Zenarmor application control: see your shadow IT and control 5,000+ apps on your business network

Application control identifies which application sits behind a network connection and lets you allow or block that app, regardless of port or IP address. Zenarmor does this at layer 7 using an application database of more than 5,000 apps with dynamically updated signatures. First you see which apps are actually in use (shadow IT); then you set policy per user, group, VLAN, device and time schedule.

This article explains why classic port and IP rules no longer suffice, how to roll out application control step by step without disrupting the business, how to govern generative AI and file-sharing services, and how to map the settings to ISO 27001:2022, NIS2 and the VDA ISA (TISAX). We write from two angles: as an independent ISO 27001 Lead Auditor and as an official Zenarmor partner in the Netherlands.

Why port and IP rules are no longer enough

A traditional firewall decides on source, destination, port and protocol. That worked when applications used their own ports. Today almost everything runs over HTTPS on port 443: Microsoft 365, WhatsApp Web, Dropbox, ChatGPT, online games and remote-access tools. A rule such as “allow port 443” tells you nothing about what travels over that connection.

• Cloud apps share infrastructure. Many services run on the same CDNs and cloud platforms, so IP lists are coarse, go stale quickly and sometimes block legitimate services as collateral damage.
• Apps hop ports and protocols. Peer-to-peer, VPN and remote-access software automatically look for another route when a port is closed.
• Users install their own tools. A free translation service, an AI assistant or a personal file-sharing account is in use within seconds, without IT knowing.

A layer 7 firewall therefore looks at the application itself. Zenarmor classifies every connection using the Zenarmor Application Database, which is kept current with dynamic signatures. According to Zenarmor, the engine identifies 5,000+ applications by name, not just by port and protocol. Application control adds a layer on top of your existing L3/L4 rules on OPNsense, pfSense CE or Linux; it does not replace them.

Visibility first, then policy: discovering shadow IT

The biggest mistake with application control is to start blocking straight away. You don’t yet know which business processes you will break, and the service desk pays the price. Start with visibility instead. Zenarmor’s reports and Live Sessions show which applications and categories are used per user, device and segment.

Two low-risk ways to begin:

• Routed mode with a permissive policy. Zenarmor runs inline, but you initially allow every app category and only collect reporting data. Later you switch on blocking without reinstalling anything.
• Passive mode. Zenarmor analyses a copy of the traffic, for example from a SPAN port. According to the deployment modes documentation, blocking is not possible in this mode, but full reporting is. Useful when you want a baseline without touching the network path.

After two to four weeks you have a realistic picture. Typical findings in a first measurement: personal cloud storage alongside the corporate tenant, several AI chat services, remote-access tools nobody approved, torrent traffic on the guest network and streaming eating bandwidth at peak times. That is your shadow IT inventory, and direct input for your risk assessment.

Blocking and allowing by app and category

In Zenconsole and the local Zenarmor interface, applications are grouped into categories and subcategories. Each category shows the status Allowed, Blocked or Custom (some apps blocked). You can:

• block an entire category, such as games or peer-to-peer;
• allow a single app within a blocked category once you have approved it;
• search apps by name and block or allow them individually.

Once saved, Zenconsole synchronises the policy to the gateways. Live Sessions and the reports show which policy, app or category blocked a connection — handy for the service desk and immediate evidence for an audit.

Policy per user, group, VLAN, device and time schedule

A Zenarmor policy can be scoped by interface, VLAN, IP address or subnet, MAC address, discovered devices and device categories, users and groups, and a time schedule (days and hours). According to the policy documentation, all criteria are combined with a logical AND. So you can express rules like “group Production, VLAN 30, Monday to Friday 07:00–17:00”.

For users and groups you connect an identity source such as Microsoft Entra ID, Google Workspace, Okta or a SAML 2.0 provider. Since Zenarmor 2.7, organisation-wide policies can also match Active Directory and LDAP users and groups. On OPNsense, user-based filtering via the captive portal is also possible, for example for guests or shared workstations.

For IoT and OT, use device identification: Zenarmor recognises device types and you can add device categories to a policy. A camera or PLC has no user logging in, but it does have a clearly expected traffic pattern.

Generative AI and file sharing: what is and isn’t possible

The question we hear most right now: “can we control ChatGPT and other AI tools?” The honest answer has two layers.

Layer 1: app and category level (application control)

The App DB contains an A.I. Tools category; the documentation uses Google Gemini as an example. You can block the whole category and then re-allow the approved service, such as your corporate Copilot or ChatGPT workspace. The same applies to file sharing and personal cloud storage: allow or block as an app or category, per group and per segment. Check in your own Zenconsole how each service is classified, because the database evolves with the market.

