Most protection sets out to recognise something dangerous. Allowlisting puts a duller question, with a far better failure mode: was this approved on this machine. Anything lacking an answer stops right there, familiar or not.
Recognition has to be right about the new. Approval only has to be right about the familiar, which is a far smaller and far steadier thing to be right about. Something nobody has catalogued yet is, from the machine's point of view, simply absent from a list.
That model costs administration, and administration is where allowlisting projects usually expire. So a learning window covers the opening pass, release tracking carries approved software through its own updates, and elevation requests reach engineers at Fortify 24x7 rather than your inbox.
This does not belong everywhere. It earns its place on machines where an unapproved program would be expensive: the one that handles money, the one that signs releases, the server room, and the laptop belonging to whoever can authorise a payment.
Ringfencing goes past approval by bounding where an approved program may reach while running. That is how a perfectly ordinary utility stops serving as a handy vehicle for moving somebody else's files about.
Every figure below comes out of billing while this page draws. Anything entered waits inside the almanac, and reading on will not disturb it.
Allowlisting turns the question inside out. Instead of judging whether a program looks harmful, the machine checks whether anybody approved it, and unapproved code never starts. A learning spell draws the list from software your people run anyway, so the gate shuts around a working day rather than across it.
| Sighted on | Endpoints where unapproved code must never execute |
|---|---|
| Tracks | Every attempt to execute, permitted or refused |
| Archived for | A record of approvals and refusals, kept for review |
| Resolved by | Fortify 24x7 engineers working the elevation queue |
| Observed by | ThreatLocker |
Default deny is powerful, and shaped very particularly. Its edges, said out loud.
Heads up: card statements show FORTIFY 24X7 - Starlight IT Services is a Fortify 24x7 brand, and your subscription is billed by Fortify 24x7.