ThreatLocker Zero Trust Platform Reviews

My main use cases for ThreatLocker Zero Trust Endpoint Protection Platform include application elevation. We started using the web portion where you can control ports and filtering. Elevation and application elevation for local administration rights are primarily what we focus on, taking away local admin access.

The features of ThreatLocker Zero Trust Endpoint Protection Platform that I like the most include the elevation, which has been huge. We just got the web portal, so I'm starting to like that a lot and I plan to explore it more.

The application elevation feature of ThreatLocker Zero Trust Endpoint Protection Platform benefits my company by reducing help desk tickets and users needing to install software when we can mass enable an installation or mass approve an EXE. I can publish applications and then people can self-install them if they've been added to our repository.

To improve ThreatLocker Zero Trust Endpoint Protection Platform, I think the team is already working on it. One of the things was the ease of application allowlisting. They actually covered this on day one with the approval process, but you get multiple approvals. I think it would be better to have clearer descriptions on what each of the installation modes are.

I have been using ThreatLocker Zero Trust Endpoint Protection Platform for two years.

I assess the stability and reliability of ThreatLocker Zero Trust Endpoint Protection Platform as excellent since I have had no issues at all. It has been very reliable.

ThreatLocker Zero Trust Endpoint Protection Platform scales well to the growing needs of my company as we have expanded a couple of modules. We just added a new one and it was very easy to turn up. We still have some backend development and setting adjustments, but it has been very easy to scale, add and reduce computers.

The customer service and technical support of ThreatLocker Zero Trust Endpoint Protection Platform have been excellent. The Cyber Heroes are phenomenal and are right there with you. They get involved and help you. It has been really easy to access support and they are great people.

Prior to adopting ThreatLocker Zero Trust Endpoint Protection Platform, we were not using another solution to address similar needs.

ThreatLocker Zero Trust Endpoint Protection Platform has reduced some of the operational costs in my company in terms of time spent on tickets, but nothing major.

My experience with the pricing, setup costs, and licensing of ThreatLocker Zero Trust Endpoint Protection Platform is that it has been very reasonable and very easy to set up. Licensing is through our MSP, so it is not something I deal with directly, but it was very easy to acquire and implement into our industry.

Before choosing ThreatLocker Zero Trust Endpoint Protection Platform, I did consider CyberQP.

In the evaluation process, both positive and negative aspects stood out to me when comparing ThreatLocker Zero Trust Endpoint Protection Platform and CyberQP. Both are excellent programs. CyberQP is a little easier for the elevation piece, but there are far fewer controls and it has a much smaller platform footprint in terms of the security side. Each has their own niche and then they have a little overlap. I was more focused on the elevation portion as our primary problem.

My impression of the allowlisting feature in ThreatLocker Zero Trust Endpoint Protection Platform for managing which software, scripts, and libraries run on my devices is that it is awesome. I think the allowlisting feature in ThreatLocker Zero Trust Endpoint Protection Platform is very intuitive and extremely well done. It is easy to allow and deny certain things and it is a great tool.

I have used the Ringfencing feature in ThreatLocker Zero Trust Endpoint Protection Platform. Ringfencing has opened our eyes to many things and how when you elevate something, it also gets extra access. It has helped us focus and keep things in the wheelhouse that they are supposed to be and helped us eliminate a threat vector that we did not know about or that we knew about but could not control.

I have not used the network control feature in ThreatLocker Zero Trust Endpoint Protection Platform yet. I am not using the storage control feature in ThreatLocker Zero Trust Endpoint Protection Platform. I have not used the DAC Dashboard in ThreatLocker Zero Trust Endpoint Protection Platform.

I do not have extensive insight on the efficiency of the real-time threat intelligence and category controls employed by Web Control in blocking malicious and non-compliant sites because it is very new to us. I had just demoed it before attending this event and started playing with it here, so I do not have a huge insight into that yet.

My assessment of ThreatLocker Zero Trust Endpoint Protection Platform's role in facilitating Just-In-Time administrative access for approved applications is that it has made life very easy for Just-In-Time accounts and Just-In-Time elevations. It has reduced our local admin footprint and the entry of credentials on end user machines. It has increased our overall security stature and reduced our footprint.

On a scale of one to ten, I would rate ThreatLocker Zero Trust Endpoint Protection Platform an eight or nine. It would be an easy ten, but you really need to have people who know how to use the application. My advice is to really take the time and learn it. It is really easy to put on, really easy to deploy, and really easy to deploy wrong. If you take the time and do it correctly, it is a phenomenal product.

The main use cases for ThreatLocker Zero Trust Endpoint Protection Platform at my company are the Auto-Elevate platform and Application Control. Those were two big priorities for us. We needed something to replace our Just-In-Time admin access. We wanted to find something smoother than having to accept every time someone needed to elevate.

By using ThreatLocker Zero Trust Endpoint Protection Platform, we are considering whether we can eliminate or consolidate any security tools or solutions. We are still wanting to explore everything it can do versus something like a good EDR platform, but we are very interested in what we have seen from ThreatLocker's endpoint protection as well as their Cyber Hero and MDR platform.

ThreatLocker Zero Trust Endpoint Protection Platform has helped our company save on operational costs and expenses. So far, we are still fairly early into using it, but we can already tell from the time that we are starting to save that we are going to get a lot back out of it.

I am a big fan of the Application Control and Ringfencing features of ThreatLocker Zero Trust Endpoint Protection Platform, as well as the elevation capabilities and how fairly easy it is to make a policy based on those elevation requests and all of the built-in protections that they have.

A lot of the value comes from time and speed. Once you make the policy, you are set. You do not have to keep going back to it over and over again. We can definitely see a breakpoint where once we have these policies in place, we will not need to keep going into ThreatLocker Zero Trust Endpoint Protection Platform on a day-to-day basis and monitoring these elements. Once we have all of that in place, it is going to be a huge time-saver for us.

