ThreatLocker Zero Trust Platform Reviews

We are a managed service provider offering comprehensive network and security monitoring for other service providers. We remotely monitor our clients' systems, many of which utilize ThreatLocker. This application allows us to provide end-to-end technical support, including proactive protection against malicious scripts and applications. ThreatLocker prevents unauthorized installations and execution of potentially harmful programs, such as PowerShell or CMD scripts, by blocking them in real-time. Essentially, it's a comprehensive security application that logs events, captures data, and aids in recovery and analysis, enabling us to understand and respond to security incidents effectively.

We have deployed ThreatLocker in the Azure and AWS clouds for some of our customers, while others utilize it in a hybrid model.

Administrators can easily approve or deny requests using their ThreatLocker allow list. With full access, an administrator can enable learning mode or create exclusions for any user, allowing them to execute specific files or actions within their user space.

The software provides superior visibility into end-user software approval requests compared to other EDR applications I've encountered. Real-time scanning is available when an exclusion occurs, and the software captures comprehensive logs of all activity on the machine.

We use allowlisting once a user access request is submitted. We verify the reason for the request and, once verified, we send an email notification to the requesting user. After approval through the ThreatLocker console, the user can access and execute the requested resources.

ThreatLocker has significantly improved numerous techniques that mitigate vulnerabilities and viruses initiated on the back end of a network. This prevents recurring attacks that utilize script files or various hacking methods by stopping them at the network level.

Previously, users with installation privileges often installed various third-party applications without oversight. ThreatLocker prevents unauthorized application execution, requiring users to submit installation requests. Since most users are reluctant to request third-party applications, this policy significantly reduces the volume of help desk tickets related to software installation and troubleshooting.

ThreatLocker helps consolidate applications and tools.

ThreatLocker's most valuable feature is its scanning capability, which executes all types of executable files. Rather than denying specific applications, it denies all applications originating from the back end, providing comprehensive protection.

ThreatLocker would benefit from incorporating an antivirus feature or comprehensive 24-hour log monitoring, a valuable enhancement for both business and enterprise-level users.

I have been using ThreatLocker Protect for approximately seven to nine months.

I haven't experienced any performance or stability issues with ThreatLocker.

ThreatLocker is highly scalable and useful for real-time protection.

ThreatLocker's technical support process could be streamlined by reducing the number of steps required to reach a human agent. Currently, users must navigate through multiple chatbot interactions before being connected, which can be time-consuming and frustrating.

The initial setup involves deploying the solution through an agent procedure within cloud platforms. Configuration is done according to system administrator instructions, and policies are set accordingly.

A team of five is involved in deploying and configuring ThreatLocker, as well as monitoring its use.

The measurable benefits of using ThreatLocker include ensuring real-time protection of organizational resources and maintaining user authentication and protection levels to reduce risks. It fosters business growth by securing the business module.

I rate ThreatLocker Protect eight out of ten.

There is no maintenance required by the customers.

The endpoint value typically falls within the range of 300 to 450 per MSP, although this can vary depending on the client. Larger enterprise-level clients may have up to 500 endpoints.

I recommend purchasing the exact number of agent subscriptions needed for the environment to avoid unnecessary expenditures.

We provide IT security or cybersecurity services to our customers. ThreatLocker is a key component of our security stack, and we roll it out to every one of our customer's endpoints. It's not an optional component, but a must-have because we are strong proponents of zero trust.

We provide remote monitoring and management services, which can be considered remote IT security for our clients. Our clients have minimal interaction with ThreatLocker Protect directly. It is one of the security tools we install on their systems to secure their networks and end devices. More importantly, it allows us to manage and control the specific applications and services running on their endpoints.

For instance, we can maintain a pre-approved list of applications that are allowed to run in the environment, while preventing unauthorized applications from executing. Even for permitted applications, we implement additional security measures.

ThreatLocker's unique capabilities are particularly evident in its handling of Adobe Acrobat, a common PDF reader. PDFs can be exploited by malicious actors, or hackers, to gain access to systems. Typically, a user clicks on a PDF, it opens, and without their knowledge, malicious code executes on the system, interacting with other components to enable hacker access.

With ThreatLocker, we can restrict Adobe Acrobat to only accessing the official Adobe update servers on the internet, preventing it from accessing any other websites. Additionally, we can restrict Adobe's access to other applications and underlying files on the computer, preventing hackers from utilizing the program to compromise the system.

ThreatLocker is a cloud-based endpoint protection platform that utilizes endpoint agents installed on each device. The deployment of these agents can be automated through Microsoft Intune or RMM, depending on the specific scenario. The ThreatLocker portal is also cloud-based, and once the agent is installed, it communicates directly with the ThreatLocker cloud. One of the key advantages of ThreatLocker is the instantaneous implementation of changes made in the cloud to the endpoints. This ensures that devices are always protected with the latest security policies.

