Fifty prompts in your first week, or a tool that quietly trusts signed software? Learning Mode is the most convenient and most debated switch in the program. Both sides of the bargain, honestly.
Learning Mode exists because of a real human problem: people drowning in prompts stop reading them. It solves that problem by auto-allowing digitally signed programs and only bothering you about the unsigned unknown. Whether that is a wise trade depends on what a signature really proves — and what it does not.
Learning Mode watches outbound attempts and automatically allows programs that carry a valid digital signature from a known publisher, writing the rules for you. Programs without a signature still trigger a prompt. The idea is simple: Microsoft, your browser maker and your office suite sign their software — the tool trusts that signature so you do not have to approve the fiftieth component of a suite you already trust.
On a fresh PC, Medium Filtering without learning can mean a storm of prompts in the first week — every helper, updater and background service of every suite asking its question. Most users respond the human way: they start allowing everything just to make the boxes stop, which quietly destroys the protection the prompts existed to create. Learning Mode removes most of that storm, so the prompts that remain actually get read.
Here is the honest grade. Every auto-allowed program is a connection you never saw and never approved. A signature proves who published a program — it does not prove the program behaves well, and plenty of signed software phones home enthusiastically for telemetry, advertising and upselling. With learning on, those leave silently. The log still records them, but a log nobody opens is a diary, not a guard.
If the PC holds sensitive work, or you are the kind of user who genuinely reads prompts, leave learning off and take the questions. Your ruleset then contains nothing you did not personally approve — the strictest honest state this tool can give you. Learning Mode is a trade, and it should be made knowingly: fewer questions, in exchange for trusting signatures by default.
Learning Mode becomes much more defensible when you use its guardrail: the programs you place on the always-ask list are never learned, however good their signature looks. Put your browser's helper processes there if you like, the accounting package, anything whose connections you personally want to witness. That one habit converts learning from a blanket trust into a default with named exceptions — which is how most real-world security policies actually work.
Profiles, prompts and rules — the whole Firewall Control walkthrough is in the video.
▶️ Watch Full VideoIn the Binisoft era it was one of the registered-user extras, along with notifications. After Malwarebytes acquired the tool the program became free for everyone, but older descriptions still list it as registered-only — check the version installed on your PC.
A valid signature only proves the publisher's identity. Signed but unwanted software — aggressive updaters, bundled extras — would be allowed automatically, which is exactly why the exceptions list and the Connections Log review habit matter when learning is on.
Yes, and it is a sensible pattern: let it build the baseline rules for your signed everyday software during setup week, then switch it off so every genuinely new program faces a prompt from then on.