How are you proposing to stop fileless malware with application whitelisting? How about popping shells on firewalls with memory corruption, then using the creds

How are you proposing to stop fileless malware with application whitelisting? How about popping shells on firewalls with memory corruption, then using the creds to pivot live-off-the-land style? Solarigate style supply chain attacks? Whitelisting is the cool buzzword again, but it doesn't do much against human operated ransomware. It's a huge effort to implement (I know you want to say it isn't; try it and learn) and it's not very useful. That's why most shops skip it.