What happens when there is a drift from the approved inventory detected by Application Control?

When there is a drift from the approved inventory detected by Application Control, the system moves into enforcement mode and logs the event. This means that any unauthorized applications or changes that do not align with the approved list of applications will be actively blocked to ensure compliance with the security policies in place.

Enforcement mode effectively protects the enterprise environment by preventing the execution of applications that have not been pre-approved, thus reducing the risk of malware or other untrusted software impacting the system. Logging the event allows administrators to review these occurrences and understand potential vulnerabilities or compliance issues that need to be addressed. This proactive combination of blocking unauthorized changes while documenting the incidents provides a robust framework for application security management.