A drainer is just an unapproved binary.
Strip the branding off the incident reports and the delivery mechanism is dull. Someone runs a file they were expecting: a desktop client for a venue, a build from a repository they were pointed at, a take home task from a recruiter with a convincing profile, an installer from a search advertisement sitting above the real result.
Detection engines are good at this and get better every year, but they are still reasoning about something novel. Allowlisting sidesteps the argument. The file is not on the list, so it does not run, and the question of whether it was malicious never has to be answered in real time.
Learn first, then deny by default.
The agent spends an opening period cataloging the software that genuinely runs on your machines, building the baseline from your own machines rather than from a template. Learning models, shaped by how software behaves across an extremely large fleet, shorten that work considerably, so the policy is usable in days rather than quarters.
Once the policy goes to enforcement, anything outside it is denied. That includes a payload compiled forty minutes ago, which is the case that defeats reputation and signature systems by construction.
- Vendor releases are picked up for you, so an update does not become a morning of blocked launches.
- Approvals and elevation land with a staffed desk on every shift, not in a queue somebody opens on Monday.
- Policy applies to the software estate, not to individual users, so a new starter inherits a working machine on day one.
Approved does not mean unlimited.
Allowlisting alone still leaves you exposed to trusted tools being used against you, which is why the policy also constrains what an approved application may do. Which other binaries it may launch, which file paths it may read, and which network destinations it may reach are all decisions rather than defaults.
The practical effect for a trading desk: a scripting host or an office application that normally has no business reading a wallet directory or opening an outbound connection to a freshly registered domain simply cannot, even when the user has been talked into running it.
The friction, stated honestly.
This control has a real cost and anybody who tells you otherwise has not deployed it. For the first stretch you are in learning mode and nothing is blocked. After that, new software needs approval. With a staffed desk that is usually minutes, but it is a step that did not exist before.
Teams that install constantly, particularly engineering teams working across many toolchains, feel it most. Teams whose signing machines run a small, stable set of applications feel almost nothing, and those are exactly the machines where this control pays for itself. A common arrangement is strict policy on treasury and signing hosts, looser policy on general workstations.
Execution Control
Application allowlisting with automated update tracking and a staffed elevation desk. Deny by default, approve on evidence.
- Learning period builds the baseline from your own estate.
- Automatic tracking of vendor application updates so approvals stay current.
- Boundaries on what an approved application may launch, read, and reach.
- Approvals and escalations worked by our team on every shift.
| Model | Default deny. Only approved software executes |
|---|---|
| Baseline | Learned from your estate, accelerated by cross fleet behavior data |
| Update handling | Application updates tracked and approvals maintained automatically |
| Boundaries | Per application controls on child processes, file access, and network destinations |
| Approvals | Handled by the Fortify 24x7 desk, 24 hours a day |
| Best fit | Signing hosts, treasury workstations, finance and operations machines |
| Priced by | Endpoint, monthly |
monthly rate, taken up front QTY
Where this line stops
Execution control governs code. It does not govern consent. If a person opens an approved browser, visits a convincing page, and authorizes a request, no allowlist was ever involved in that decision.
- Malicious approvals inside a trusted browser are covered instead by web filtering, inbox defense and training, and ultimately by hardware wallets that display what is being signed.
- A browser extension installed through the normal store flow is not an unapproved binary. Extension hygiene is a policy question we will help you write, not a product line.
- The learning period is a real deployment cost. Plan for it rather than being surprised by it.
- This line covers managed endpoints. Personal machines outside the policy are not in scope.