Application control (allowlisting) tools enforce a deny-by-default posture on endpoints and servers: only explicitly approved binaries, scripts, and libraries may run. This is a prevention/control discipline – distinct from detection-and-response.
This category covers dedicated allowlisting and application-control platforms – ThreatLocker, Airlock Digital, VMware Carbon Black App Control, Ivanti Application Control – the built-in Windows controls (AppLocker and WDAC / App Control for Business), allowlisting-based endpoint suites (Faronics Anti-Executable, PC Matic), and open-source enforcers (Google Santa on macOS, fapolicyd and AppArmor on Linux).
Related categories: EDR / XDR (detection and response, often deployed alongside allowlisting), Privileged Access Management (privilege elevation, which some of these tools also provide), and Vulnerability Management.
What Application Control Covers
Mix (10 tools)
License: 3 open source · 7 proprietary
Hosting: 7 self-hosted · 0 SaaS · 3 both
Allowlisting (whitelisting) – a default-deny policy where only approved applications execute; everything else is blocked.
Ringfencing / containment – constraining what an approved app may do (which files, registry, network, and other processes it can touch), to limit living-off-the-land abuse.
Elevation control – running specific applications with elevated rights without giving the user admin, overlapping with endpoint privilege management.
Storage and network control – policy over removable media and host-level connections on some platforms.
Policy authoring & audit – learning mode, approval workflows, and an audit trail of what ran or was blocked.
The market splits into commercial deny-by-default platforms (strong central management, ringfencing, MSP multi-tenancy), the Windows-native controls (AppLocker and kernel-enforced WDAC, free with the OS), and open-source enforcers for macOS (Santa) and Linux (fapolicyd, AppArmor). Allowlisting is most often deployed to complement, not replace, EDR.
About this data & disclaimer
The information on these pages was researched by a combination of human review and large language models. This catalogue serves as a reference for the resources, applications, devices, deployment payloads, and other components that the ResorsIT platform integrates, deploys, and manages. To suggest an addition or correction, please contact us. Prepared by Rhodium Systems Inc., author of the ResorsIT platform — a unified IT operations management platform for IT teams and MSPs that integrates a curated suite of open-source, commercial, and SaaS applications into a single system with shared identity, single sign-on, access control, and a common audit trail. This information is compiled on a best-effort basis: it may be incomplete, contain errors, and become out of date as tools, vendors, licences, and features change. Use this catalogue only as a starting point for your own research, and independently verify and review any tool carefully against your own requirements before relying on it.
Comparison
Cross-tool comparison of application-control / allowlisting platforms.
Overview Comparison
| Tool | Type | Platforms | License | Deployment |
|---|---|---|---|---|
| ThreatLocker | Allowlisting + ringfencing suite | Windows, macOS | Proprietary | Cloud console + agent |
| Airlock Digital | Execution control / allowlisting | Windows, macOS, Linux | Proprietary | On-prem or cloud + agent |
| Carbon Black App Control | Server/fixed-function allowlisting | Windows, Linux | Proprietary | On-prem server + agent |
| Ivanti Application Control | Allowlisting + privilege mgmt | Windows | Proprietary | On-prem + agent |
| Microsoft AppLocker & WDAC | Built-in OS controls | Windows | Proprietary (in OS) | Native (GPO / Intune) |
| Faronics Anti-Executable | Allowlisting | Windows | Proprietary | Native + console |
| PC Matic Pro | Allowlist-based endpoint suite | Windows, macOS | Proprietary | Cloud + agent |
| Santa | Binary authorization | macOS | Apache-2.0 | Native |
| fapolicyd | File access policy daemon | Linux | GPL-3.0 | Native |
| AppArmor | Mandatory access control | Linux | GPL-2.0 | Native |
Capabilities
| Tool | Ringfencing | Elevation Control | Central Mgmt | MSP Multi-tenant |
|---|---|---|---|---|
| ThreatLocker | Yes | Yes | Yes (cloud) | Yes |
| Airlock Digital | Partial | No | Yes | Yes |
| Carbon Black App Control | Yes | No | Yes (server) | Limited |
| Ivanti Application Control | Partial | Yes | Yes | Limited |
| Microsoft AppLocker & WDAC | No | No | GPO / Intune | No |
| Faronics Anti-Executable | No | No | Yes (console) | Limited |
| PC Matic Pro | No | No | Yes (cloud) | Yes |
| Santa | No | No | Sync server (self-run) | No |
| fapolicyd | No | No | Config / trust db | No |
| AppArmor | Yes (confinement) | No | Profiles (config) | No |
Suitability Summary
- Best full commercial platform: ThreatLocker (allowlisting + ringfencing
- elevation + storage/network control, cloud-managed, MSP-friendly); Airlock Digital where cross-platform execution control is the priority.
