White listing doesn’t protect against supply chain attacks. You need some sort of behavioral analysis.