What is our primary use case?
My main use case for ThreatLocker Zero Trust Platform involves using two modules: the Application Control module and Elevation Mode, which I use for application controlling and privileged access on the system.
A recent example of how I use those modules in my day-to-day operations is when our security team wanted to block the OpenTlo application and the shim app on Windows and Mac OS devices to prevent them from running and having no processes active on the systems. I have been using application control for blocking that particular part, and in terms of Elevation Mode, I have been using it for performing admin rights on the system, with policies created that auto-elevate specific software updates or allow users to do self-elevation.
These are the main purposes of using ThreatLocker Zero Trust Platform right now.
I have not used ThreatLocker ring fencing specifically to control the behavior of AI agents, but I have used it for the OpenTlo agent, which connects to various gateways and APIs in that context.
How has it helped my organization?
ThreatLocker Zero Trust Platform has positively impacted my organization, making us in a much better state now.
By using ThreatLocker Zero Trust Endpoint Protection Platform, I have consolidated the Admin By Request tool for admin privileges, which I have completely removed after moving to ThreatLocker Elevation Mode. ThreatLocker Zero Trust Platform allows me to manage application controls under one license, saving me from additional expenses on separate tools for admin requests.
What is most valuable?
In my experience, the best features that ThreatLocker Zero Trust Platform offers are its ability to identify applications not just by name but also based on their processes, file paths, hash values, and certificates defined in policies, making it quite dynamic in modifying and defining application rules to block or allow applications or run them in a ringfenced state.
When I mention it's dynamic in nature, I have found that sometimes it is easy to create a definition for an application and modify it, but sometimes it is complex, such as with OpenTlo, which has many components and gateways running, requiring a better understanding of how the application works and the processes involved from terminal initiation to executing tasks. This really depends on the situations.
Regarding ThreatLocker Zero Trust Platform's AI capabilities, I think they are excellent, as they follow all the standards and are quite secure.
When discussing the accuracy and reliability of the AI output, I acknowledge that while AI may sometimes provide incorrect responses, it generally offers good and accurate results around eighty to ninety percent of the time based on the platform's capabilities.
My impression of the solution's allow listing feature is that it is quite good, as it helps in watching what should or should not be allowed on the system, providing an additional layer of guardrails for securing the systems and network.
I have been using ring fencing for specific applications such as PowerShell and CMD, where I ensure that only particular actions are allowed, which adds a nice layer of security to prevent unauthorized executions while permitting the necessary functionality.
I think it is easy to moderately easy to identify which security and configuration settings need fixing using the DAC dashboard.
I have been using the privileged access management and elevation control feature in ThreatLocker Zero Trust Platform, which facilitates just-in-time administrative access for approved applications very effectively, as it allows self-elevation without requiring user interactions.
What needs improvement?
I believe one of the needed improvements is that while they have enabled policy structuring, there might still be some confusion for admins who do not work on it daily to understand how the policy structure is defined and how it impacts systems. Perhaps there could be enhancements to show the policy structure, hierarchy, and actual implementation.
I give it a seven because there are a few areas for improvement with the policy structuring and understanding the hierarchy in the portal or console, and while it functions well for application control, other MDM or UEM solutions may offer similar capabilities without needing separate licenses for just those functionalities.
For how long have I used the solution?
I have been using ThreatLocker Zero Trust Platform for the past one year.
What do I think about the stability of the solution?
ThreatLocker Zero Trust Platform is very stable with many releases related to ThreatLocker agent. However, it does consume a lot of storage and memory on physical devices as it stores all policy data, which can take up to five, ten, fifteen, or twenty GB, and this can lead to high CPU usage at times.
What do I think about the scalability of the solution?
The platform is quite scalable, following a cloud model, allowing for scaling from one hundred to one thousand devices while behaving consistently across the range.
How are customer service and support?
Regarding user experience, as an admin, I have had a good experience with the support team, which has been fantastic with instant replies, and the Cyber Hero support has been quite flexible and around the clock, which is one of the biggest advantages I have noticed in support for any product.
The customer support is the best I have encountered across different products and support vendors, with knowledgeable people on the Cyber Hero support team providing excellent assistance.
I would rate the customer support a solid ten.
Which solution did I use previously and why did I switch?
I previously used Admin By Request for admin or privileged access management, and once I explored ThreatLocker Zero Trust Platform capabilities, I found that the Elevation Mode could offer me the same features, prompting me to switch to ThreatLocker Zero Trust Platform for both application control and elevation.
What was our ROI?
I am not certain about the numbers regarding operational cost savings, but I believe I have saved a lot in operational costs and improved efficiency while maintaining the application control measures.
An example of return on investment would be related to the Elevation Control module, where I save significant amounts of money compared to when I was using Admin By Request, and after removing that tool, I manage everything effectively under the same ThreatLocker Zero Trust Platform license.
What's my experience with pricing, setup cost, and licensing?
I am not aware of the pricing and licensing costs, but I can say that the setup has been quite solid, and the support team has been very helpful during the setup process and consistently monitors my systems.
Which other solutions did I evaluate?
I did not evaluate other options before choosing ThreatLocker Zero Trust Platform, and I am not entirely certain if there were any other options that were considered.
What other advice do I have?
ThreatLocker Zero Trust Platform is a product I would rate around seven based on my experience with the two modules. I am not certain which cloud provider I am using for my private cloud deployment, but it is most probably AWS.
I am not certain about the impact of the Zero Trust Endpoint firewall and network control feature, as I have not utilized that module. Apart from application control and Elevation Mode, I do not have any knowledge of those.
I have no information about the data storage access control and storage control feature in enforcing policy-driven access over various storage devices.
I do not use any other modules apart from the two mentioned, so I cannot assess the efficiency of the real-time threat intelligence and category controls employed by web content control in blocking malicious and non-compliant sites.
The advice I would give to others considering ThreatLocker Zero Trust Platform is that it really depends on your infrastructure, but if you are looking for efficient management options in Elevation Mode or other modules, it is a quite good product to consider.
Which deployment model are you using for this solution?
Private Cloud
If public cloud, private cloud, or hybrid cloud, which cloud provider do you use?
Disclosure: My company does not have a business relationship with this vendor other than being a customer.