Administration of Allowlisting is incredibly simple, and ThreatLocker provides numerous methods for approving applications and ensuring their legitimacy. One of ThreatLocker's strengths is its dedicated team that continuously monitors applications for changes. For instance, Microsoft's infamous "patch Tuesday" releases require thorough vetting of all patches. If not vetted, ThreatLocker will block them. ThreatLocker's team proactively prevents these issues by adding validated applications to the system. Occasionally, an unpopular application may slip through their team's detection. In such cases, the process for blocking is straightforward. Upon receiving an alert, we can examine the application and its characteristics, including its files. Directly from ThreatLocker, we can verify the application against known repositories that track applications based on their hash or unique Digital DNA to determine if it's a registered application with a known location. Additionally, we can check for any malicious characteristics. Based on this assessment, we can take two actions: either approve the application or utilize ThreatLocker's newly introduced virtual sandbox environment. With a simple click, we can isolate the blocked file in a virtual environment. ThreatLocker creates a separate Windows screen, copies the file over, and executes it within the environment for two purposes. The first is for capturing the file's signatures and any missing elements. The second is for observing the file's behavior in a controlled environment.

Software approval requests for end users are simple. The end user will typically see a small box, which can be customized. We can create a custom appearance or use the ThreatLocker standard box that appears and states that the application has been blocked. There is a box where users can justify the application and explain why they need it. They can then request approval. This is their interaction in terms of requesting approval. On the backend, either the Cyber Heroes or our team will review and approve everything. If the application is approved, the users will receive another small box in the lower right-hand corner of the screen stating that the app has been approved and can now be run. The box will have a button that users can click to run the previously blocked application.

The combination of Allowlisting and Ringfencing is a key advantage of ThreatLocker, particularly in preventing applications from accessing unauthorized internet sources or tampering with sensitive system programs. Allowlisting explicitly permits specific applications to run, while Ringfencing imposes additional restrictions on their behavior. This layered approach ensures that applications can only execute authorized actions and cannot escalate privileges or compromise system integrity. Allowlisting simplifies application control by eliminating the need to define granular permissions for each application. Instead, administrators can simply check a few boxes to whitelist trusted applications. However, for more advanced configurations, ThreatLocker provides granular control over application permissions. Ringfencing acts as a safeguard, akin to guardrails along a mountain road. Just as guardrails prevent vehicles from plunging over the edge, Ringfencing prevents applications from engaging in unauthorized or malicious activities. This additional layer of protection provides peace of mind and enhances overall security.

Establishing trust is crucial, and with Allowlisting, we have a thorough vetting process to ensure applications meet the necessary security criteria. We first evaluate whether the application is truly needed in the environment or what its purpose is. Additionally, we can identify who initiated the request. Furthermore, ThreatLocker's portal provides access to historical data on applications, including file hashes, which act as unique digital DNA. This allows us to verify whether the application is in its original form and check for any known threat advisories. This comprehensive information empowers us to make informed decisions about whether to Allowlist or deny an application based on our findings. Additionally, we can sandbox the application to observe its behavior in a controlled environment and detect any malicious activities. This rigorous vetting process ensures that only trustworthy applications are Allowlisted.

ThreatLocker allows us to maintain consistent environments by providing a central repository that tracks which applications are authorized to run. This simplifies application management and ensures that only approved applications are installed. Additionally, ThreatLocker enables us to control bloatware, which can often contain vulnerabilities. We can prevent bloatware from executing within our environment, further enhancing security. ThreatLocker's zero-trust architecture, including application control, ringfencing, and other features, strengthens our overall security posture. With ThreatLocker, we no longer need to worry excessively about end users clicking on malicious emails, as the embedded code cannot execute due to the restrictions we have implemented. Overall, ThreatLocker's zero-trust architecture is mandatory across all clients in our environment. It is not an optional security measure; it is essential for doing business with us. ThreatLocker empowers us to control our environment and ensure comprehensive security.

ThreatLocker has helped us reduce our helpdesk tickets by preventing rogue applications from running in our environment. This significantly reduces the overhead associated with managing tickets. With ThreatLocker, we have complete control over which applications are allowed to run, so we don't have to worry about users clicking on something they shouldn't. Occasionally, we do receive requests from end users who are trying to run blocked applications, such as games. These requests are denied and do not become tickets. Overall, ThreatLocker has significantly improved the standardization of our environments and reduced the overhead associated with managing user-related tickets. It has given us complete control over which applications can run in our environment, and we rarely have any end-user-related tickets as a result.

Many tickets are created due to an inconsistent or non-standardized user environment. Users encounter differences in software configurations between systems, leading to curiosity and clicking on unfamiliar items. In the current era where 96 percent of security incidents originate from phishing email clicks, we have clear evidence, supported by metrics, of the impact and consequences of such actions within client environments. By standardizing the environment and utilizing a common system like ThreatLocker, which enables whitelisting, blacklisting, or implementing guardrails, the number of tickets and user-generated noise can be significantly reduced.