The allow-listing feature of ThreatLocker Zero Trust Endpoint Protection Platform has a steep learning curve at first, but once you understand it, it is very smooth. We are looking forward to reaching that break-even point. It does seem that it is going to be very low hassle and low time management once we have all of those application controls in place.

The Ringfencing feature makes it much more secure. I would assess its impact on controlling the behavior of approved applications very positively. It will help us with things such as auditing down the line, being able to know what PowerShell is actually interacting with and who can and cannot run applications such as PowerShell. We can tell from everything we have seen that it does a great job at ring-fencing everything.

The network control feature impacts my ability to manage network traffic across my endpoints and servers very positively. So far, we have not implemented too much on the network control side, but it is nice having those audit logs and being able to see where people are making those connections. Once we are ready to really go full-in on the network control, we will have a good amount of information and signals in front of us to be able to make those decisions so we can lock that down just as much as the application controls.

The Elevation Control feature is what made us look at ThreatLocker Zero Trust Endpoint Protection Platform to begin with. Our assessment of Elevation Control's role in facilitating Just-In-Time administrative access for approved applications is that we are loving it so far. Our users are loving it. They appreciate the fact that they do not have to continuously ask for elevation on certain programs. Once an elevation is set and once a policy is created for it, they are able to continuously run it as long as we know that it is a good application, which saves us a lot of time and saves them a lot of time too.

I think the storage control feature of ThreatLocker Zero Trust Endpoint Protection Platform is awesome. It is very granular compared to some other solutions that I have seen before. I have used some other vendors in the past for storage control, and a lot of it is just on and off, whereas with ThreatLocker Zero Trust Endpoint Protection Platform, you can build those policies out more comprehensively. It is easier to exclude or allow certain files and programs to run. You can have a specific device be able to talk to a specific host on a specific path, whereas with most others, it seems they can either use a USB or they cannot use a USB. This is great whenever we are dealing with our HR and finance departments that do need to have access to removable storage.

ThreatLocker Zero Trust Endpoint Protection Platform could be improved by being able to consolidate even more with an EDR for deeper scanning as needed. The philosophy for ThreatLocker does not quite seem to head in that direction, but it still would be very beneficial. Additionally, deeper browser control would be beneficial to be able to see DLP mismanagement where people are entering information into an AI platform that we do not want them to be able to enter that information into, or at the very least alert us to that type of activity.

I have been using ThreatLocker Zero Trust Endpoint Protection Platform for approximately three months.

My assessment of the stability and reliability of ThreatLocker Zero Trust Endpoint Protection Platform is very positive. As long as we have had it, we have not had any complaints regarding performance, and we have not seen any downtime accessing the portal or from endpoints.

ThreatLocker Zero Trust Endpoint Protection Platform scales very smoothly with the growing needs of our company. We have expanded usage, and so far, the process has been very smooth with the Application Control learning modes and the baseline scans. It has made it so we can shorten down those learning times where we are not quite as protected as we would prefer to be. At this point, we are able to roll it out to over 300 endpoints very seamlessly.

I would evaluate the customer service and technical support from ThreatLocker as a ten out of ten. They are very good on both sides of that.

Positive

Prior to adopting ThreatLocker Zero Trust Endpoint Protection Platform, we were primarily using ScreenConnect's auto-elevate and Just-In-Time access management for similar needs. One factor that led us to consider a change was the price that we were paying for them for pretty much just that feature was close to what we ended up paying for ThreatLocker Zero Trust Endpoint Protection Platform entirely. So we got a lot more out of ThreatLocker Zero Trust Endpoint Protection Platform. Additionally, the rules that we could build in those platforms just were not as robust as what we can create in ThreatLocker Zero Trust Endpoint Protection Platform, giving us a much more secure platform.

My experience with the pricing, the setup costs, and the licensing for ThreatLocker Zero Trust Endpoint Protection Platform is that they were very flexible with us. They worked with us to give us a good five-year term, starting off at where we needed to be in order to get ThreatLocker Zero Trust Endpoint Protection Platform. Then we were able to slowly adjust over those five years, so we were getting a very good rate upfront and then a solid rate continuing on from there.

We did not shop around too much for other providers before selecting ThreatLocker Zero Trust Endpoint Protection Platform. I was familiar with ThreatLocker from a previous company, so we were very quick to want to join up with ThreatLocker. They were very nice with the pricing and flexible with working with us, so it made the decision straightforward.

It is very easy to identify which security and configuration settings need fixing using the DAC dashboard. It is pretty much one or two clicks. You can see all of the configuration mismanagements that you have, and then it is another one or two clicks to view a solution.

So far, we have not done too much on the real-time threat intelligence and category controls employed by web control in blocking malicious and non-compliant sites, so I cannot speak to that.

I would rate ThreatLocker Zero Trust Endpoint Protection Platform very highly. The biggest advice I would give to other companies considering this solution is to use the ThreatLocker Academy. Make sure you get the university package so you can really learn. There is a lot that you can do with ThreatLocker Zero Trust Endpoint Protection Platform, but there is a lot of misconfigurations you can put in there and accidentally take some people down for a while while you are trying to troubleshoot it. So definitely work with your solutions engineers and read those knowledge base articles. Overall, I would rate this review as a ten out of ten.

For example, in my day-to-day work, for storage control, whenever we have USB devices that we don't want production to use, we use the storage control. Whenever there is a shared folder that we don't want people to access, we use storage control. Allow listing is used so that people don't execute files that are not approved. This is zero trust—by default, everything is denied and we specify what we need to allow.

Elevation is something I would like to add. The elevation control is very good. We use it all the time for those applications that require one-time admin privileges, such as QuickBooks. When you need to update QuickBooks, we use elevation so that users can run QuickBooks as an administrator and update it themselves. We use this for applications that require elevation or one-time elevation.

