[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"control:application-allowlisting":3},{"control":4,"products":25,"stories":55,"lessons":99,"related":124,"compare":145},{"slug":5,"name":6,"problem":7,"summary":8,"business_value":9,"vendor_questions":10,"risk_register":15,"framework_refs":16,"area":21,"updated_at":24},"application-allowlisting","Application allowlisting","Any program that reaches a computer can run, including ransomware and the remote-access tools attackers bring with them.","Only software you have approved is allowed to run, and everything else is blocked by default. Modern tools learn what each machine already uses, so the approved list can be built without months of manual work. Some also limit what approved programs may do, for example stopping a document editor from starting PowerShell.","Most ransomware and hands-on-keyboard attacks need to run something new on the victim's computers: a malware file, a remote-access tool, a network scanner. Blocking unapproved software stops that whole class of attack, instead of trying to recognise each new variant, which is why the Australian Signals Directorate lists application control in its Essential Eight. The real cost is the approval process: if approving new software takes days, people will look for ways around it.",[11,12,13,14],"How is the first approved list built, and how long does learning take before blocking starts?","How quickly can a blocked user get a legitimate program approved, and who approves it?","Can it also control scripts and libraries, and limit what approved programs may do, such as starting PowerShell or reaching the network?","How does it handle software updates without breaking the approved list?","Risk: ransomware or attacker tools running on workstations and servers. Control: application allowlisting in blocking mode on servers and endpoints, with a fast approval process for new software. Owner: endpoint or IT operations lead. Measure: share of endpoints in blocking mode and median approval time for new software.",[17,18,19,20],"CIS Controls 2.5 to 2.7: allowlist authorised software, libraries and scripts","ASD Essential Eight: application control","NIST SP 800-167: guide to application whitelisting","ISO\u002FIEC 27001:2022 A.8.19: installation of software on operational systems",{"name":22,"slug":23},"Configuration Management","configuration-management","2026-10-16T16:05:05.104475+00:00",[26,34,42,50],{"vendor_slug":27,"vendor_name":28,"vendor_logo":29,"product_slug":30,"product_name":31,"url":32,"description":33},"airlock-digital","Airlock Digital","\u002Fvendor-logos\u002Fairlock-digital.png","airlock-allowlisting","Airlock Allowlisting and Execution Control","https:\u002F\u002Fwww.airlockdigital.com\u002F","Blocks anything not explicitly trusted from running, with tools to build and keep the trusted list current as software changes.",{"vendor_slug":35,"vendor_name":36,"vendor_logo":37,"product_slug":38,"product_name":39,"url":40,"description":41},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","app-control-for-business","App Control for Business","https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fwindows\u002Fsecurity\u002Fapplication-security\u002Fapplication-control\u002Fapp-control-for-business\u002F","Application control built into Windows, formerly Windows Defender Application Control, with AppLocker as the older option. Policies can be managed through Intune.",{"vendor_slug":43,"vendor_name":44,"vendor_logo":45,"product_slug":46,"product_name":47,"url":48,"description":49},"threatlocker","ThreatLocker","\u002Fvendor-logos\u002Fthreatlocker.png","allowlisting","Allowlisting","https:\u002F\u002Fwww.threatlocker.com\u002Fcapabilities\u002Fallowlisting","Blocks any software that has not been approved, including ransomware and unapproved remote-access tools. A learning