Application Control and Allowlisting
Products that control which applications, scripts and libraries may run on endpoints, usually through default-deny allowlisting, plus tools that limit what approved applications can access. Endpoint privilege management is included when it is sold together with application control. Behavioral threat detection belongs in EDR.
This category lists 8 products that decide which software may run on an endpoint. Most work on a default-deny basis: anything not on the approved list is blocked, including unknown ransomware and unapproved installs. EDR tools watch what a program does after it starts; these tools decide before it starts.
ThreatLocker Allowlisting builds the allowlist in a learning mode, and ThreatLocker Ringfencing limits what an approved app can reach, so Word can edit documents without launching other programs. Heimdal Application Control with AppFencing sets permissions by file path, vendor or certificate. PC Matic allowlists applications, certificates and scripts. Idemeum Application Allowlisting covers Windows and macOS, with a catalog of common apps you can approve in one click. Airlock Digital is built around defining which software is trusted before it runs. Securden combines application control with endpoint privilege management, so standard users can run approved apps with admin rights without being local admins.
When you compare them, check how the allowlist is built and kept current, how a user asks for a new app, and whether the tool also controls scripts and libraries.
Products
8Deny-by-default allowlisting blocks unapproved software, scripts and ransomware; the ThreatLocker agent auto-catalogs apps into policy suggestions.
Application containment that limits what trusted apps such as Microsoft Office, Zoom and PowerShell can access.
Zero Trust endpoint protection that uses allowlisting and Learning Mode to control which applications run and stop ransomware and zero-days before they execute.
Application control software for real environments that lets teams define trust before execution and enforce gradually toward deny by default.
Application control for IT professionals and MSPs that blocks or allows apps by file path, MD5 hash, or certificate and logs executions in real time.
Allows only approved applications to run, blocking malware, ransomware, and other untrusted software.
Securden tool that grants just-in-time admin rights and controls which applications run on Windows, Mac and Linux endpoints.
Application allowlisting endpoint security for MSPs with cloud-based management, vulnerability scoring and US-based support.