Our current security stack is very lean and well-integrated. Whenever I attend a trade show or conference with vendor halls, I'm always approached by vendors trying to sell me something. ThreatLocker already does what they're offering, so there's no need for additional purchases. From a cost perspective, ThreatLocker has allowed us to consolidate and save significantly. Additionally, without ThreatLocker, we would likely need six or seven different tools to achieve the same level of security, further reducing costs.

We use ThreatLocker's Allowlisting to whitelist specific applications and prevent unauthorized software from running.

We utilize Ringfencing to establish guardrails around implementations, ensuring that applications operate within defined boundaries.

We leverage network access control to granularly control interactions between computer systems and servers. This enables us to restrict communication between specific applications, even within a locked-down environment.

We employ storage control to impose additional security measures on data storage. This includes controlling access to network shares, network files, and folders, as well as USB storage devices. We can whitelist specific devices based on their serial numbers or allow access based on predefined conditions.

We rely on ThreatLocker's Cyber Hero support, which provides exceptional assistance and responsiveness. At any time, we can initiate a chat session and receive immediate support. If the issue requires escalation, it is promptly handled.

Cyber Hero support also plays a crucial role in vetting application updates. When a user attempts to install or update an application, and the update has not been approved from a security standpoint, it is blocked by ThreatLocker. A notification is presented to the user, informing them of the block and providing an option to justify the application's need. These requests are then reviewed by ThreatLocker's Cyber Hero support team, who evaluate them against our security criteria and make an informed decision to allow or deny the application.

We utilize ThreatLocker's elevated control feature for applications that require administrator-level access. We avoid granting full administrative privileges to end users, as this elevates the risk of compromise if the device is infiltrated. Instead, elevated control allows us to precisely define the execution conditions for specific applications, such as QuickBooks updates. By verifying the application's signature and certificate, we can enable the update to run with administrative privileges while restricting the user's overall administrative access.

Integrating ThreatLocker with other products is simple and only requires a few clicks. ThreatLocker's deployment is also very straightforward. The company provides extensive and well-written online documentation, which is continuously being improved. They also offer a variety of training resources, including university courses, training videos, webinars, and conferences. I have no complaints about the level of support and knowledge transfer provided by the company. ThreatLocker is also developing a new reporting tool, which I had the opportunity to beta test. The company has also been showcasing the new reporting tool at conferences. The new reporting tool provides a level of detail that is unmatched by any other product on the market.

From a reporting perspective, enhancing the ability to customize reports would be beneficial. This could include the option to export reports to a Word document for further tailoring, allowing users to add their own executive summaries and additional content.

I have been using ThreatLocker Protect for five and a half years.

ThreatLocker's development team is capable of releasing beta versions of upcoming releases. Our organization has a policy against deploying beta code due to potential stability and security issues. We don't want to inconvenience our customers or use them as guinea pigs. Overall, ThreatLocker has been a stable platform. However, the threat landscape changes rapidly, and even vetted releases can have minor glitches, such as applications being categorized differently. This can sometimes have adverse effects. However, ThreatLocker's team is very responsive and quickly addresses any issues we bring to their attention.

I haven't identified any inherent limitations or restrictions, or let's say, a ceiling. I'm aware that ThreatLocker is deployed in large corporations around the world. So, they can accommodate organizations of all sizes, from single-person entities to Fortune 500 companies. It's undoubtedly scalable. When I evaluate scalability, I consider not only the number of endpoints and various supported components but also the ability to adapt to the evolving threat landscape. ThreatLocker has certainly been doing that with the introduction of new products and services, as well as the continuous evolution of the platform as a whole.

ThreatLocker is the only company where, regardless of the time of day or whether it's a holiday, I can get immediate support by just jumping into the portal, clicking on the chat, and having someone respond. And it's not just a bot; it's a real Cyber Hero who is ready to assist. They even offer the option to request a Zoom link so that we can have a face-to-face meeting to explain our scenarios and share our screens. If the Cyber Hero is unable to resolve the issue, there are two additional levels of support available online 24/7. We've dealt with many vendors, but we've never experienced this level of support.

Positive

The implementation process was relatively straightforward. ThreatLocker provides us with granular control over almost every aspect of the system, which is one of its key advantages. Upon initial installation, ThreatLocker enters a learning mode where it identifies and catalogs all applications within the environment. We can then determine when to transition ThreatLocker from learning mode to full secure mode, with options ranging from one day to 30 days. In our case, the transition to full secure mode was relatively seamless. We completed the learning phase and had ThreatLocker fully operational within 30 days.