My use cases for the data storage access control and storage control feature are mainly for storage, such as USB devices and shared folders.

The elevation control is something that we have used in the past and it has reduced the amount of tickets we get because people need elevation. We configure applications that we need to elevate and the user can elevate the application themselves without needing to call the service desk or open a ticket for that.

The addition of licenses through Microsoft 365 for elevation is a way that we have been able to eliminate or consolidate security tools or solutions.

What I appreciate about allow listing is the deny by default approach because it lets me control or at least audit what people do or what people are trying to install on a day-to-day basis. I can audit this allow listing and then approve whatever I need to approve. Network control functions as a centrally managed host-based firewall. I appreciate how non-approved traffic is blocked.

What stands out to me about the storage control feature is that it prevents the use of unauthorized storage devices. This helps prevent information leaks.

Regarding ThreatLocker Zero Trust Platform's AI capabilities, I appreciate the way ThreatLocker keeps updating their platform. For example, in learning mode, you can select multiple products that have already been tested by ThreatLocker.

I would rate the solution's allow listing feature in terms of managing which software, scripts, and libraries run on your devices as a 10 out of 10. This is probably the best feature I have seen in ThreatLocker.

I think it is easy to identify which security and configuration settings need fixing using the DAC dashboard. When there is something that I need to look at, I usually go into the audit and see which items are getting blocked because of mis-allow listing.

ThreatLocker Zero Trust Endpoint Firewall's network control feature has not impacted my ability to manage network traffic across my endpoints and servers. Normally, before we implement ThreatLocker, we put it into learning mode for at least a week or two. That way, it knows what traffic goes through the network, so it does not block anything that is on-premises because it has already learned about it.

Another thing I would appreciate seeing is content filtering. Content filtering would allow us to prevent access to those websites that we do not want people to access.

I rate the platform a nine because it still needs some improvement. If we can get budget control, that would be beneficial because we sometimes install more endpoints than we can afford to and then the bill gets out of control. We end up spending more than we wish to.

My main use cases for it involve blocking what shouldn't be running or blocking software in our company that's not whitelisted, so people can't use what they want. We also get phishing emails, and people like to click on things and run applications, so ThreatLocker Zero Trust Endpoint Protection Platform has stopped that before in the past as well.

The feature of ThreatLocker Zero Trust Endpoint Protection Platform that I like the most is probably the deny access feature. I find the deny access feature easy to use; you can do it with Microsoft, but ThreatLocker Zero Trust Endpoint Protection Platform just makes it easy, allowing me to go right to the application, set it to deny all, and it's done without having to do anything else.

This deny feature benefits my company by stopping the shadow IT aspect of it; we know what's running on the machines, and we don't have people just installing whatever they want to install on their work machine, so we can manage the endpoints better.

By using ThreatLocker Zero Trust Endpoint Protection Platform, we have been able to eliminate or consolidate some security tools or solutions because there was some overlap, and ThreatLocker Zero Trust Endpoint Protection Platform covered it or the other application we used covered it, so we were able to save money.

I assess the impact of ThreatLocker Zero Trust Endpoint Protection Platform on controlling the behavior of legitimate applications as great since we don't have to worry about logging in to help someone update something that needs admin credentials; you can just whitelist it with ThreatLocker Zero Trust Endpoint Protection Platform, and it will do it, except for UPS WorldShip because that's a monster and a terrible application.

I do use the Elevation Control feature. My assessment of its role in facilitating just-in-time administrative access for approved applications is that it does not take our time to do it; it's set, it can go, and we give it to the end user so they can do it. There's no need to remote in and use my credentials; the credentials are used once and they're gone.

My thoughts on the Storage Control feature in enforcing policy-driven access over various storage devices involve blocking people from being able to use USB drives or thumb drives unless they were approved, especially in finance to prevent them from just plugging something in that they found in the parking lot.

My experience with it is that it's super simple to set up; it's all pretty intuitive on how to use it.

It's easy to identify which security and configuration settings need fixing using the DAC dashboard since it shows, and you can look at per machine to see what's been denied in the past, such as three days, five days, and seven days; you can decide if something should or shouldn't be running with just a two-second process to click approve or deny.

I don't know how ThreatLocker Zero Trust Endpoint Protection Platform can be improved, and I'm happy with how it is now, so I can't think of anything off the top of my head.

There are some programs that, when they update, they hit other folders; it would be nice to be able to see where that application is pointing when it wants to update, especially if it's updating in the AppData folder or C Windows folder since it might be the same application already whitelisted, but it changes around.

I have been using ThreatLocker Zero Trust Endpoint Protection Platform for about a year and a half.

I have experienced none in terms of stability and reliability, with no downtime, crashes, or performance issues.

ThreatLocker Zero Trust Endpoint Protection Platform scales with the growing needs of my company by just adding the agent on the machine, which goes into learning mode for about 30 days, and it's done.

The customer service and technical support are great when I've needed them; I've never had to call, just get on the live chat, and someone's there within a minute or so who knows their stuff.

Positive

Prior to adopting ThreatLocker Zero Trust Endpoint Protection Platform, I used Defender a little bit, and it's kind of a bear to set up, but ThreatLocker Zero Trust Endpoint Protection Platform was super simple, especially with setting up; we had Adam, our technical rep from ThreatLocker, who walked us through it from the start, and we meet with him quarterly for usually just a five-minute check-in unless I have a question, but other than that, it's been simple, and he's been great.

ThreatLocker Zero Trust Endpoint Protection Platform has helped my company save on operational costs since we set it and don't have to spend time updating applications ourselves, giving more control to the user to run the applications they want without managing each and every one.

