Which of the following is the MOST effective way for a large and diversified organization to minimize risk associated with unauthorized software on company devices?

Actively scanning endpoints for applications not in the approved asset inventory directly identifies unauthorized software, including shadow IT or malware, which poses a significant security risk. This method provides real-time or near real-time detection, allowing the organization to promptly address and remove unapproved applications across its diverse environment, thereby minimizing the associated risks.

Prohibiting cloud-based virtual desktop software is too restrictive and not directly focused on detecting *unauthorized* software on *company devices*; it targets a specific legitimate technology that might be part of an approved stack.

Conducting frequent reviews of software licenses is important for compliance and cost management but primarily identifies licensing non-compliance rather than the presence of potentially malicious or unauthorized software itself.

Performing frequent internal audits of enterprise IT infrastructure is a broad control; while it might uncover unauthorized software, it's not as targeted or efficient for this specific purpose as dedicated endpoint scanning.