Application control when AI writes the malware

Every antivirus and detection tool ever built works by answering one question: is this thing bad? For decades that was a winnable game. Then attackers started using AI to generate malware, and the question became unanswerable, because there is no longer a stable “this thing” to assess. Every sample is new. The smarter move is to stop asking whether software is bad and start asking whether it is approved. That is application control, and against AI-generated malware it is the layer that quietly wins.

This is the third post in our series on how AI is reshaping each layer of your security stack, following identity and Zero Trust and EDR, and the full ecosystem overview ties the whole series together.

What application control actually is

Application control, also called allowlisting, flips traditional security on its head. Instead of trying to identify and block bad software, it permits only approved software to run and blocks everything else by default. This is the deny-by-default, allow-by-exception model at the heart of Zero Trust. If a program is not on the approved list, it does not execute, no matter who launched it or how it arrived.

We deploy ThreatLocker for this across our managed clients. It starts in a learning mode that catalogues every application already running, builds a tailored policy you review, then enforces it. When someone needs new software, they request it through a popup and it is approved in about a minute. The result is full visibility and real control without the months of manual work that legacy allowlisting used to demand.

Why AI-generated malware makes this the decisive layer

Here is the reality that detection-based tools are struggling with. AI lets attackers mutate malware so quickly that every sample is unique, which means signature-based antivirus has nothing to match and even behavioural detection can be evaded. The defender is forced to recognise an infinite, ever-changing set of threats.

Application control refuses to play that game. It does not need to know that a file is malicious. It only needs to know that the file is not on the approved list, and that is enough to block it. A novel, AI-generated payload that has never been seen before still cannot run, because nothing unapproved runs. The goal is not to detect every new AI threat. It is to stop threats from executing in the first place. That inversion is why allowlisting has moved from a nice-to-have to a core control for businesses serious about ransomware.

Control is more than blocking apps

Stopping unapproved programs is the start. The real strength of a modern application control platform is restricting what your approved software is allowed to do, which matters enormously as attacks get more creative.

That web control point is increasingly relevant. As staff adopt AI browser agents and plugins without telling anyone, application control can block the unapproved ones, which makes it a practical shadow AI control as well as a malware one. We tie this together with our AI governance work so the policy and the technical enforcement actually match.

Why it works best alongside EDR, not instead of it

Application control and EDR are not competitors. They answer different questions. EDR detects and responds to what does run and watches behaviour over time. Application control prevents what should never run from running at all. Used together, far less reaches the point where detection is needed, and the things that do are caught and contained. This layered approach, prevention plus detection plus response, is the core of how we deliver managed cyber security, and it maps neatly onto two Essential Eight controls: application control and restricting administrative privileges.

What you should do now

Ask whether you have application control at all. Most businesses do not, and rely entirely on detection. If your security model is “block the bad”, you are exposed to every new AI-generated threat by design. Deny-by-default closes that gap.

Do not let “it sounds restrictive” stop you. Modern allowlisting deploys in a learning mode and approves new software in about a minute, so the friction staff fear rarely materialises. The trade for a small approval step is that ransomware cannot execute.

Pair prevention with your detection layer. If you already run EDR, application control is the missing half. Contact Epic IT for a free endpoint security review and we will show you what an attacker could run on your machines today, and what they could not.

Next in the series: how AI is changing patching and update management.