They use approved software lists containing a list of software that is already approved, by vendor version number, for use within your organization. There are

They use approved software lists containing a list of software that is already approved, by vendor version number, for use within your organization. There are teams that analyze popular commercial software for approved usage, often including source code inspection. Bank of America does the same thing.