Application whitelisting: it's easy to say it should be practiced as part of a complete endpoint security practice, but in reality it can be hard to deploy widely without causing friction and frustration across the organization. This talk will look at the tools and processes that enabled Duo's Corporate Security team to progressively deploy and monitor application whitelisting across their fleet of OS X endpoints.