Comparison
Application Allowlisting Solutions
Application allowlisting is the strictest form of application control: anything not explicitly approved is blocked. It is one of the controls recommended in NIST SP 800-167 and in the CIS Critical Security Controls.
Problems this category addresses
- Execution of unknown files delivered by phishing or downloads
- Living-off-the-land abuse of built-in tools
- Inconsistent software across a fleet
Comparison criteria
Every product is described against the same criteria. Products are listed alphabetically; KyberScore does not rank vendors. See our methodology.
Rule types
Hash, publisher certificate, path, or parent-process rules.
Approval workflow
Speed and auditability of approving new software.
Elevation handling
How admin-level installs are handled.
Offline enforcement
Protection when devices are disconnected.
Platform coverage
Operating systems supported.
Vendor and product comparison
| Product | Capabilities | Deployment | Pricing | |
|---|---|---|---|---|
Airlock Digital Airlock Allowlisting Sample data — not publicly verified Last verified: never | Application allowlisting, Execution blocklisting | On-premises, Cloud-hosted | Not publicly verified | |
CyberArk Endpoint Privilege Manager Sample data — not publicly verified Last verified: never | Least privilege, Application control, Privilege elevation | SaaS | Not publicly verified | |
Ivanti Application Control Sample data — not publicly verified Last verified: never | Application allowlisting, Privilege elevation | On-premises | Not publicly verified | |
Microsoft App Control for Business Sample data — not publicly verified Last verified: never | Application allowlisting, Code integrity policies | Built into Windows, Intune / Group Policy | Not publicly verified | |
ThreatLocker Application Allowlisting Sample data — not publicly verified Last verified: never | Application allowlisting, Ringfencing, Storage control | Cloud-managed agent | Not publicly verified |
Deployment and administration
- Start with audit-only mode on a pilot group.
- Inventory existing software before enforcement.
- Assign an owner for exception approvals.
Integration considerations
- RMM and endpoint management
- Identity providers for approver authentication
- SIEM
Best-fit use cases
- Fixed-function devices such as kiosks and point-of-sale
- Servers with predictable workloads
- Organizations prioritizing ransomware prevention
Questions to ask during a demo
- What is the typical number of exception requests per week after rollout?
- What does day-to-day administration look like after the initial rollout?
- How are policy exceptions requested, approved, and audited?
- What happens to protection if an endpoint loses connectivity to the management console?
- Which operating systems and versions are supported today, in writing?
- How is pricing structured, and what is excluded from the quoted price?