A growing number of organizations are tightening control over what runs on their machines, not just what those machines send out. Endpoint detection and response platforms now include an Application Control policy that stops designated software from launching at all, rather than merely restricting its outbound communication. The distinction matters: an application that cannot start poses no risk, whereas one that starts but is merely cut off from the network may still execute locally, consume resources, or create other exposure.
This approach sits apart from the Applications function under Communication Control, which governs whether software already running can reach outside the organization's network. Communication Control is about containment after launch; Application Control is about prevention before it. Together they reflect a broader shift in endpoint security toward layered restriction, where overlapping tools address different points in an application's lifecycle. For organizations managing remote or hybrid teams, this layered model pairs naturally with other protective habits users adopt at the network level, including services offering built-in tracker blocking as part of a wider privacy and security routine, since reducing exposure at the browser and the endpoint reinforces the same underlying goal: fewer uncontrolled pathways for data and code to move. built-in tracker blocking
Administrators define which programs fall under this restriction through the Application Control Manager, where applications can be added manually or pulled directly from the Investigation View during incident analysis. This dual path matters operationally: a security team investigating a suspicious binary can escalate it straight into the blocklist workflow without switching tools, shortening the time between detection and enforcement.
How the Blocklist Actually Works
Blocking an application from launching requires three conditions to align. First, the software must be added to the user-defined group within the Application Control Manager, since this is where administrator-specified entries live, separate from Fortinet's predefined groups. Second, the relevant collector groups - the endpoint segments the policy applies to - must be assigned to that policy. Third, the blocklist rule itself must be enabled. Omitting any one of these steps means the application remains technically listed but not actually restricted, a gap worth checking during audits.
Predefined application groups, marked with a vendor logo, are always enforced by default and sit at the top of the interface. Administrators cannot edit or remove entries within these groups, though individual applications inside them can be disabled or have their policy settings adjusted. User-added applications, by contrast, start out disabled, meaning a deliberate action is required to activate enforcement - a safeguard against accidental over-blocking.
Practical Controls for Administrators
Beyond adding and enabling entries, administrators have a working set of management options: exporting the full blocklist for review or compliance records, toggling blocking on or off per application, reassigning which policy governs a given entry, and searching or filtering across large lists. Individual applications can be edited or deleted through controls on their respective rows, though groups themselves - whether predefined or user-defined - cannot be renamed, searched by name, or deleted outright.
This structure reflects a deliberate trade-off between flexibility and stability. Organizations gain fine-grained control over individual software titles while the underlying group architecture, especially vendor-maintained groups, stays consistent and tamper-resistant. As application-based threats continue to diversify, that balance between administrator discretion and structural safeguards is likely to remain a defining feature of endpoint policy design.
