The Zero-Trust Application Service involves continuous monitoring of endpoint activity and sending every application running on the endpoints to a cloud platform for classification. The classification is based on AI and multiple machine learning algorithms that process static, behavioral, and context attributes in real-time. The service uses risk-based application control to default-deny any unknown application or binary. The service classifies applications as either malware or trusted before allowing only the trusted ones to execute on each endpoint.