Say Goodbye to Passwords and Hello to Passwordless Technology!
Passwords are being replaced by passkeys, and the technology is finally ready. What passwordless gives you, and what it takes to get there.
All resources
Application Control Technologies for Essential 8: A Comparative Guide
AppLocker, App Control for Business, ThreatLocker and Airlock Digital compared against the Essential Eight maturity levels, with indicative pricing, implementation effort and ongoing management.
Application control is a core component of the Australian Cyber Security Centre’s (ACSC) Essential 8 mitigation strategies. By restricting which applications can run in your environment, you significantly reduce the risk of malware infections and unauthorised software. Several technologies can be used to achieve this, including AppLocker, App Control for Business (formerly WDAC), ThreatLocker, and Airlock Digital. This post compares them against the maturity levels, gives a pricing guide, and rates both the implementation effort and the operational management involved.
The Essential 8 and application control
The Essential 8 framework defines three maturity levels for cybersecurity:
- Level 1: Basic cyber hygiene, designed to protect against opportunistic cyber threats.
- Level 2: Increased protection to defend against more targeted attacks.
- Level 3: Advanced protection, aimed at mitigating sophisticated cyber threats.
Application control is one of the primary strategies for each maturity level, becoming more stringent as you move from Level 1 to Level 3.
The comparison, up front
Maturity level coverage
| Solution | Level 1 | Level 2 | Level 3 |
|---|---|---|---|
| AppLocker | Yes | Yes | Limited |
| App Control for Business | Yes | Yes | Yes |
| ThreatLocker | Yes | Yes | Yes |
| Airlock Digital | Yes | Yes | Yes |
AppLocker is the only one of the four that does not comfortably reach Level 3. It will get you to Level 2, but it lacks the flexibility and the advanced features the higher level asks for.
Cost and effort
| Solution | Cost per endpoint per month | Implementation effort | Ongoing management |
|---|---|---|---|
| AppLocker | Free, with Windows Enterprise or Education | 3 | 3 |
| App Control for Business | Free, with Windows 11 Enterprise | 5 | 4 |
| ThreatLocker | $5 to $8 | 3 | 3 |
| Airlock Digital | $5 to $12.50 | 2 | 2 |
Both scales run from 1 to 5. For implementation effort, 1 is minimal effort and 5 is high effort. For ongoing management, 1 is easy to manage and 5 is difficult to manage.
The two free options are the two most expensive to run. That is the trade this table is really showing: App Control costs nothing to licence and the most to operate, while Airlock costs the most per endpoint and the least in staff time. Which of those is cheaper depends entirely on what an hour of your team’s time is worth.
Pricing is indicative and was last checked in September 2024. Capabilities were reviewed in September 2026. None of the paid options publish a public price list, so confirm current figures with the vendor before you build a business case on them.
The four solutions in detail
AppLocker
AppLocker is a built-in Windows feature that allows administrators to control which applications and files users can run. It operates by setting rules based on file attributes, such as file path, file publisher, and hash values.
It meets Level 1 by providing basic application allow-listing, and meets Level 2 but requires more complex rule sets to do it. It may struggle to meet Level 3, as it lacks the flexibility and advanced features found in the other solutions.
Rule creation can be time-consuming in a large environment. Once rules are in place, maintenance means periodic updates, which stays manageable until the number of rules grows.
App Control for Business (formerly WDAC)
App Control for Business is a more advanced application control feature, also built into Windows. Microsoft renamed it from Windows Defender Application Control, and you will still see the old name in plenty of documentation. It enforces through kernel-mode policies and supports richer rule sets.
It meets Level 1 with ease, meets Level 2 with more comprehensive control than AppLocker, and meets Level 3, offering the level of security and customisability sophisticated environments require.
Policy creation is more complex than AppLocker’s and requires a solid understanding of Windows security. Managing those policies is equally demanding, because of how deeply it integrates with the Windows kernel. Updating and troubleshooting both need someone who knows the system well.
ThreatLocker
ThreatLocker is a third-party application control solution that uses default deny policies, letting organisations approve specific applications while blocking all others. It also provides endpoint protection features beyond just application control.
It easily meets Level 1 with its default-deny approach, meets Level 2 with more flexibility in policy creation, and meets Level 3 with granular control and the ability to handle sophisticated, targeted attacks.
The interface is intuitive, but implementation still takes time for policy configuration. Ongoing management is straightforward at first and becomes more involved as new applications and updates arrive in the environment.
Airlock Digital
Airlock Digital is a specialised application allow-listing solution specifically designed for Essential 8 compliance. It provides a high degree of automation to simplify the process of allow-listing applications, especially in large and complex environments.
It easily meets Level 1 with automated controls, meets Level 2 with robust application control capabilities, and is well suited to Level 3, having been designed with a focus on high-level security.
Features like automatic application discovery reduce setup time. The automation also cuts the day-to-day burden considerably: software updates and new application requests are handled for you.
Conclusion
Each application control solution offers unique benefits and is suited to different levels of complexity and operational needs. AppLocker is a good entry-level solution but may struggle with more complex environments. App Control provides stronger security but requires significant effort to manage. ThreatLocker offers robust application control with a balance between ease of use and flexibility. Airlock Digital is ideal for organisations looking for automation and seamless compliance with the Essential 8, especially for Level 3.
Choosing the right tool depends on your organisation’s needs, resources, and the complexity of your IT environment. For those looking for easy management with advanced security, Airlock Digital is a great choice, while ThreatLocker and App Control provide solid options for more custom environments. AppLocker, though free, may be limited for higher levels of maturity.
There is more on what implementing the Essential Eight actually feels like in Essential 8 Lessons, including why application control tends to be the control that takes the longest.
Element Digital offers IT consulting services in Hobart. If you are choosing an application control product, get in touch.
