Essential Eight 'maturity levels' are vague in this regard, though seems to mandate it (at least 'application control'), at varying levels. Seems like the only

Essential Eight 'maturity levels' are vague in this regard, though seems to mandate it (at least 'application control'), at varying levels. Seems like the only way third-parties could do it 'effectively' is with kernel-level access, though I am absolutely not an expert in this field (light years from it). https://www.cyber.gov.au/resources-business-and-government/essential-cyber-security/essential-eight/essential-eight-maturity-model https://www.cyber.gov.au/resources-business-and-government/e... Having been an end-user going through the adoption of one of these third-party application control and auditing systems, I won't say which, or for whom, I can definitely state it was painful. Said system broke quite a few business-as-usual processes, despite a months long 'learning phase' and often required 'super user' intervention. Occasionally this is still the case now, because almost no software vendor (commercial or open-source) digitally signs all their files capable of executing instructions (either natively or via an interpreter). That said, the third-party app control package stops everything it doesn't recognise or has an exception for. I don't know how far it embeds itself into the system though. It seems like vendors like CrowdStrike swoop in on the 'easy to be compliant' gimmick. One wonders how many are aware of Microsoft's own products in this space? App Locker comes to mind.