I don't know approximately how much was saved off the top of my head, but I can say we dropped an MSP that was supposed to be helping us and brought more of the security in-house, which was expensive, so we didn't have to pay them to monitor.

I have no idea by how much the operational costs have been saved, but I know we're not cheap and there's definitely a time savings.

My experience with pricing, setup costs, and licensing is that it's super simple and easy; for what it is and what it replaces and can do, it's an easy peace of mind and an easy sell.

We use the Ringfencing feature with ThreatLocker Zero Trust Endpoint Protection Platform on some of the PowerShell scripts just to keep it local.

From 1 to 10, I would rate ThreatLocker Zero Trust Endpoint Protection Platform as a 10; I've been super happy with it, advising other companies to just do it since it's a simple setup, easy to use, intuitive, and worth the money compared to potential losses. I give this review an overall rating of 10.

Our main use case for ThreatLocker Zero Trust Platform is controlling what applications can run on the endpoints for end users. We use it to block unauthorized software and give users temporary elevated access when they need it, without giving them full admin rights.

A common example is when a user needs to install or update any specific application that requires admin privileges. Instead of giving them local admin access, we use ThreatLocker Zero Trust Platform to temporarily elevate that specific application so that they can completely complete the task safely.

One thing I would like to add is that we also use ThreatLocker Zero Trust Platform to get better visibility into what applications users are trying to run. It helps us review the requests and decide what should be allowed instead of just giving a user admin access.

ThreatLocker Zero Trust Platform has improved our overall endpoint security and given us much better control over admin privileges. We can block unauthorized applications and provide elevation only when needed, which reduces risk while still letting users get their work done.

I have definitely reduced the risk around local admin access. Users no longer need permanent admin rights for one-off tasks and ThreatLocker Zero Trust Platform gives us better control over what software or application is allowed to run.

We still use our other endpoint security tools alongside ThreatLocker Zero Trust Platform. For us, ThreatLocker Zero Trust Platform adds another security layer with Application Control and privilege management rather than completely replacing any existing security stack.

The best features ThreatLocker Zero Trust Platform offers are Application Control, which we are mostly using, and Elevation Control. Application Control gives us better control over what can run on the endpoints, and Elevation Control lets us provide admin access only when it is needed, instead of giving users permanent local admin rights.

Elevation Control is the feature I find myself relying on the most day-to-day because we get regular requests from users who need admin permission to install or update their software or applications. It lets me approve what they need without giving them permanent local admin rights.

Visibility is really useful. I can see what applications are being blocked or requesting elevation and review why they need access. It makes troubleshooting and managing application requests much easier.

ThreatLocker Zero Trust Platform's AI capabilities in governance and security are good because it still keeps control with the administrator. For governance, I appreciate having policies and approvals in place rather than relying completely on automated decisions. That gives us more confidence when using AI-based features.

From what I have seen, the AI output has been pretty accurate and reliable. I still prefer to review the recommendations before making changes, especially when it involves application blocking or security policies. Overall, it has been helpful and consistent.

The allowlisting feature of ThreatLocker Zero Trust Platform is very effective. It gives us good control over which applications and scripts can run on our endpoints while blocking anything that has not been approved. It adds a strong extra layer of protection without relying only on traditional antivirus.

I definitely use Ring Fencing with ThreatLocker Zero Trust Platform and it adds another good layer of control. Even when an application is approved, we can restrict what it is allowed to interact with or access. I appreciate it because approved software does not automatically get unlimited access.

I find the DAC dashboard pretty easy to use. It gives us a clear view of security or configuration items that need attention. We can identify what needs to be fixed without spending too much time digging through different settings. It also provides recommendations, which is helpful.

Storage Control is really useful because it gives us more control over how users and applications access storage devices such as USB drives or hard drives. We can apply policies based on our security needs, which helps reduce the risk of unauthorized data being copied or accessed.

I think the policy management could be a little simpler. When you have a lot of applications and policies, troubleshooting why something was blocked can sometimes take extra time. Making that process more straightforward would improve the overall experience.

I think the dashboard and reporting could be a little more user-friendly because sometimes finding the exact event or policy behind the block takes a few extra steps. Better filtering and simpler views would make troubleshooting quicker.

We have been using ThreatLocker Zero Trust Platform for the past three to four years.

ThreatLocker Zero Trust Platform is very stable. I did not have any kind of issues so far.

The scalability of ThreatLocker Zero Trust Platform has been very good for us. It is easy to apply policies across multiple endpoints and manage everything centrally. As we add more devices, we do not have to manage each one individually, which is really good.

Customer support is very helpful and quick. Whenever we need any kind of support and reach out to the team, we get a prompt reply from the support team. I am personally very happy with the support.

I think we have seen a good return on investment, mainly from better security and easier privilege management. We spend less time dealing with local admin access and unauthorized software. It also helps us handle elevation requests in a more controlled way now.

Overall, the pricing and licensing for ThreatLocker Zero Trust Platform have been reasonable for the security and control we get from the platform. The initial setup took some planning, especially around the policies and approved applications, but once everything was configured, the day-to-day management became pretty straightforward.

We are not evaluating any other options because we find this solution very helpful and that is why we chose ThreatLocker Zero Trust Platform instead of evaluating any other platforms or options.

I would rate ThreatLocker Zero Trust Platform a 10 out of 10 because I personally really appreciate this application.

I gave it a 10 because it gives me strong control over what can run on the endpoints and how admin privileges are handled. The biggest thing for me is being able to give users the access they need without giving them permanent local admin rights. It adds security without making day-to-day IT support difficult.

We use ThreatLocker Zero Trust Platform as a cloud-based solution. The management and policies are handled through ThreatLocker Zero Trust Platform portal while the agent runs on our endpoints and enforces the policies.

We use ThreatLocker hosted cloud service, so we do not manage the underlying cloud provider ourselves. ThreatLocker Zero Trust Platform handles that infrastructure on their side.