Layer 2: action level (CASB, SSE and higher)

If you want to allow a service but stop certain actions — uploading, sharing or deleting — you need Cloud Access Rules (CASB). These are available from the SSE editions upwards and require full TLS inspection. The documentation also mentions category-based TLS inspection for, for example, the Generative AI category, and that QUIC connections must not remain allowed. Which actions can be controlled differs per service. For a worked example on uploads to WeTransfer, see our article How SSE, CASB and DLP stop confidential uploads to WeTransfer.

Be clear about what is not possible: Zenarmor does not assess the content of what an employee types into an AI prompt. Content-aware DLP requires additional measures such as data classification, awareness and rules in your AI policy.

Practical policy examples

The table below shows starting points we use in projects. They are examples: the right choices follow from your risk assessment and your acceptable use policy.

Environment	Allow	Block or restrict	Scope
Office (staff)	Microsoft 365 or Google Workspace, approved AI service, video calls, business applications	Peer-to-peer, unapproved remote-access tools, other A.I. Tools, personal cloud storage	Group “Staff” via Entra ID or LDAP, office VLAN
Guest Wi-Fi	Web, email, mainstream streaming	Peer-to-peer and torrents, remote-access tools, anonymiser and proxy services (where recognised)	Guest VLAN, captive portal, optional schedule
Production / OT	Only the required industrial and maintenance applications	All other categories; remote maintenance tool only during the maintenance window	OT VLAN, device categories, schedule
Education (pupils)	Learning platforms, office apps, exam environment	Games, social media and streaming during lessons; A.I. Tools during exams	Pupil VLAN or group, timetable schedule

Always combine application control with network segmentation. Segmentation decides which zones may reach each other; application control decides which apps are allowed within and from those zones. For web traffic itself — phishing, malware and categories such as gambling — use the Zenarmor web filter.

Compliance: mapping to ISO 27001, TISAX and NIS2

Application control is not a goal in itself. Auditors want to see that you have a policy and that the technology demonstrably enforces it. Zenarmor supports this; it does not make you compliant on its own. Here is how the settings map to the frameworks:

Framework / control	What application control contributes	Evidence for the auditor
ISO 27001:2022 A.5.10 – Acceptable use	Technical enforcement of the acceptable use policy	Policy plus export of blocked categories
ISO 27001:2022 A.8.20 – Networks security	Controlled network traffic at application level	Configuration, change history, reports
ISO 27001:2022 A.8.22 – Segregation of networks	Different app policies per VLAN or segment	Policy overview per segment
ISO 27001:2022 A.5.23 – Use of cloud services	Visibility of the cloud services actually in use	Top-apps report compared with the approved list
VDA ISA 1.3.3 / 1.3.4 – approved external IT services and software	Detect and block unapproved services	Periodic comparison of the app report with the approved list
NIS2 Art. 21(2)(a), (g), (i)	Security policy, cyber hygiene, access control policy and asset management	Policy, reports, review minutes

For ISO 27001, reference these measures in your Statement of Applicability (see the ISO/IEC 27001:2022 standard). For the automotive supply chain: TISAX® results are labels, not certificates. VDA ISA controls 1.3.3 and 1.3.4 require that only assessed and approved external IT services and software are used (see for example this explanation of ISA 1.3.3). Numbering may shift in ISA2027. More in our article on TISAX readiness and network security. For NIS2, the risk-management duty is in Article 21 of Directive (EU) 2022/2555; see also ISO 27001 and NIS2. How to use the reports as evidence is covered in Zenarmor reporting for NIS2 and ISO 27001.

Rollout in five steps

This is how we introduce application control, from baseline to structural review:

Managing several sites or customers? Roll out the same policy centrally through Zenconsole, with an audit trail and policy backups.

Limits: encrypted traffic and honest expectations

Application control is powerful, but not magic. Keep the following in mind:

• TLS without decryption. With light-weight, certificate-based TLS inspection, Zenarmor reads the hostname, web category and application type from the handshake. That is enough for many app decisions. When browsers use Encrypted Client Hello (ECH), the hostname is no longer visible, according to the TLS documentation.
• Deeper control requires full TLS inspection. Action control (CASB) and URL-level rules need decryption, with your own CA certificate on the endpoints. That has privacy and employment-law implications; read our article on TLS inspection with Zenarmor first.
• QUIC. Zenarmor recommends blocking the QUIC protocol; browsers then fall back to TCP, where inspection is more reliable.
• Devices off the network. A laptop at home or a phone on 5G does not pass your gateway. That is what the endpoint agents are for (Windows, macOS, Linux, Android, iOS).
• Classification is never 100%. New apps appear every day, so plan the monthly review and the exception process from the start.