Endpoint control is the use of security policies to govern which software can run on a device and what actions it may perform. Controls can allow or block applications, restrict changes to sensitive settings, and prevent approved programs from launching unexpected processes.
These policies matter because attackers may exploit trusted tools or combine them with other payloads to execute code. In a campaign involving legitimate software, endpoint controls can limit what that software is permitted to do, while monitoring can flag unusual behavior. Defenders should inventory installed applications, apply least-privilege rules, and review execution policies alongside patching and phishing defenses.