The two Essential Eight controls everyone underestimates
Application control and patching look like the simple ones on paper. In practice they are where most Essential Eight uplifts stall, and for the same reason.
When an organisation decides to get serious about the Essential Eight, the conversation usually starts with MFA and admin privileges. Fair enough; those are visible and the tooling is mature. The two that end up consuming the budget are the ones that looked easy in the planning workshop: application control and patch applications.
They stall for the same reason. Both require you to know what's actually running on your fleet, and almost nobody does.
Application control
The maturity model wants you to prevent the execution of unapproved executables, scripts, installers, compiled HTML and the rest, from user-writable locations at Maturity Level One, then everywhere at Level Two, with rulesets validated annually and a growing list of blocked drivers and known-bad binaries as you go up.
The technology is not the hard part. Windows Defender Application Control (now App Control for Business) or AppLocker will do it, and Intune will push it. The hard part is the week after you turn on audit mode and discover:
- the finance team runs a macro-enabled workbook that shells out to a console app nobody has seen since 2014,
- the engineers have a
toolsfolder in their profile that every one of them depends on, - three line-of-business apps update themselves by dropping a new executable into
%LocalAppData%.
None of that shows up in an application inventory. It only shows up in audit logs, which is why audit mode is not optional and three months of it is not excessive. Collect the events centrally (the Intune device log collection or a Log Analytics workspace will do), build the allow rules from what you see, and publish rules by publisher wherever the binary is signed, so an update doesn't become a block.
The thing to avoid is the shortcut where someone allows an entire path because it was noisy. A rule that allows everything under C:\Program Files sounds reasonable until you remember that's a writable location for a lot of installers. Keep path rules for places standard users can't write to, and nothing else.
Patch applications
The requirement reads simply: patch within 48 hours when an exploit exists, otherwise within two weeks, for internet-facing services and the apps that interact with untrusted content; remove the things the vendor no longer supports; and use a vulnerability scanner to find what you missed.
What stalls it:
The 48 hours. Not the patching, the deciding. If the only way to know a vulnerability is being exploited is for someone to read advisories in the evening, you won't make 48 hours. Subscribe to the ASD alerts and the CISA Known Exploited Vulnerabilities feed, and give one person the job of reading them.
Apps that aren't yours. Windows Update for Business handles Windows and Office well. It does nothing for the PDF reader, the browser you don't standardise on, Java, the VPN client, and the forty other things people installed. You need either the Microsoft Store apps via Intune (good, where the app is there), an app catalogue like the Enterprise App Catalog or a third-party patching tool, or a willingness to repackage. Pick one; the mixed approach is where things get missed.
Unsupported software. Every fleet has it. The old Access runtime, the scanner driver tool, the EOL browser kept "for one system". Removal is a conversation with the business, not a technical task, and it is better had early.
The scanner. Defender Vulnerability Management is already there if you have the licence, and it is the fastest way to turn "we think we're patched" into a list. Run it before you declare the control met, not after the assessor asks.
Why they're worth it
Both controls do the same thing from different angles: they stop attacker code from running on your endpoints. Everything else in the Essential Eight limits the damage once it's running. That's why these two are hard, and why they matter most.
If you're planning an uplift, put them first on the timeline, not last, and give them the audit period they need. The rest of the eight will go faster for it.
Written from the field, not a lab. If something here has changed since, it probably has; the newer posts are the place to look.