period builds the approved list first.",{"vendor_slug":43,"vendor_name":44,"vendor_logo":45,"product_slug":51,"product_name":52,"url":53,"description":54},"ringfencing","Ringfencing","https:\u002F\u002Fwww.threatlocker.com\u002Fcapabilities\u002Fringfencing","Limits what approved applications may do, such as which files, network locations and other programs they can reach, so a compromised application cannot be turned against you.",{"total":56,"last_days":57,"recent":58},99,97,[59,64,69,74,79,84,89,94],{"slug":60,"title":61,"published_at":62,"brief":63},"cikabika-bot-rat-uses-discord-for-c-c-60f1b8","CikaBika Bot RAT Uses Discord for C&C","2026-10-15T11:25:58+00:00","CikaBika Bot RAT, a new Rust-based malware, uses Discord for C&C and Ngrok for data exfiltration.",{"slug":65,"title":66,"published_at":67,"brief":68},"novel-android-rat-hirudo-replaces-banking-apps-with-trojanized-copies-17a097","Novel Android RAT ‘Hirudo’ Replaces Banking Apps With Trojanized Copies","2026-10-15T10:15:32+00:00","New Android RAT 'Hirudo' replaces banking apps with trojanized copies to steal credentials.",{"slug":70,"title":71,"published_at":72,"brief":73},"hirudo-android-trojan-uses-patched-banking-apps-to-bypass-their-built-in-securit-a95ca0","Hirudo Android Trojan Uses Patched Banking Apps to Bypass Their Built-In Security Checks","2026-10-14T11:08:22+00:00","Hirudo Android Trojan replaces legitimate banking apps with patched versions to bypass security checks.",{"slug":75,"title":76,"published_at":77,"brief":78},"ghostscript-flaw-lets-hackers-hijack-servers-via-pdf-uploads-521975","Ghostscript flaw lets hackers hijack servers via PDF uploads","2026-10-13T21:33:26+00:00","Ghostscript flaw CVE-2026-39919 allows RCE via crafted PDF uploads.",{"slug":80,"title":81,"published_at":82,"brief":83},"agent-baseline-publishes-security-reference-architecture-for-software-factories-68c07d","Agent Baseline Publishes Security Reference Architecture for Software Factories","2026-10-13T17:54:48.146+00:00","Agent Baseline releases reference architecture for securing AI-driven software factories.",{"slug":85,"title":86,"published_at":87,"brief":88},"macos-users-targeted-by-fake-zoom-installer-carrying-cloudsyncd-backdoor-174e76","macOS Users Targeted by Fake Zoom Installer Carrying CloudSyncD Backdoor","2026-10-02T13:15:00+00:00","macOS users targeted by fake Zoom installer delivering CloudSyncD backdoor.",{"slug":90,"title":91,"published_at":92,"brief":93},"a-flaw-in-chatgpt-s-mac-app-could-have-let-hackers-grab-sensitive-data-ca874f","A Flaw in ChatGPT’s Mac App Could Have Let Hackers Grab Sensitive Data","2026-10-02T09:45:00+00:00","ChatGPT's Mac app had a vulnerability allowing attackers to access chat logs and run commands.",{"slug":95,"title":96,"published_at":97,"brief":98},"android-17-advanced-protection-locks-accessibility-services-to-verified-accessib-e9bd71","Android 17 Advanced Protection Locks Accessibility Services to Verified Accessibility Tools","2026-10-02T08:01:30+00:00","Android 17 Advanced Protection restricts accessibility services to verified apps.",[100,104,108,112,116,120],{"slug":101,"title":102,"published_at":103},"android-rat-hirudo-swaps-legitimate-banking-apps-with-trojanized-clones","Android RAT 'Hirudo' Swaps Legitimate Banking Apps with Trojanized Clones","2026-10-15T12:21:08.907+00:00",{"slug":105,"title":106,"published_at":107},"cikabika-rat-abuses-discord-and-ngrok-to-evade-detection","CikaBika RAT Abuses Discord and Ngrok to Evade Detection","2026-10-15T12:20:40.147+00:00",{"slug":109,"title":110,"published_at":111},"ai-coding-agents-need-zero-trust-security-boundaries-to-prevent-production-disasters","AI Coding Agents Need Zero-Trust Security Boundaries to Prevent Production Disasters","2026-10-13T22:21:43.666+00:00",{"slug":113,"title":114,"published_at":115},"critical-ghostscript-flaw-enables-rce-via-malicious-pdf-uploads","Critical