My advice would be to spend enough time planning and testing your policies before rolling them out broadly. Start with a smaller group, understand what applications users actually need, and then expand from there. That helps avoid unnecessary blocks and make the rollout much smoother.

As the administrator for ThreatLocker Zero Trust Endpoint Protection Platform, I manage it, deploy it for new clients, and if someone installs an application that ThreatLocker stops, I have to allow that. So we can say I am the admin of ThreatLocker in my day-to-day life.

Once, one of our big clients in the US installed a new application, but it was stopped by ThreatLocker. They emailed me that their application was not working, and then I reviewed it. I took approval from their senior managers before allowing that application in their environment, and afterward, I approved it.

I just do daily tasks where I create policies for the applications they use. There are some generic applications which they use, so I create policies for them to ensure new users will not encounter issues. Sometimes, I have to approve applications, but I need to get approval from their manager or some senior engineer before real-time approval.

Ring-Fencing technology helps me day-to-day by monitoring application behavior. If it thinks the application is malicious or has code that shouldn't run in the environment, it stops that. For example, if an SQL application throws some codes, and if the application stops working, we need to check why it stopped, and then we can approve it if it's justified.

The best features of ThreatLocker Zero Trust Endpoint Protection Platform include a deny-by-default approach, ensuring only approved applications and processes can run, which significantly reduces attack surfaces. It provides granular application control that prevents ransomware, unauthorized scripts, and unknown executables from executing. It stops ransomware before executing, which greatly improves endpoint security, along with its unique Ring-Fencing technology that restricts application behavior and prevents trusted applications from being exploited maliciously. Additionally, it provides precise control over USB devices, external storage, and network shares to help prevent data exfiltration.

The easy policy management with a centralized dashboard makes it effortless for IT teams and engineers to manage policies, approval workflows, and endpoint visibility. The real-time approval system allows administrators to approve or deny applications instantly without disrupting endpoint user productivity. Strong visibility of audit logs offers detailed logs and reporting that help with compliance, forensic analysis, and security investigations. The lightweight endpoint performance impact means it operates effectively without noticeable system downtime compared to traditional antivirus solutions, making it a highly scalable platform ideal for MSPs and organizations managing multiple clients or distributed environments.

Overall, ThreatLocker Zero Trust Endpoint Protection Platform has significantly strengthened our endpoint security by enforcing zero trust principles while maintaining operational flexibility and user productivity.

ThreatLocker Zero Trust Endpoint Protection Platform has positively impacted my organization by preventing unknown applications from running in my environment. Many clients cannot run applications without our permissions, and I also have great control over the endpoints, enhancing both productivity and security.

After implementing ThreatLocker Zero Trust Endpoint Protection Platform, we have seen a productive impact, including significantly reduced security incidents. The deny-by-default approach drastically minimizes malware and unauthorized application incidents, which reduces emergency remediation efforts and results in less endpoint downtime. Systems experience fewer disruptions caused by ransomware, malicious scripts, or unwanted software installations, leading to improved uptime for the end user.

Faster troubleshooting and detailed logging allow us to quickly identify blocked processes or unauthorized behavior, significantly reducing troubleshooting time. The real-time approval feature enables our IT team to instantly approve legitimate applications, avoiding long user wait times while maintaining security. Our IT team spends less time handling infections or cleanup tasks and more time on proactive infrastructure improvements. Once policies are properly tuned, users can work without interruption while security remains tight, enforced in the background.

Overall, ThreatLocker Zero Trust Endpoint Protection Platform has shifted our environment from reactive incident handling to proactive security management, leading to a measurable reduction in downtime and support overload.

ThreatLocker Zero Trust Endpoint Protection Platform is already an optimized platform. I have a great experience with this, so I don't think anything needs to be improved.

There might be a small thing, but I would need to assess that further.

I took off one point because sometimes it can be a bit complicated for new engineers, such as my teammates, especially for those who don't have hands-on experience. They occasionally find it difficult to check application approvals. Overall, for me, it's good.

I have been using ThreatLocker Zero Trust Endpoint Protection Platform for about three years and I am continuously using it.

In my experience, ThreatLocker Zero Trust Endpoint Protection Platform is stable because we have not encountered any major crashes or reliability issues. The agent runs consistently in the background without causing system instability or performance degradation. Any operational challenges we experienced were mostly related to initial policy tuning or application allowing, which is expected when implementing a zero-trust model. Once policies were properly configured, the environment became very stable. Overall, I have not observed any unexpected agent crashes, minimal impact on endpoint performance, and consistent policy enforcement across devices. ThreatLocker Zero Trust Endpoint Protection Platform has proven to be a dependable and stable security solution for both daily operations and long-term endpoint protection.

Regarding scalability, we have added new endpoints easily, as the policies were already made, and we just copied them to the new organization. So it's not a big deal.

The customer support of ThreatLocker Zero Trust Endpoint Protection Platform is really quick, and they respond very promptly. I've had a good experience with them.

Positive

We have eliminated CrowdStrike because we were using it for security purposes before we started using ThreatLocker Zero Trust Endpoint Protection Platform, which has proven to work for us.

We used CrowdStrike before ThreatLocker Zero Trust Endpoint Protection Platform and switched because CrowdStrike was complicated. There was also a significant security concern last year that led us to make the switch.

My advice for organizations looking into using ThreatLocker Zero Trust Endpoint Protection Platform would be to plan the initial deployment and policy configuration carefully, especially during the early learning phase of adopting a zero-trust model. Since ThreatLocker Zero Trust Endpoint Protection Platform works on a deny-by-default approach, which is extremely powerful for security, organizations should start with learning mode and a staged deployment to understand application behavior.

