Application allowlisting can reduce the risk on a host you cannot patch by letting only approved programs run, which blocks a lot of malware and attacker tools. It does not stop an exploit of an approved program, so pair it with isolation and monitoring.
What it is
NIST's least functionality control asks you to configure a system to provide only essential capabilities, and to prohibit or restrict unnecessary functions, ports, protocols, software and services. A related enhancement, authorized software with allow-by-exception, goes further: only software on an approved list may execute. NIST adds that authorized programs can be limited to specific versions or sources, and that integrity can be verified with digital signatures, checksums or hash functions, before execution or at startup.
That fits legacy hosts well. A server that runs one application and has not changed in five years has a short, stable list of programs.
What it stops and what it does not
| Threat | Stopped by allowlisting? |
|---|---|
| Dropped ransomware executable | Likely, if it is not on the list |
| Attacker uploading a remote access tool | Likely |
| Exploit of a flaw in the approved application itself | No, the approved code runs |
| Scripts run by an approved interpreter | Depends on how the rules cover scripts |
| Someone with admin rights editing the list | No, protect the policy and its admins |
The honest summary: allowlisting narrows what an attacker can do after getting in, and what malware can run. It does not close the original flaw.
A rollout that will not take down a fragile system
- Baseline first. Record running programs, services and scheduled jobs over a full business cycle, including month end and backups.
- Start in audit mode. Log what would be blocked without blocking it. Review the log.
- Build the list from hashes or signatures, not paths. Path based rules are easy to bypass if users can write to the folder.
- Cover the update path. Decide how a vendor patch or a new version is approved and added to the list.
- Switch to enforce on one host. Choose a test twin if you have one.
- Protect the policy. Limit who can change it and log every change.
Watch for these traps
- Allowing broad folders such as a temp directory to get past a deadline.
- Allowing a general scripting tool that attackers also like.
- Forgetting drivers, installers and scheduled tasks, which then fail at 2 am.
- No process for emergencies, which leads people to turn the whole thing off.
When it is not an option
Some embedded and appliance systems cannot run allowlisting software at all. For those, move the control to the network: deny by default firewall rules and a tight list of who may connect.
Where Safeguard fits
For the software you build, Safeguard's policies, gates and guardrails apply an allow or block decision before code ships, which is the same idea moved earlier in the pipeline. SBOM and dependency scanning list what is in it. The free scan is at gold.safeguard.sh/scan.
Quick check
Does allowlisting replace antivirus on a legacy host?
They do different jobs. Allowlisting controls what may start. Other tools look at behaviour or known bad files. Where a legacy host supports only one, allowlisting often gives more value for a fixed workload.
What if the vendor patch changes file hashes?
Plan for it. Add the new hashes or the vendor signature to the list as part of the change, and keep the old entries until the old version is gone.
Sources
- NIST SP 800-53 Rev 5 control catalog (OSCAL JSON, NIST oscal-content repository) (CM-7 Least Functionality and CM-7(5) Authorized Software, Allow-by-exception)
Last reviewed: 19 October 2026.
