What is our primary use case?
As a sheriff's department, our main use cases for ThreatLocker Zero Trust Endpoint Protection Platform involve managing many different endpoints that are our deputies on the road who constantly receive evidence, encompassing various file types, including video files in executable form from banks and ATMs, necessitating careful monitoring of executions.
Additionally, we have a finance department that faces constant phishing attacks, and the platform helps us gain better control over what is executed in our environment. When something is executed, we can pause to assess its necessity.
How has it helped my organization?
By using ThreatLocker Zero Trust Endpoint Protection Platform, we have been able to consolidate several security tools, including considering removing SentinelOne to streamline everything under ThreatLocker and ThreatLocker Detect to minimize device overhead. Previously, we encountered conflicts between tools, but transitioning entirely to ThreatLocker has been satisfying as it effectively prevents threats.
What is most valuable?
For us, the features we appreciate most about ThreatLocker Zero Trust Endpoint Protection Platform are the learning mode, maintenance modes, and installation modes which we utilize heavily. We do not allow new applications to be executed in our environment, so we maintain an approved list of applications. The learning mode enables us to learn these applications initially, thus preventing the launch of anything else. If an unapproved application attempts to launch, it prompts a conversation about its necessity, often revealing that we might already have a similar tool we can use. The maintenance mode is indispensable for us.
My impression of the allow-listing feature of ThreatLocker Zero Trust Endpoint Protection Platform is positive; it is convenient that for widely used applications such as Adobe, we do not have to learn each individual application as we can simply allow the entire suite, ensuring all updates and applications are included. This feature helps us establish a static baseline of safe items to ensure familiarity within our finance department and other teams.
I have used the ringfencing feature of ThreatLocker Zero Trust Endpoint Protection Platform.
I assess the impact of ThreatLocker Zero Trust Endpoint Protection Platform on controlling the behavior of approved applications as beneficial; for example, with our CAD program, there is no need for outside applications to interface with it. This ringfencing capability allows us to monitor any unauthorized interaction attempts with our applications, providing intensive oversight of their behavior.
Regarding the network control feature of ThreatLocker Zero Trust Endpoint Protection Platform, I do not use it extensively; we mainly rely on our network firewall since all our clients are connected through a VPN. However, I am actively learning about the features and plan to advocate for increased usage as I recognize we are under-utilizing this aspect.
I do use the elevation control feature of ThreatLocker Zero Trust Endpoint Protection Platform.
My assessment of how ThreatLocker Zero Trust Endpoint Protection Platform facilitates just-in-time administrative access for approved applications is quite favorable; for instance, one of our applications requires admin access for initial launches or periodically to download new map files. This application can be set to launch as an admin automatically, alleviating recurring issues.
ThreatLocker Zero Trust Endpoint Protection Platform helps us save on operational costs and expenses, particularly concerning application management since it enables us to verify applications efficiently. Before, we often had to backtrack and resolve issues created by unverified installations, which has transitioned to a more proactive stance against vulnerabilities.
What needs improvement?
Identifying which security and configuration settings need fixing using the DAC dashboard is somewhat difficult at times. Initially, we encountered challenges when launching applications for the first time due to denials, requiring a detailed investigation. However, I have found that there is a more effective approach available in the panel for this purpose; nonetheless, I still struggle to pinpoint the exact reasons for certain denials and the policies causing them.
To improve ThreatLocker Zero Trust Endpoint Protection Platform, it would be beneficial to integrate a notification feature with the learning mode that clearly indicates items learned during a session. This feedback would help us understand what is learned in real-time, especially during a one-hour learning mode setup, ensuring we remain aware of potentially unnecessary learned items.
For how long have I used the solution?
We have been using ThreatLocker Zero Trust Endpoint Protection Platform for a little over a year now.
What do I think about the stability of the solution?
I assess the stability and reliability of ThreatLocker Zero Trust Endpoint Protection Platform as excellent; in the entire time we have had it, there was only one occasion where it crashed, necessitating a reinstall. Given the scale of our operations managing a thousand installations, this performance is impressive.
What do I think about the scalability of the solution?
ThreatLocker Zero Trust Endpoint Protection Platform scales well with our company's growing needs; as we continuously hire new deputies and add servers, the installation process is smooth and easy when the right server or workstation applications are designated for installation.
How are customer service and support?
My experience with the customer service and technical support for ThreatLocker Zero Trust Endpoint Protection Platform is positive; they are responsive and readily available. We manage through our MSP, which facilitates direct communication during troubleshooting, making it easy to connect when issues arise. I would rate the support at a ten as I have never faced any problems.
How would you rate customer service and support?
Which solution did I use previously and why did I switch?
Prior to using ThreatLocker Zero Trust Endpoint Protection Platform, we were utilizing SentinelOne.
How was the initial setup?
My experience with pricing, setup cost, and licensing for ThreatLocker Zero Trust Endpoint Protection Platform is that the setup process is straightforward. While I do not know the specifics of our financial arrangement because our finance department manages that, we focus on securing multiple vendor quotes as part of our internal procedures. The initial learning phase took about a month or two, establishing a baseline across our machines, and after that, it became an effortless operation.
What about the implementation team?
We manage through our MSP, which facilitates direct communication during troubleshooting, making it easy to connect when issues arise.
What's my experience with pricing, setup cost, and licensing?
Quantifying the exact savings ThreatLocker Zero Trust Endpoint Protection Platform provides is challenging, but I estimate it saves us at least a couple of hours a week through streamlined auditing processes rather than the manual effort previously required.
Which other solutions did I evaluate?
There are no other solutions I am aware of that address similar needs outside of ThreatLocker Zero Trust Endpoint Protection Platform. I believe we considered a couple of other solutions during our decision-making process, but I cannot recall their names now.
What other advice do I have?
Overall, I would give ThreatLocker Zero Trust Endpoint Protection Platform a rating of ten out of ten. It is an ideal solution for any company lacking comparable protection, offering complete visibility into the environment, making it a recommended choice for every organization with computer systems in place. I have not used the storage control feature of ThreatLocker Zero Trust Endpoint Protection Platform until recently; I finally got it turned on today. We plan to implement it, especially since we frequently receive various USBs as evidence in law enforcement, allowing us to issue specific USBs that individuals can use safely without risking unknown data from random devices.
Disclosure: My company does not have a business relationship with this vendor other than being a customer.