It's essential to ensure the IT team receives proper training, as policy management and application approvals may feel complex for engineers new to zero trust. Define approval workflows in advance to avoid user disruption by gradually enforcing policies instead of applying strict controls immediately. Once properly configured, ThreatLocker Zero Trust Endpoint Protection Platform becomes a highly effective and low-maintenance security solution that significantly strengthens endpoint protection while maintaining productivity.

I haven't observed specific metrics regarding return on investment, but I am aware of the general impacts.

I haven't noticed any specific benefits in terms of saving time, reducing the need for extra staff, or seeing fewer security incidents since using ThreatLocker Zero Trust Endpoint Protection Platform, so I can't provide numbers.

Before choosing ThreatLocker Zero Trust Endpoint Protection Platform, we did not evaluate any other options.

The allowlisting feature in ThreatLocker Zero Trust Endpoint Protection Platform effectively manages which software, scripts, and libraries run on our devices, as it provides excellent control while enforcing security measures.

I find the allowlisting feature easy to use, and it gives me enough control over which software, scripts, and libraries can run.

I can say it is easy to identify which security and configuration settings need fixing using the DAC dashboard; I would rate it a 10 out of 10 for me.

The efficiency of the real-time threat intelligence and category controls employed by web control is a big plus, as it helps ensure that we are dynamically protected even as new threats emerge.

I would rate this review nine out of ten overall.

My main use cases for ThreatLocker Zero Trust Endpoint Protection Platform are endpoint and server security. We have a lot of niche applications, many of which come from GitHub. ThreatLocker's ringfencing capabilities make us feel confident that if any of those niche, obscure applications were to be compromised, our endpoints would stay secure.

The features of ThreatLocker Zero Trust Endpoint Protection Platform that I have found most valuable include Application Control. We really appreciate the new DAST component of their Health Center and those vulnerability scans with results coming out.

The benefits of those features for my company are significant. My company has a lot of scientists using very specific applications that are not well-known, and VirusTotal has probably never inspected them before. ThreatLocker's VDI environment, coupled with the ringfencing capabilities of policies, gives us confidence.

My impression of ThreatLocker Zero Trust Endpoint Protection Platform's Allowlisting feature in terms of managing which software, scripts, and libraries run on my device is that it works great. We have lots of scripts that run on servers, and we use hash-based rules on them. If a user changes their script and does not let me know, their script will not run, which ensures I can review it. We have scientists who want random, obscure software to be installed, but it will not be installed even if the help desk agrees to assist with the installation until I approve it. This is a great all-around product.

I assess its impact on controlling the behavior of approved applications as very positive. It works really well, and I have nothing to add to that.

If I had one feature I would like added to ThreatLocker Zero Trust Endpoint Protection Platform, it would be the ability to clone a policy to a new machine. Right now, I have to manually clone it. If it is just a basic policy, its not a big deal. However, if there is one that is very specific with ringfencing rules and user-based rules, I do not have a way to just copy that to a new machine. I would either have to manually add all those same rules. That would be the one feature I think is needed.

I have been using ThreatLocker Zero Trust Endpoint Protection Platform for one year.

My evaluation of the stability and reliability of ThreatLocker Zero Trust Endpoint Protection Platform is that the portal sometimes seems to crash. I can get logged in, but I cannot load anything and it will kick me out in about five minutes. There is no apparent pattern to it, and there is not a particular time when this happens. However, occasionally there are days where the portal has issues.

I would assess how well ThreatLocker Zero Trust Endpoint Protection Platform scales with the growing needs of my company positively. We recently went through a replacement project of approximately 600 computers, and it went very smoothly. I did not hear any complaints about it.

I would evaluate the customer service and technical support as great, with no complaints. They are all very responsive.

I have not dropped any products since obtaining Threatlocker. Threatlocker is the most recent addition. I do not wish to disclose the other products I am using.

I would guess that ThreatLocker Zero Trust Endpoint Protection Platform has helped my company save on operational costs or expenses, but I would not be able to give specific numbers.

There was no other consideration in the evaluation process for another solution.

By using ThreatLocker Zero Trust Endpoint Protection Platform, my company has an option now to eliminate or consolidate any security tools or solutions. We could get rid of a couple of things, but we have not gone down that path.

The reason we have not gone down that path is because we are in contracts with quite a few things right now.

Regarding the Network Control feature, we are still in audit mode. We have it purchased but have not enabled it.

For Elevation Control, we use that for a few things. Our developers do web app development, and if they need to debug, it opens in IIS, which is an admin-level feature. Elevation Control lets us automatically elevate Visual Studio, which is really useful there. We were able to get rid of admin accounts for that by using Elevation Control.

Concerning the Storage Control feature, we are still starting to use it.

I am using the DAST dashboard and we are reviewing it. We have enabled some policies based off of its recommendations.

Identifying which security and configuration settings need fixing using the DAST dashboard is pretty good at outlining what needs to happen. There have been some quirks. I understand it is still in its infancy. There are some quirks with its actual reporting. There was a period where it was saying we were 100% secured, and then a week later it showed we had a bunch of vulnerabilities. We are not fully relying on it, but as far as presenting vulnerabilities it has found and where to go to change things, it is pretty easy to understand.

I would rate this review overall as a 10.

I currently work in the Enterprise GitLab platform for Scania where we have a lot of users using our GitLab platform for code pull and push, and our main use case for ThreatLocker Zero Trust Platform was improving endpoint security and enforcing least privilege across cloud and engineering environments. I have used different tools earlier, but in this particular GitLab team, it's deployed on AWS and Kubernetes platform, AWS EKS, and it's an auto-scalable system. So we wanted stronger control over which applications and scripts or tools could run in production-related systems. ThreatLocker Zero Trust Platform helped us reduce operational risk by standardizing application control or limiting unnecessary privileged access. Since we are in cloud environments, it's a pretty common practice that people have more access than they need, and we wanted to bring that down to least privileges. That is why we searched for options and found this.

