I would add one. An agent that lands still needs something to run, a driver, an RMM, a LOLBin. Default-deny app control takes those away, and it does not get tired either. Make every step cost more time, tokens and compute.

Try default-deny app control free with https://MagicSword.io: https://magicsword.io