Ghostscript Flaw Enables RCE via Malicious PDF Uploads","2026-10-13T22:20:31.668+00:00",{"slug":117,"title":118,"published_at":119},"fake-zoom-installer-deploys-macos-backdoor-via-social-engineering","Fake Zoom Installer Deploys macOS Backdoor via Social Engineering","2026-10-02T14:20:22.101+00:00",{"slug":121,"title":122,"published_at":123},"android-17-locks-accessibility-services-to-verified-apps-under-advanced-protection","Android 17 Locks Accessibility Services to Verified Apps Under Advanced Protection","2026-10-02T10:22:05.06+00:00",[125,129,133,137,141],{"slug":126,"name":127,"problem":128},"asset-inventory","Cyber asset inventory","You cannot patch, monitor or protect the devices, cloud resources and accounts you do not know you have.",{"slug":130,"name":131,"problem":132},"cloud-security-posture","Cloud security posture management (CSPM and CNAPP)","Misconfigured cloud storage and over-permissive roles get caught before they leak.",{"slug":134,"name":135,"problem":136},"saas-security-posture","SaaS security posture management (SSPM)","Business apps like Microsoft 365 and Salesforce stop leaking through risky settings and connected apps.",{"slug":138,"name":139,"problem":140},"endpoint-management","Device management (MDM and UEM)","Every company laptop and phone is known, encrypted, locked down and up to date.",{"slug":142,"name":143,"problem":144},"email-authentication","Email authentication (DMARC)","Nobody can send email that pretends to come from your domain.",{"microsoft\u002Fapp-control-for-business":146,"threatlocker\u002Fallowlisting":164,"airlock-digital\u002Fairlock-allowlisting":177,"threatlocker\u002Fringfencing":187},{"hq_country":147,"also_provides":148,"reviews":149,"affected":162,"reported":163},"US",[],[150,153,156,159],{"label":151,"url":152},"AV-TEST: business results for Microsoft Defender","https:\u002F\u002Fwww.av-test.org\u002Fen\u002Fantivirus\u002Fbusiness-windows-client\u002Fmanufacturer\u002Fmicrosoft\u002F",{"label":154,"url":155},"ITPro: Microsoft Defender for Business review (2024)","https:\u002F\u002Fwww.itpro.com\u002Fcloud\u002Fcloud-security\u002Fmicrosoft-defender-for-business-review-feature-filled-enterprise-security-for-small-businesses",{"label":157,"url":158},"Gartner Peer Insights: Microsoft Defender for Endpoint user reviews","https:\u002F\u002Fwww.gartner.com\u002Freviews\u002Fproduct\u002Fmicrosoft-defender-for-endpoint",{"label":160,"url":161},"PeerSpot: Microsoft Defender for Endpoint user reviews","https:\u002F\u002Fwww.peerspot.com\u002Fproducts\u002Fmicrosoft-defender-for-endpoint-reviews",244,105,{"hq_country":147,"also_provides":165,"reviews":166,"affected":176,"reported":176},[],[167,170,173],{"label":168,"url":169},"TechRadar: ThreatLocker review (2023)","https:\u002F\u002Fwww.techradar.com\u002Fpro\u002Fthreatlocker-review",{"label":171,"url":172},"Gartner Peer Insights: ThreatLocker Platform user reviews","https:\u002F\u002Fwww.gartner.com\u002Freviews\u002Fproduct\u002Fthreatlocker-platform",{"label":174,"url":175},"PeerSpot: ThreatLocker Zero Trust Platform user reviews","https:\u002F\u002Fwww.peerspot.com\u002Fproducts\u002Fthreatlocker-zero-trust-platform-reviews",0,{"hq_country":178,"also_provides":179,"reviews":180,"affected":176,"reported":176},"AU",[],[181,184],{"label":182,"url":183},"Gartner Peer Insights: Airlock Digital user reviews","https:\u002F\u002Fwww.gartner.com\u002Freviews\u002Fproduct\u002Fairlock-digital",{"label":185,"url":186},"PeerSpot: Airlock Digital Application Control user reviews","https:\u002F\u002Fwww.peerspot.com\u002Fproducts\u002Fairlock-digital-application-control-reviews",{"hq_country":147,"also_provides":188,"reviews":189,"affected":176,"reported":176},[],[190,191,192],{"label":168,"url":169},{"label":171,"url":172},{"label":174,"url":175}]