The initial foothold exploits - where application whitelisting would help the most - generally are not "critical systems", they are the daily workstations of random employees. By the time the attackers reach your critical systems, they most likely can attack them with stolen credentials without running any exploits that whitelisting would prevent.

To protect your company, application whitelisting needs enough usability to be easily supportable for the workstations of your accountant, office receptionist, and the VP of Marketing (those three are all good examples of valuable entry points for targeted attacks), which all may get management approval to throw out application whitelisting if it inconveniences them enough - there's no reasonable tradeoff between security and usability, you must get both as usability is mandatory and usability deficiencies will result in security features getting removed in all but the most critical circumstances.

What makes app whitelisting hard to use on an employee's corporate issue laptop? They shouldn't install anything that doesn't have a business purpose, and these days there are hardly any native apps people want to install anyway.

In practice it's quite common to run (and sometimes install) software that isn't whitelisted officially, even if it's outside strict IT rules.

Otherwise have fun editing scripts with Notepad++ because IT never cared to allow VSCode, unzipping using Windows Explorer's feature because your request for 7zip was denied since the feature exists on paper, navigating the web without content blocker, being restricted to Python 3.1 because the responsible doesn't care about updates, not being able to run your own compiled scripts, being unable to run your keyboard macros, having to manage your passwords in a txt file, having only Excel to analyze data…

Nothing, in theory. There is a lot of clerical office work, or fixed flow work (like CNC machining) that doesn't need new programs. But there is also a fair amount of IT work that is hampered enough by whitelisting that IT is the one that does not want to do the whitelisting.

Some of this can be blamed on Windows IT admins finding it normal to download random binaries and run them for diagnostic information or configuration management, but that is not an easy problem to solve.

There's no real reason except for basic incompetence and lack of resources. I expect that over the next few years most small and medium enterprises will essentially be forced to outsource their IT infrastructure to a few huge cloud vendors with the scale to build and maintain secure systems.

> these are critical systems

I’d guess that recognizing that a given computer is now critical infrastructure is also part of the problem.

How are you proposing to stop fileless malware with application whitelisting? How about popping shells on firewalls with memory corruption, then using the creds to pivot live-off-the-land style? Solarigate style supply chain attacks?

Whitelisting is the cool buzzword again, but it doesn't do much against human operated ransomware. It's a huge effort to implement (I know you want to say it isn't; try it and learn) and it's not very useful.

That's why most shops skip it.