What is application allowlisting?

Application allowlisting flips the security model. Antivirus and EDR work by blocking known-bad software; allowlisting works by only allowing known-good software. Everything else, including software nobody has seen before, gets blocked by default.

Why it works

Most malware succeeds because the operating system happily runs whatever an attacker delivers — macros, scripts, executables, DLLs, PowerShell commands. Allowlisting forces every executable to be pre-approved. A ransomware payload arrives on an endpoint — it has no chance to run because it's not on the approved list. Same for legitimate tools used maliciously (PsExec, mimikatz, Cobalt Strike), and same for one-off attacker binaries that signature-based AV has never seen.

How modern allowlisting works

Old-school allowlisting was painful to operate — every approval was manual. Modern platforms (ThreatLocker, Microsoft Defender Application Control, AppLocker) use:

• Learning mode — deploy to a test endpoint, watch what legitimate software actually runs, build the baseline
• Catalog libraries — pre-approved lists of major business software (Microsoft Office, Adobe, common LOB apps)
• Approval workflows — when users need new software, they request approval; the request gets evaluated centrally
• Ringfencing — even approved apps can be restricted in what they can do (PowerShell allowed for legitimate use but blocked from network connections to unusual destinations)

Best fit

Regulated industries (healthcare, defense contractors, financial services), security-mature SMBs, and any environment where ransomware impact would be catastrophic. ThreatLocker is the dominant SMB allowlisting platform; Microsoft Defender Application Control is built into Windows enterprise SKUs.