Application allowlisting permits only pre-approved software to run — blocking all else including unknown malware and unauthorized tools.
Most effective malware prevention control. AppLocker (Windows) implements it via GPO. Best for: kiosks, POS systems, high-security environments. Difficult to maintain at scale — significant operational overhead.