In short
Application whitelisting, now usually called application allowlisting, is a security control that lets only approved applications run on a device and blocks everything else by default. Rules identify approved software by publisher certificate, file hash or path. It is highly effective against malware and unapproved tools, but needs an audit phase and a process for approving new software.
Get a quote for application whitelisting
Tell us roughly how many users or sites you have and we will reply by email with options and a quote.
What application whitelisting is
Application whitelisting is a default-deny approach to software. You define the applications that are allowed to run, and the device refuses to run anything that is not on the list, whether it is malware, an unapproved remote access tool, a game or a script downloaded from an email.
The NCSC and much of the industry now say allow list and deny list (or allowlisting and blocklisting) instead, and we use those terms on this page. The idea is the same.
The NCSC's guidance on using third-party applications on devices is direct about it: allow lists are a much better strategy than deny lists, and although they carry an administrative burden, they are a highly effective way of stopping malicious code running and can be well worth the cost. It also recommends joining the approval process up with software licensing and procurement, so new software is approved once, in one place.
Application control is the broader term. It covers allowlisting, blocklisting and controls in between, such as blocking named categories of application or letting a vendor's reputation service decide.
Allowlisting vs blocklisting
Both approaches have a place. The difference is what happens to software nobody has thought about yet.
| Allowlisting (default-deny) | Blocklisting (default-allow) | |
|---|---|---|
| Default for unknown software | Blocked | Allowed |
| Protection against new malware | Strong: it is not on the list, so it does not run | Depends on other tools recognising it |
| Protection against legitimate tools misused by attackers | Strong, if those tools are not approved for that user or device | Only for the tools you have listed |
| Effort to set up | Higher: you must discover and approve what people use | Low: list the few things you want to stop |
| Effort to run | A process for approving new software and updates | Keeping the block list current |
| Typical use | Servers, kiosks, fixed-function devices, high-risk users, then wider estates | Stopping specific unwanted apps, such as unapproved remote access or file-sharing tools |
Many organisations start with blocklisting the obvious risks, then move high-value systems to allowlisting. Servers and fixed-function devices are good first candidates because their software rarely changes.
Not sure which option fits? Ask us
Tell us what you need and we will recommend the right option for your organisation, with a quote.
How allowlisting rules identify software
Every allowlisting product needs a way to recognise approved software. The usual rule types are:
- Publisher or certificate rules allow anything signed by a trusted software publisher. They survive updates, so they are the lowest-maintenance option, and Cyber Essentials' allow listing option is built around code signing.
- Hash rules allow one exact file. They are precise but break every time the file is updated.
- Path rules allow anything in a protected folder, such as the program files directory. They are convenient but only safe if ordinary users cannot write to that folder, which is one more reason to remove local admin rights.
- Reputation or classification rules let a vendor's service decide, based on what it knows about a file. WatchGuard's Zero-Trust Application Service works this way: applications are blocked until they are classified as safe.
- Managed installer rules trust software deployed by your management tool, so anything IT installs is allowed automatically.
Scripts and macros need thought too. Allowlisting executables but leaving script interpreters open to everyone leaves a gap attackers know well. Our endpoint hardening checklist covers macro and script controls.
Rolling out allowlisting: audit mode first
The NCSC notes that most platforms can run application control in a reporting mode that blocks nothing but records what would have been blocked. That is the safe way in:
- Choose the scope: start with servers, a fixed-function group or one department rather than the whole estate.
- Run in audit mode: collect what actually runs over a full business cycle, including month-end and occasional tools.
- Build the rules: prefer publisher rules, add managed installer trust, and use hashes only where nothing else works.
- Agree the request process: how a user asks for new software, who approves it and how quickly, linked to purchasing and licensing.
- Enforce for a pilot group: watch for blocked legitimate software and adjust.
- Extend in waves and keep reviewing blocked events; they show both attacks stopped and gaps in the rules.
Record the approach in your endpoint security policy, so staff know software requests go through IT.
Is application whitelisting the right fit for you?
We will check it against your systems and requirements and recommend the right option.