- Best for servers / fixed-function: Carbon Black App Control.
- Best free / built-in (Windows): AppLocker for policy, WDAC / App Control for Business for kernel-enforced code integrity.
- Best OSS: Santa (macOS binary authorization), fapolicyd (Linux allowlisting), AppArmor (Linux application confinement).
- Deploy application control to complement EDR (see the EDR / XDR category), not replace it: allowlisting prevents unapproved execution while EDR detects and responds to what does run.
Tools
10 tools.
Airlock Digital
Airlock Digital is an application allowlisting and execution control platform that enforces default-deny policies to block untrusted binaries and scripts across Windows, macOS, and Linux endpoints.
License: Proprietary (proprietary) · Kind: web · Deploy: direct, saas · SSO: SAML
ResorsIT usage: Web App with SSO
Access & Identity: Single sign-on · Provisioned account
AppArmor
AppArmor is a Linux mandatory access control framework that confines programs to a per-profile set of file paths, capabilities, and network access, enforced by an in-kernel LSM in enforce or complain mode.
License: GPL-2.0-only (OSS) · Kind: service · Deploy: direct · SSO: none
ResorsIT usage: Deployment Payload
Access & Identity: Vaulted credential · Local host account · Key-based access
fapolicyd
fapolicyd is a Linux application allowlisting daemon for RHEL and Fedora that permits or blocks execution by file path, SHA-256 hash, or an RPM-backed trust database, enforced through fanotify.
License: GPL-3.0-or-later (OSS) · Kind: service · Deploy: direct · SSO: none
ResorsIT usage: Deployment Payload
Access & Identity: Vaulted credential · Local host account · Key-based access
Faronics Anti-Executable
Faronics Anti-Executable is an application allowlisting agent that blocks unauthorized executables, scripts, and DLLs from running, permitting only approved programs on Windows and macOS endpoints.
License: Proprietary (proprietary) · Kind: service · Deploy: direct · SSO: none
ResorsIT usage: Deployment Payload
Access & Identity: Vaulted credential · Local host account · Key-based access
Ivanti Application Control
Ivanti Application Control combines trusted-ownership application allowlisting with application privilege management to block unauthorized executables and grant granular, per-application admin rights.
License: Proprietary (proprietary) · Kind: web · Deploy: direct · SSO: SAML
ResorsIT usage: Web App with SSO
Access & Identity: Single sign-on · Provisioned account
Microsoft AppLocker & WDAC
Two built-in Windows application control features: AppLocker, a Group Policy-based allowlisting engine, and Windows Defender Application Control (WDAC / App Control for Business), which enforces kernel-level code integrity policy.
License: Proprietary (proprietary) · Kind: service · Deploy: direct · SSO: none
ResorsIT usage: Deployment Payload
Access & Identity: Vaulted credential · Local host account · Key-based access
PC Matic Pro
PC Matic Pro is a cloud-managed endpoint security suite built on a global application allowlist (SuperShield) that blocks any executable not on the vetted whitelist, rather than relying on blacklist detection.
License: Proprietary (proprietary) · Kind: web · Deploy: direct, saas · SSO: SAML
ResorsIT usage: Web App with SSO
Access & Identity: Single sign-on · Directory / LDAP
Santa
Santa is a binary authorization system for macOS that allows or blocks executables by SHA-256 hash, code-signing certificate, Team ID, or Signing ID, running in monitor or lockdown mode.
License: Apache-2.0 (OSS) · Kind: service · Deploy: direct · SSO: none
ResorsIT usage: Deployment Payload
Access & Identity: Vaulted credential · Local host account · Key-based access
ThreatLocker
ThreatLocker is a Zero Trust endpoint security platform built on default-deny application allowlisting, plus ringfencing, storage control, network control, and privileged elevation management.
License: Proprietary (proprietary) · Kind: web · Deploy: saas, direct · SSO: OIDC, SAML
ResorsIT usage: Web App with SSO
Access & Identity: Single sign-on · Provisioned account
VMware Carbon Black App Control
VMware Carbon Black App Control (formerly Bit9) is an on-premises application allowlisting and file-integrity solution for locking down servers and fixed-function devices with default-deny policies.
License: Proprietary (proprietary) · Kind: web · Deploy: direct · SSO: SAML
ResorsIT usage: Web App with SSO
Access & Identity: Single sign-on · Provisioned account
