# Application Control Technologies for Essential 8: A Comparative Guide

Source: https://elementdigital.com.au/topics/application-control-technologies-for-essential-8-a-comparative-guide/
Published: 2024-09-30
Updated: 2026-09-16

> AppLocker, WDAC, ThreatLocker and Airlock Digital compared against the Essential Eight maturity levels, with indicative pricing, implementation effort and ongoing management.

Application control is a core component of the Australian Cyber Security Centre’s (ACSC) **Essential 8** mitigation strategies. By restricting which applications can run in your environment, you significantly reduce the risk of malware infections and unauthorized software. Several technologies can be used to achieve this, including **AppLocker**, **Windows Defender Application Control (WDAC)**, **ThreatLocker**, and **Airlock Digital**. This post compares them against the maturity levels, gives a pricing guide, and rates both the implementation effort and the operational management involved.

## The Essential 8 and application control

The **Essential 8** framework defines three maturity levels for cybersecurity:

- **Level 1:** Basic cyber hygiene, designed to protect against opportunistic cyber threats.
- **Level 2:** Increased protection to defend against more targeted attacks.
- **Level 3:** Advanced protection, aimed at mitigating sophisticated cyber threats.

Application control is one of the primary strategies for each maturity level, becoming more stringent as you move from Level 1 to Level 3.

## The comparison, up front

### Maturity level coverage

| Solution | Level 1 | Level 2 | Level 3 |
| --- | --- | --- | --- |
| AppLocker | Yes | Yes | Limited |
| WDAC | Yes | Yes | Yes |
| ThreatLocker | Yes | Yes | Yes |
| Airlock Digital | Yes | Yes | Yes |

AppLocker is the only one of the four that does not comfortably reach Level 3.
It will get you to Level 2, but it lacks the flexibility and the advanced
features the higher level asks for.

### Cost and effort

| Solution | Cost per endpoint per month | Implementation effort | Ongoing management |
| --- | --- | --- | --- |
| AppLocker | Free, with Windows Enterprise or Education | 3 | 3 |
| WDAC | Free, with Windows 10/11 Enterprise | 5 | 4 |
| ThreatLocker | $5 to $8 | 3 | 3 |
| Airlock Digital | $5 to $12.50 | 2 | 2 |

Both scales run from 1 to 5. For implementation effort, **1 is minimal effort
and 5 is high effort**. For ongoing management, **1 is easy to manage and 5 is
difficult to manage**.

The two free options are the two most expensive to run. That is the trade this
table is really showing: WDAC costs nothing to licence and the most to operate,
while Airlock costs the most per endpoint and the least in staff time. Which of
those is cheaper depends entirely on what an hour of your team's time is worth.

> Pricing and product capabilities were correct as at September 2024. Vendors
> change both. Confirm current figures before you build a business case on them.

## The four solutions in detail

### AppLocker

**AppLocker** is a built-in Windows feature that allows administrators to
control which applications and files users can run. It operates by setting
rules based on file attributes, such as file path, file publisher, and hash
values.

It meets Level 1 by providing basic application whitelisting, and meets Level 2
but requires more complex rule sets to do it. It may struggle to meet Level 3,
as it lacks the flexibility and advanced features found in the other solutions.

Rule creation can be time-consuming in a large environment. Once rules are in
place, maintenance means periodic updates, which stays manageable until the
number of rules grows.

### Windows Defender Application Control (WDAC)

**WDAC** is a more advanced application control feature also built into
Windows. It provides stronger enforcement by using kernel-mode policies and
supports richer rule sets.

It meets Level 1 with ease, meets Level 2 with more comprehensive control than
AppLocker, and meets Level 3, offering the level of security and
customizability sophisticated environments require.

Policy creation is more complex than AppLocker's and requires a solid
understanding of Windows security. Managing those policies is equally
demanding, because of how deeply WDAC integrates with the Windows kernel.
Updating and troubleshooting both need someone who knows the system well.

### ThreatLocker

**ThreatLocker** is a third-party application control solution that uses
default deny policies, allowing organizations to whitelist specific
applications while blocking all others. It also provides endpoint protection
features beyond just application control.

It easily meets Level 1 with its default-deny approach, meets Level 2 with more
flexibility in policy creation, and meets Level 3 with granular control and the
ability to handle sophisticated, targeted attacks.

The interface is intuitive, but implementation still takes time for policy
configuration. Ongoing management is straightforward at first and becomes more
involved as new applications and updates arrive in the environment.

### Airlock Digital

**Airlock Digital** is a specialized application whitelisting solution
specifically designed for Essential 8 compliance. It provides a high degree of
automation to simplify the process of whitelisting applications, especially in
large and complex environments.

It easily meets Level 1 with automated controls, meets Level 2 with robust
application control capabilities, and is well suited to Level 3, having been
designed with a focus on high-level security.

Features like automatic application discovery reduce setup time. The automation
also cuts the day-to-day burden considerably: software updates and new
application requests are handled for you.

## Conclusion

Each application control solution offers unique benefits and is suited to
different levels of complexity and operational needs. **AppLocker** is a good
entry-level solution but may struggle with more complex environments. **WDAC**
provides stronger security but requires significant effort to manage.
**ThreatLocker** offers robust application control with a balance between ease
of use and flexibility. **Airlock Digital** is ideal for organizations looking
for automation and seamless compliance with the Essential 8, especially for
Level 3.

Choosing the right tool depends on your organization’s needs, resources, and
the complexity of your IT environment. For those looking for easy management
with advanced security, **Airlock Digital** is a great choice, while
**ThreatLocker** and **WDAC** provide solid options for more custom
environments. **AppLocker**, though free, may be limited for higher levels of
maturity.

Element Digital offers IT Consulting Services in Hobart, dedicated to providing expert guidance and strategic planning for all your IT needs. Our Hobart-based IT Professional Services are tailored to meet the diverse requirements of businesses in Tasmania. For more insights and updates, follow us on LinkedIn and stay connected with #ElementDigital.