Expose Crypto Wallet, Private Keys","2026-11-10T11:40:16+00:00","Binance warns iPhone users of iOS flaw worse_query exposing crypto wallet data.",{"slug":80,"title":81,"published_at":82,"brief":83},"attackers-crash-claude-s-office-party-flaw-to-run-malicious-code-on-linux-b9fc0b","Attackers Crash Claude's 'Office Party' Flaw to Run Malicious Code on Linux","2026-11-09T18:08:30+00:00","Claude document-processing flaw allows attackers to execute malicious code on Linux systems.",{"slug":85,"title":86,"published_at":87,"brief":88},"new-abe-office-malware-bypasses-chrome-app-bound-encryption-to-steal-browser-pas-add9dd","New Abe Office Malware Bypasses Chrome App-Bound Encryption to Steal Browser Passwords and Cookies","2026-11-09T17:58:44+00:00","Abe Office malware bypasses Chrome's encryption to steal passwords and cookies.",{"slug":90,"title":91,"published_at":92,"brief":93},"hackers-deploy-armorsteal-malware-through-fake-software-downloads-to-steal-crede-9bfd18","Hackers Deploy ArmorSteal Malware Through Fake Software Downloads to Steal Credentials and Mine Crypto","2026-11-09T08:55:53+00:00","ArmorSteal malware spreads via fake software downloads, stealing credentials and mining crypto.",{"slug":95,"title":96,"published_at":97,"brief":98},"fake-github-security-tools-infect-over-2-000-pcs-with-malware-9cfa6a","Fake GitHub Security Tools Infect Over 2,000 PCs With Malware","2026-11-09T08:07:39+00:00","Fake GitHub security tools are spreading malware that disables defenses and steals data from over 2,000 PCs.",[100,104,108,112,116,120],{"slug":101,"title":102,"published_at":103},"cruciferra-maas-crypter-hides-infostealers-and-rats-from-security-tools-at-scale","Cruciferra MaaS Crypter Hides Infostealers and RATs from Security Tools at Scale","2026-11-12T13:20:21.227+00:00",{"slug":105,"title":106,"published_at":107},"ghostmap-android-flaw-can-brick-devices-in-permanent-crash-loop","GhostMap Android Flaw Can Brick Devices in Permanent Crash Loop","2026-11-12T08:20:40.452+00:00",{"slug":109,"title":110,"published_at":111},"critical-ios-flaw-exposes-crypto-wallet-keys-on-unpatched-iphones","Critical iOS Flaw Exposes Crypto Wallet Keys on Unpatched iPhones","2026-11-10T12:20:45.506+00:00",{"slug":113,"title":114,"published_at":115},"claude-office-party-flaw-enables-remote-code-execution-via-unsafe-file-handling","Claude 'Office Party' Flaw Enables Remote Code Execution via Unsafe File Handling","2026-11-09T19:21:46.98+00:00",{"slug":117,"title":118,"published_at":119},"abe-office-rat-bypasses-chrome-encryption-to-harvest-browser-credentials","Abe Office RAT Bypasses Chrome Encryption to Harvest Browser Credentials","2026-11-09T18:20:24.245+00:00",{"slug":121,"title":122,"published_at":123},"fake-github-security-tools-spread-malware-to-2000-users","Fake GitHub Security Tools Spread Malware to 2,000+ Users","2026-11-09T10:20:43.713+00:00",[125,129,133,137,141],{"slug":126,"name":127,"problem":128},"asset-inventory","Cyber asset inventory","You cannot patch, monitor or protect the devices, cloud resources and accounts you do not know you have.",{"slug":130,"name":131,"problem":132},"cloud-security-posture","Cloud security posture management (CSPM and CNAPP)","Misconfigured cloud storage and over-permissive roles get caught before they leak.",{"slug":134,"name":135,"problem":136},"saas-security-posture","SaaS security posture management (SSPM)","Business apps like Microsoft 365 and Salesforce stop leaking through risky settings and connected apps.",{"slug":138,"name":139,"problem":140},"endpoint-management","Device management (MDM and UEM)","Every company laptop and phone is known, encrypted, locked down and up to date.",{"slug":142,"name":143,"problem":144},"email-authentication","Email authentication (DMARC)","Nobody can send email that pretends to come from your domain.",{"microsoft\u002Fapp-control-for-business":146,"threatlocker\u002Fallowlisting":164,"airlock-digital\u002Fairlock-allowlisting":177,"threatlocker\u002Fringfencing":187},{"hq_country":147,"also_provides":148,"reviews":149,"affected":162,"reported":163},"US",[],[150,153,156,159],{"label":151,"url":152},"AV-TEST: business results for Microsoft Defender","https:\u002F\u002Fwww.av-test.org\u002Fen\u002Fantivirus\u002Fbusiness-windows-client\u002Fmanufacturer\u002Fmicrosoft\u002F",{"label":154,"url":155},"ITPro: Microsoft Defender for Business review (2024)","https:\u002F\u002Fwww.itpro.com\u002Fcloud\u002Fcloud-security\u002Fmicrosoft-defender-for-business-review-feature-filled-enterprise-security-for-small-businesses",{"label":157,"url":158},"Gartner Peer Insights: Microsoft Defender for Endpoint user reviews","https:\u002F\u002Fwww.gartner.com\u002Freviews\u002Fproduct\u002Fmicrosoft-defender-for-endpoint",{"label":160,"url":161},"PeerSpot: Microsoft Defender for Endpoint user reviews","https:\u002F\u002Fwww.peerspot.com\u002Fproducts\u002Fmicrosoft-defender-for-endpoint-reviews",311,128,{"hq_country":147,"also_provides":165,"reviews":166,"affected":176,"reported":176},[],[167,170,173],{"label":168,"url":169},"TechRadar: ThreatLocker review (2023)","https:\u002F\u002Fwww.techradar.com\u002Fpro\u002Fthreatlocker-review",{"label":171,"url":172},"Gartner Peer Insights: ThreatLocker Platform user reviews","https:\u002F\u002Fwww.gartner.com\u002Freviews\u002Fproduct\u002Fthreatlocker-platform",{"label":174,"url":175},"PeerSpot: ThreatLocker Zero Trust Platform user reviews","https:\u002F\u002Fwww.peerspot.com\u002Fproducts\u002Fthreatlocker-zero-trust-platform-reviews",0,{"hq_country":178,"also_provides":179,"reviews":180,"affected":176,"reported":176},"AU",[],[181,184],{"label":182,"url":183},"Gartner Peer Insights: Airlock Digital user reviews","https:\u002F\u002Fwww.gartner.com\u002Freviews\u002Fproduct\u002Fairlock-digital",{"label":185,"url":186},"PeerSpot: Airlock Digital Application Control user reviews","https:\u002F\u002Fwww.peerspot.com\u002Fproducts\u002Fairlock-digital-application-control-reviews",{"hq_country":147,"also_provides":188,"reviews":189,"affected":176,"reported":176},[],[190,191,192],{"label":168,"url":169},{"label":171,"url":172},{"label":174,"url":175}]