← All terms

Allowlisting

Allowlisting permits only approved software, senders, or destinations and blocks everything else — flipping security from default-allow to default-deny.

Allowlisting (historically "whitelisting") is a default-deny control: instead of blocking known-bad items the way a blocklist does, it permits only an approved set — applications, email senders, network destinations, USB device types, browser extensions — and rejects everything else. The logic is the inverse of antivirus: you do not need to recognize the attack if it was never on the approved list.

How it works

Application allowlisting is the most common form. An endpoint policy defines what may execute — by publisher signature, file hash, or installation path — and anything outside it fails to run, including the payload a phishing email just delivered. The same principle applies at other layers: mail systems can restrict which external senders reach finance, firewalls can restrict egress to approved destinations (starving command-and-control traffic), and software catalogs can restrict installs to a managed store. Allowlisting is particularly effective against attacks that depend on the employee running something: ClickFix lures that paste commands into the Run dialog, fake "support" sessions that install a remote access trojan, and the unapproved remote-admin tools that ransomware crews push over help desk calls — a staple of the human-layer intrusions described in our analysis of how ransomware starts.

How to defend with it

Start in audit mode: inventory what actually runs, then enforce on the highest-risk hosts first — servers, finance, admin workstations. Pair the control with a fast exception process, because a slow one breeds shadow IT and teaches employees to work around security rather than with it. Block or allowlist remote-access software explicitly; a persuaded employee cannot install what policy forbids, which converts a successful social-engineering call into a failed one. And treat the allowlist as a living document with an owner and review cadence — stale entries for departed vendors and abandoned tools are how default-deny quietly degrades back into default-allow. Combined with least privilege, allowlisting means a compromised user can neither run the attacker's tools nor reach what those tools were for.

Related terms

ClickFixClickFix is a social engineering attack that uses fake CAPTCHAs or error prompts to trick victims into pasting and running malicious commands themselves.Remote Access Trojan (RAT)A remote access trojan is malware that gives an attacker covert, ongoing control of a victim's device — keyboard, files, camera and credentials included.Shadow ITShadow IT is technology used without IT approval — unsanctioned apps, accounts, and AI tools that expand attack surface outside security's visibility.Principle of Least PrivilegeLeast privilege means every user, process and system gets only the access it needs, for only as long as it needs it — limiting what a compromised account can do.
See your Human Risk Score

NOUSEC simulates attacks across 8 channels and turns the results into one number your board can read.

Book a demo