Application control tools we supply
Several platforms we supply include application control, from full default-deny to targeted blocking. Pick by how much you want to approve yourself and how much you want the vendor to decide.
| Product | Approach | Notes |
|---|---|---|
| WatchGuard Zero-Trust Application Service | Default-deny: applications are blocked until classified as safe | Included in WatchGuard Endpoint Security 360 and Elite. See WatchGuard EPDR |
| TrendAI Vision One Endpoint Security | Device and application control | Included from the Core tier. Licensing: TrendAI Endpoint Security |
| Blackpoint CompassOne | Application control blocking risky and abused applications with rules curated by Blackpoint's SOC, in monitor-only or blocking mode | Included in CompassOne Core and Standard. Licensing: CompassOne |
| ThreatDown Application Block | Blocklisting: stops named applications from launching | Supplied as an add-on to ThreatDown Endpoint Protection. It is not the same as default-deny allowlisting. See ThreatDown |
| Check Point Endpoint Security | Application control included in every edition | See Harmony Endpoint |
| Sophos Endpoint | Application control alongside device and web control | See Sophos Endpoint |
Windows also has built-in application control: App Control for Business (formerly Windows Defender Application Control) and AppLocker, and the NCSC's guidance suggests a combination of the two on Windows. They are capable but need careful policy design and management tooling; a security platform's application control is often easier to run and report on. On phones and tablets, the equivalent is allowing apps only from a managed catalogue through mobile device management.
Application allow listing and Cyber Essentials
Cyber Essentials' malware protection control can be met with anti-malware software or with application allow listing, where only approved applications restricted by code signing may run. Under the current v3.3 requirements, sandboxing is no longer one of the options. Allow listing is also the route for devices where the anti-malware option does not apply, such as phones and tablets using signed apps from an official store.
Our sister site explains the detail of Cyber Essentials malware protection, including how Cyber Essentials Plus tests it. Note that blocking named applications, as ThreatDown Application Block does, is useful but is not the scheme's allow listing option.
How we help
Allowlisting succeeds or fails on planning and on the approval process that follows. We can:
- Check whether your current platform already includes application control
- Recommend a default-deny or targeted approach for each group of devices
- Help run the audit phase, build rules and plan enforcement in waves
- Arrange licensing for the tools you need, with pricing confirmed at quote
Contact us to talk about application whitelisting for your organisation.
How Forever Systems helps with endpoint security
We are an independent UK IT and cyber security provider. We supply and support endpoint security from several vendors, so we can recommend what fits your devices, your people and your budget rather than one vendor's answer to everything.
- Start with what you have: we can review your current antivirus, EDR and Microsoft 365 licences before suggesting anything new
- Vendor-aware advice on EDR, XDR and managed detection and response, including CrowdStrike, SentinelOne, WatchGuard, Bitdefender, Sophos and Check Point Harmony
- Deployment help: planning a rollout, replacing an existing product and setting sensible policies for device control, encryption and patching
- Policies and compliance: we help you map your controls to Cyber Essentials and the NCSC's device guidance
- Ongoing support options, such as policy tuning, renewals and regular reviews, agreed and confirmed at quote
We work with businesses, schools, charities and public sector organisations. Tell us about your devices and we will suggest a sensible next step.
Frequently asked questions
What is application whitelisting?
Application whitelisting, now usually called allowlisting, is a security control that allows only approved applications to run on a device and blocks everything else by default. Approved software is identified by publisher certificate, file hash, file path or a vendor's classification.
What is the difference between application whitelisting and blacklisting?
Whitelisting (allowlisting) blocks everything that is not approved, so unknown software cannot run. Blacklisting (blocklisting) allows everything except software you have listed as unwanted. Allowlisting is stronger against new threats but takes more effort to set up and maintain.
Is application whitelisting the same as application control?
Allowlisting is one form of application control. Application control is the wider term and also covers blocklisting and category or reputation-based blocking. Many endpoint platforms offer several of these modes.
Does application whitelisting replace antivirus?
It can stop most malware from running, and Cyber Essentials accepts application allow listing as an alternative to anti-malware software for its malware protection control. Most organisations still run endpoint protection and EDR as well, because attackers can misuse approved software.
Which software can do application whitelisting?
Options we supply include WatchGuard Endpoint Security 360 and Elite with the Zero-Trust Application Service, TrendAI Vision One Endpoint Security application control and Blackpoint CompassOne application control. Windows also includes App Control for Business and AppLocker.
Still have a question about application whitelisting?
Ask us and a member of our team will reply by email.