A recent specific example of how ThreatLocker Zero Trust Platform helped us enforce least privilege or improve endpoint security in our environment is that we have a bunch of DevOps engineers working on the AWS setup, and some engineers occasionally needed elevated permissions for troubleshooting or deployments into production. For deployments, we generally use only pipelines, but for troubleshooting and fixing some things, we may need those elevated accesses. Before ThreatLocker Zero Trust Platform, there was more dependency on persistent admin access, with administrator role on AWS, providing access and then if you don't remove it, it stays there. That is called prolonged access. We don't want to have that. With ThreatLocker Zero Trust Platform, we were able to enforce more controlled and temporary privilege elevations while restricting unauthorized scripts and applications from running. That improved endpoint security and reduced our operational risks overall.

ThreatLocker Zero Trust Platform fits into almost everything where we want least privileges, but I think this is one primary scenario for which we chose this particular tool.

The best features ThreatLocker Zero Trust Platform offers include the ability to provide elevated access for a short term, which I think is called short-term lived accesses. The best feature I would say is that for us, you can allow whitelisting of certain applications or temporary privilege elevations through a central management system.

This short-term privilege elevation and allow-listing have made a difference for our team because initially, when we did not have this software, we were using AWS access roles for people to log into those environments. Each time they had to request that role, and the person responsible had to ensure that when that task was done, they revoked that access as well. This process always needed two people for a single task, creating a dependency and risking delays if someone wasn't available. It involved a lot of time and effort and repeated actions, as well as human errors since we sometimes may miss revoking the accesses. Those credentials could stay, and people could leave the organization and still have access to IAM users, which we didn't want them to have. ThreatLocker Zero Trust Platform helped us improve drastically in terms of how we operate, and it really improved our operations.

Overall, ThreatLocker Zero Trust Platform has increased the security posture and operational accountability in our team. Apart from short-term privilege elevation, it also gives us a centralized platform to manage all accesses, which I think is another important aspect to mention.

ThreatLocker Zero Trust Platform has positively impacted our organization by making our processes so fast, our operations super efficient, and more reliable now. We don't have a constant lingering threat of leaked credentials. The main positive impact is improving security consistency and reducing operational risks. It helped us move away from broad persistent access and gave us more controlled privilege management, which enterprises like my company need. We also see improvements in visibility and policy enforcement, especially for distributed systems working on AWS and Kubernetes environments. From an operational perspective, it has reduced manual security overhead while still allowing teams to work efficiently and respond quickly during troubleshooting.

In our support process, when our team receives an incident, the developer has to ask for access, and then it's provided, and that process takes a lot of time, which can lead to a couple of hours that can go away and reduce your SLA. So we have definitely seen a reduction in our time handling incidents and also in efforts across managing those accesses. When we have to give persistent admin permissions or manual approvals, that creates delays and increases security exposure. In all those aspects, I would say it has improved our processes.

My experience with ThreatLocker Zero Trust Platform has been fairly good with not a lot of complaints. If I have to say what they can improve, one area would be making policy tuning and onboarding simpler for large enterprise environments. This is something that we faced with multiple tools in the industry, which offer different facilities, but this is a common problem for large enterprises because we have a lot of people and processes but lack that granular level of fine-tuning. Perhaps they can work on that, especially in today's world of cloud, DevOps, and AI, which can help a lot to larger organizations.

Their documentation and support were good, but we could benefit from out-of-the-box templates so that we don't have to build everything from scratch. A base setup that we can modify on top of it would be great.

I have been using ThreatLocker Zero Trust Platform for the last two years.

ThreatLocker Zero Trust Platform is deployed in our organization on a public cloud, AWS.

We use AWS, Amazon Web Services.

We did not purchase ThreatLocker Zero Trust Platform through the AWS Marketplace because we had a separate connection with them offline since we already have an enterprise license from AWS, and we don't get discounts there. Our discounts are already catered in that tie-up we have with AWS, so we took it offline.

I would rate this product a 9 out of 10.

My main use cases for ThreatLocker Zero Trust Endpoint Protection Platform are Application Control and Endpoint Protection.

The feature I like the most about ThreatLocker Zero Trust Endpoint Protection Platform is Application Control. It keeps things secure by ensuring only trusted programs run, and it does not matter that the user has local admin because they cannot run untrusted software.

ThreatLocker Zero Trust Endpoint Protection Platform benefits my company by preventing serious incidents. A few months ago, someone called one of our users and pretended to be helpdesk. They remoted into their computer and tried to run Node.js. The hackers could not get it to run. They tried several times and even sent me a ThreatLocker request for it, which is how I found out about the attempted compromise. I was wondering why this person was running a script. I called them up and discovered what was going on. I told them to hang up immediately. The attackers were not able to run anything. They tried PowerShell and command prompt, but nothing worked.

ThreatLocker Zero Trust Endpoint Protection Platform should focus more on the application allow listing feature, which shows whether a program has been recognized but not necessarily whether it has been trusted. It would be helpful to have categorization to let me know which programs are not trustworthy. For example, GoToMeeting is a known screen sharing program that shows as high risk, but that does not necessarily mean it is not trustworthy. A little more clarification on that would be beneficial.

I have been using ThreatLocker Zero Trust Endpoint Protection Platform for two years.

There were some concerns about the stability and reliability of ThreatLocker Zero Trust Endpoint Protection Platform regarding memory usage, but we found that the concerns were out of proportion. I think we probably need more communication on our IT front because whenever something glitches, people would assume it is ThreatLocker. We would investigate and see that ThreatLocker is not blocking anything and the issue is something else. A little more transparency would be beneficial.

