A potentially unwanted application is software a user may not intend to install because it adds unwanted behavior, changes settings, or creates security risk. In cybersecurity, it includes adware, bundled installers, browser hijackers, and similar programs that are not always malware but can weaken endpoint trust, privacy, and control.
What Makes Potentially Unwanted Applications a Security Problem?
Potentially unwanted applications sit in a gray area between legitimate software and malware. They often arrive through bundling, deceptive prompts, or misleading install flows, then change browser settings, inject ads, collect data, or make the endpoint less predictable and less trustworthy.
The security concern is not just nuisance. A PUA can weaken user control over the device, introduce unexpected persistence, and create a foothold for further abuse by lowering the integrity of the endpoint environment.
How PUAs Affect Endpoint Trust and User Control
PUAs matter because they alter the operating conditions of a system without the user’s informed intent. That may include modifying homepage and search settings, adding extensions, changing default applications, or creating background processes that keep returning after cleanup.
Even when a PUA is not classified as malware, it can still reduce confidence in the endpoint as a trusted workplace asset. The practical effect is a smaller gap between “annoying software” and “software that helps an attacker hide, redirect traffic, or harvest data.”
Common Forms of Potentially Unwanted Software
PUAs commonly appear as adware, browser hijackers, toolbars, download managers, and bundled installers. Some are installed with clear consent buried inside a long setup sequence, while others rely on misleading defaults, pre-checked options, or unclear disclosures.
Definitions vary across vendors, so one security tool may flag a program as a PUA while another treats it as low-risk software. That variation does not make the category meaningless, it means organisations need a clear policy for what they will allow on managed endpoints.
- Adware can flood the user with advertising and tracking.
- Browser hijackers can redirect search and navigation behaviour.
- Bundled installers can add extra software the user did not intend to receive.
- Potentially unwanted system utilities can alter configuration or reduce visibility into the device.
Why Detection and Removal Require Policy, Not Just Antivirus
PUAs are often best handled through layered controls rather than relying on detection alone. Many are distributed through legitimate-looking installers or software marketplaces, which means endpoint protection, application control, and user-awareness controls all play a role.
Organisations also need a decision on what “unwanted” means in their environment. A tool that is tolerated in consumer use may be unacceptable in a corporate setting if it changes browser defaults, creates privacy risk, or complicates support and incident response.
Risk and Threat Considerations
PUAs create meaningful risk because they can degrade endpoint integrity without immediately triggering classic malware alerts. Their behaviours can also provide staging conditions for more serious abuse, especially when the software modifies browser state, introduces persistence, or opens a path for tracking and redirection.
Failure mechanism: The software changes settings, adds background components, or uses bundled installation paths to persist on the endpoint while remaining within a gray zone that many users and controls treat as low urgency.
Impact: Organisations can lose trust in endpoint configuration, expose user activity or browsing data, increase support burden, and miss early signs of a broader compromise path.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
CIS Controls v8, NIST SP 800-53 Rev 5, NIST CSF 2.0 and OWASP ASVS set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| CIS Controls v8 | CIS-2 — Inventory and Control of Software Assets | PUAs are governed through software allowlisting and asset visibility on endpoints. |
| Recommendation — Maintain software inventories and block unauthorized or unwanted applications from being installed. | ||
| NIST SP 800-53 Rev 5 | CM-7 — Least Functionality | PUAs often add unnecessary functions and persistence that least-functionality controls should restrict. |
| SI-3 — Malicious Code Protection | PUAs may not be malware, but malware protection often detects or quarantines unwanted software behaviors. | |
| Recommendation — Limit endpoints to approved functions and remove unnecessary or unwanted software capabilities. Deploy code-scanning and malware protections that flag suspicious or unwanted software activity. | ||
| NIST CSF 2.0 | PR.PS-01 — Configuration Management | PUAs change settings and browser state, making configuration management directly relevant. |
| Recommendation — Enforce approved configurations and detect unauthorized changes made by unwanted software. | ||
| OWASP ASVS | V13 — Configuration | PUAs often exploit insecure or unclear installation and configuration flows on endpoints and browsers. |
| Recommendation — Harden software and browser configuration so unwanted changes are blocked or immediately detected. | ||
Practitioner Guidance
Governance implication: Treat PUA handling as an application control decision, not only a malware decision. A clear allow, block, or review policy helps security teams and endpoint administrators respond consistently when software is unwanted but not overtly malicious.
What to watch for: Repeated browser setting changes, unexplained extensions, bundled installs, and recurring ad-supported utilities are strong signs that the environment needs tighter software controls and user-installation review.
Practitioner takeaway: The most effective PUA strategy is to reduce installation ambiguity at the source, then enforce the same standard across managed endpoints so “unwanted” does not become “accepted by default.”
Related resources from NHI Mgmt Group
- How should security teams respond when a file is labelled as a potentially unwanted application but the underlying capability is unclear?
- What happens when a user clicks a smishing link and installs a potentially unwanted program?
- How does Potentially Harmful Application work?
- How do attackers use Potentially Harmful Application?
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 23, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org