Modular Service

Application Control

Antivirus reacts to threats it already knows about. Application control stops the ones it doesn’t — by only allowing software you’ve explicitly approved to run at all. If it’s not on the list, it doesn’t execute. Full stop.

Essential Eight: Application Control Windows & Mac supported

From AUD $8.10 per device, per month, ex GST.

94+/100 average user rating across major independent B2B software review platforms
3 layers of default-deny protection working together, not a single point of failure
2 – 4 wks dedicated tuning period per environment before enforcement goes live

How it works

We deploy our application control platform in Learning Mode first, observing your environment to build an accurate allowlist of what’s genuinely in use before switching on enforcement — so day-to-day work isn’t disrupted. Once live, anything not explicitly approved is blocked by default, closing off an entire category of attack that traditional antivirus can’t touch: unknown, zero-day, and brand-new malware that no signature-based tool has seen before.

Covers Windows and Mac devices across your fleet, so mixed environments get the same protection regardless of platform.

What’s included

Allowlisting

Only approved executables, scripts, and installers can run — everything else is blocked by default.

Ringfencing

Controls what your approved applications can do once running — e.g. Word can open, but can’t spawn PowerShell or reach files outside Documents. Closes off the macro-based attacks that plague Office documents.

Storage Control

Granular control over what can access removable media and sensitive storage — block USB drives, limit which applications touch network shares, and stop ransomware from encrypting shared data.

New Software Request ✓ Manager / Account Contact Approval Unapproved / Unknown Execution Attempt BLOCKED no approval possible logged with a ticket number Allowlist only approved apps can run Ringfencing controls what apps can do once running Storage Control removable media & network shares ✓ safe to run New software only reaches the allowlist after approval — everything else is denied by default Your Portal policy status & blocked-attempt visibility, self-service

Prevention, not detection

Traditional antivirus scans for known bad patterns and reacts once something looks suspicious. Our zero-trust, default-deny model never gives unknown code the chance to run in the first place — unless it’s expressly permitted.

This is a genuine shift in operating model, not a bolt-on. Getting it right takes proper tuning during rollout, which is exactly why we run a dedicated learning period per environment before switching enforcement on.

A note on Essential Eight scope: this tag reflects the Application Control strategy specifically. ACSC scores your overall Essential Eight maturity against your weakest control across all eight strategies, not an average — get in touch for your organisation’s actual maturity assessment.

Want to see how application control would fit your environment?

Book a free IT & security review — no obligation.

Book Now