ThreatLocker Zero Trust Endpoint Protection Platform scales well with the growing needs of my company. At first, we deployed it to normal laptops. Then we expanded to developer laptops and our technicians because they need more programs. This year, we are going to expand to servers that are mission critical in our company. We want to make sure nothing gets blocked, so we are taking our time with those. We do a lot of turnover with laptops because we buy and sell assets, and it has scaled very well with that. I have not had any issues integrating new laptops or decommissioning old ones.

I evaluate the customer service and technical support of ThreatLocker Zero Trust Endpoint Protection Platform as very good. They are very responsive. I am able to get in touch with a chat person usually within a minute.

Positive

Before adopting ThreatLocker Zero Trust Endpoint Protection Platform, we did not have a platform like this.

ThreatLocker Zero Trust Endpoint Protection Platform has definitely saved us on operational costs and expenses by preventing incidents. The one I mentioned before involved an attempted ransomware infection. It has saved us on two other occasions besides that. Talking to our CIO, he said that ThreatLocker more than paid for itself during those incidents.

The other solutions that came under consideration in our process include ConnectWise for scripting and patching. We also have SentinelOne for detection. For endpoint elevation and control, we were looking for a solution and ThreatLocker was really the only one that met our needs.

I have used the Ringfencing feature.

The Ringfencing feature of ThreatLocker Zero Trust Endpoint Protection Platform impacts controlling the behavior of approved applications positively. Ringfencing keeps programs that are potentially running as admin, and they might need to run as admin, but it does not give that admin access to other programs. We are able to limit them from talking to the internet. It gives us a lot of peace of mind.

We do not use the Network Control feature.

I do use the Elevation Control feature.

The Elevation Control feature of ThreatLocker Zero Trust Endpoint Protection Platform facilitates just-in-time administrative access for approved applications effectively. We used to have every user as a local admin on their machine because some programs had to run as admin. This feature lets us run just that program without having to elevate the whole machine. So it is much safer.

We do not use the Storage Control feature.

I have used the DAC Dashboard.

Identifying which security and configuration settings need fixing using the DAC Dashboard is very easy. It shows you right there on the home screen without having to do an extra scan. There is nothing you have to configure for it to work. It shows you the top vulnerabilities right there.

We do not use the Web Control feature.

I give ThreatLocker Zero Trust Endpoint Protection Platform an overall rating of 10 out of 10. It works perfectly for what we use it for.

My main use case for ThreatLocker Zero Trust Platform is to block the execution of unauthorized applications. A specific example of an application I block is Google Chrome files and extensions.

In addition to my main use case, I use ThreatLocker Zero Trust Platform to check whether applications are up to date or outdated.

The impact of ThreatLocker Zero Trust Platform on my organization has been positive, as it significantly improved the handling of security prompts when installing or running programs downloaded directly from the web browser.

This reduction in security prompts has led to measurable changes, including reduced impact and time required to investigate incidents.

By using ThreatLocker Zero Trust Platform, my organization has not been able to eliminate or consolidate any security tools or solutions.

The best features that ThreatLocker Zero Trust Platform offers include web monitoring and the ability to block applications that are not authorized to run.

When it comes to blocking unauthorized applications, managing and updating those application lists in ThreatLocker Zero Trust Platform is straightforward. If it is an application that is not used in the organization, I reject the request, and if it is authorized, I run it in a VM and authorize it.

The features related to allow listing or ring-fencing capabilities in ThreatLocker Zero Trust Platform are separated into desktop and notebook categories.

Regarding ThreatLocker Zero Trust Platform's AI capabilities, I believe its governance and security are great. The accuracy and reliability of output from ThreatLocker Zero Trust Platform is good.

My impression of ThreatLocker Zero Trust Platform's allow listing feature in terms of managing which software, scripts, and libraries run on my devices is that the list is good. I have not used the ring-fencing feature with ThreatLocker Zero Trust Platform, so I cannot assess its impact on controlling the behavior of approved applications.

It is easy to identify which security and configuration settings need fixing using the DAC dashboard. I am not using ThreatLocker Zero Trust Platform ring fencing to control the behavior of my AI agents.

The Zero Trust Endpoint Firewall network control feature does not impact my ability to manage network traffic across my endpoints and servers, as I do not use it for this purpose.

I do not use the privileged access management or elevation control feature in ThreatLocker Zero Trust Platform for just-in-time administrative access for approved applications.

I do not use the data storage access control or storage control feature to enforce policy-driven access over various storage devices.

I assess the efficiency of the real-time threat intelligence and category controls used by web content control in blocking malicious and non-compliant sites as not applicable since I do not use it for this purpose.

ThreatLocker Zero Trust Platform works great for my needs and does exactly what I need it to do, with no improvements needed. There is nothing, even small, that I believe could be improved or added in the future to make my workflow smoother or help with reporting. There are no improvements needed for ThreatLocker Zero Trust Platform that I have not mentioned yet.

I have been using ThreatLocker Zero Trust Platform for approximately one year.

ThreatLocker Zero Trust Platform is stable.

The scalability of ThreatLocker Zero Trust Platform is great.

The customer support for ThreatLocker Zero Trust Platform is great. I would rate the customer support for ThreatLocker Zero Trust Platform a ten on a scale of one to ten.

I did not previously use a different solution.

ThreatLocker Zero Trust Platform has not helped my organization save on operational costs or expenses, as the cost did not change. I have seen a return on investment as I have saved time.

I did not purchase ThreatLocker Zero Trust Platform through the AWS Marketplace. My experience with pricing, setup cost, and licensing for ThreatLocker Zero Trust Platform has been great.

Before choosing ThreatLocker Zero Trust Platform, I did not evaluate other options.

I would rate ThreatLocker Zero Trust Platform overall as a ten on a scale of one to ten because it met my needs. My advice for others looking into using ThreatLocker Zero Trust Platform is that the investment is worth it. I gave ThreatLocker Zero Trust Platform an overall review rating of ten.