Note: This article was originally published on the Ivanti Blog.
Summary
Application control has long been a foundational security pillar, yet organizations often struggle with the old assumptions and operational friction surrounding traditional tools. Classic allowlisting feels safe in theory, but maintaining expansive lists of allowed files quickly transforms into an exhausting administrative maintenance burden. On the other hand, blocklisting is inherently reactive, leaving critical gaps that sophisticated threat actors easily bypass. Furthermore, while tools like Microsoft AppLocker led many security teams to believe that strict, path- or publisher-based allowlisting is the definitive gold standard, modern attack vectors have proven otherwise. Today’s attackers frequently bypass list-based controls entirely by weaponizing legitimate, digitally signed native operating system tools and executing them in unintended, malicious contexts.
To solve this dilemma, Ivanti Application Control leverages a provenance-based execution model known as Trusted Ownership. Instead of focusing exclusively on the static identity, hash, or path of an individual file, Trusted Ownership evaluates how software arrived on the system and who placed it there. The core premise is a streamlined default-deny architecture: any file introduced or placed by an authorized, trusted owner or legitimate software deployment channel is allowed to run, while any content introduced directly by standard users is blocked by default.
This provenance-based enforcement applies consistently across the entire execution chain, encompassing standard executables, dynamic-link libraries (DLLs), script files (such as PowerShell or VBScript), and MSI installers. For example, if an attacker attempts to download a malicious script into a user profile directory or trigger an abuse vector using built-in living-off-the-land binaries like rundll32 or mshta, the mechanism inspects the origin of the content. Even though the utility itself may be a legitimate, built-in operating system tool, the specific content or script it has been asked to execute fails the provenance check because it originated from an untrusted or user-controlled source. Consequently, the execution is stopped automatically before any damage can occur.
Ultimately, Trusted Ownership bridges the gap between high security and operational scalability. It aligns cleanly with modern zero-trust frameworks and automated software distribution practices, dramatically reducing the number of complex exceptions, custom rules, and ongoing maintenance cycles required compared to legacy allowlisting utilities.