We utilize Microsoft Azure and Intune to manage the majority of our services. In this instance, we employed a PowerShell script provided by ThreatLocker, tailored to our specific environment, and deployed it via Intune. Intune ensures that every device is enrolled. Upon defining and adding the PowerShell script, Intune automatically distributes it to the endpoints, completing the installation process. The deployment process is simple.

We don't require many people for the deployment of ThreatLocker.

ThreatLocker has been instrumental in our ability to standardize and secure our environments, enabling us to replicate them consistently. This standardization has significantly reduced overhead, as we no longer need to rebuild the infrastructure for each new client or prospect. Furthermore, the controlled environment that ThreatLocker has facilitated resembles a well-policed community, where crime rates are low, residents are content, and property values are rising. In contrast, an uncontrolled environment akin to one with inadequate law enforcement would result in chaos. Consequently, ThreatLocker has allowed us to operate efficiently and effectively, minimizing support tickets, eliminating security concerns, and ultimately contributing to our profitability.

Today, the term "zero-trust bubble" is used to describe the growing number of vendors offering zero-trust security solutions. However, I've observed that the IT security industry, as a whole, tends to over-hype new technologies with acronyms and buzzwords without fully understanding their implications. When I examine the current zero-trust landscape and compare it to other security bubbles like endpoint detection and response, secure access service edge, and so on, I find ThreatLocker's pricing to be reasonable for the services it provides.

Previously, we had not implemented any solutions for zero trust because it was a relatively new concept at the time. We were exploring various options to gain more granular control over applications running on separate networks within our environment. Our goal was to standardize and normalize these applications while preventing the execution of unauthorized applications or scripts. However, we were unable to find any solutions that met our specific requirements. When we were introduced to ThreatLocker, we evaluated other available solutions and found that ThreatLocker offered the most comprehensive feature set.

There was nothing else in the market at the time that was doing what ThreatLocker was doing or even attempting to do anything with Zero Trust. The CEO and co-founder visited my office and provided me with an in-depth explanation of the product, its vision, and its future plans. This was sufficient for me because, first and foremost, what matters most to me, especially in the security industry, is having personal connections with my vendors. I don't want to be just another customer. I specifically want to know that I have people I can call on my speed dial when something goes wrong. And that's the kind of relationship I have with ThreatLocker.

I would rate ThreatLocker Protect nine out of ten. There are many security products available today that companies like mine utilize, and some of these products could be replaced with ThreatLocker. However, ThreatLocker is one of those tools that I consider indispensable to our security stack. We have such a strong conviction about this because we understand its capabilities and have seen its effectiveness firsthand. While a significant portion of our work is proactive security, we have also been called upon by companies who have experienced ransomware attacks. In these situations, we have been able to assist them in their recovery efforts. If these companies had ThreatLocker in place, they would not have been vulnerable to these attacks. This reinforces our unwavering belief in the value of ThreatLocker.

We implemented ThreatLocker from the outset within our environments. Therefore, it's difficult for me to compare it to previous solutions as it has become an integral part of our security framework. When I interact with colleagues who don't use ThreatLocker, I hear a lot of complaints, particularly regarding ticketing and the time wasted on text-based communications. I would say that the vast majority of these issues could be avoided if they had ThreatLocker in place.

The company as a whole has experienced and addressed all the concerns that have been raised. Firstly, they are continuously developing and enhancing their product offerings, which include not only the product itself but also the accompanying knowledge base and support structure. Most recently, we have been beta testing their latest portal upgrade, which is remarkably impressive. Ultimately, if I were forced to reduce my security stack to just one or two tools, ThreatLocker would undoubtedly be among them.

Occasionally, a less popular application pushed by a publisher may be flagged by ThreatLocker. In such instances, customers may inquire about the issue. However, once the reasoning behind the flag and the importance of our application vetting process to safeguard their environment are explained, the concerns typically subside.

ThreatLocker's user interface has undergone a significant transformation since its inception. The new beta portal, which we now have access to, is a vast improvement over the original portal. It is both aesthetically pleasing and functional, fulfilling all of its intended purposes. In terms of UI customization, I see little room for improvement. One area where I always seek enhancements is integration with third-party products, particularly PSA platforms. We utilize ConnectWise Manage, now known as ConnectWise PSA, and it seamlessly integrates with ThreatLocker. During a recent client audit, I compared the actual numbers to the PSA's reports, and everything matched up perfectly. When I consider ThreatLocker as a whole, I am impressed with not only the product itself but also the company's culture and commitment to innovation. They continuously invest in thought leadership initiatives, such as webinars, training programs, the ThreatLocker University, and their annual conference. These efforts demonstrate their dedication to providing their customers with the best possible experience. I have no specific wishlist items for ThreatLocker. I am genuinely satisfied with their product and overall approach.

We began realizing immediate value from ThreatLocker, as it provided us with the ability to view blocked applications, scripts, or files within the environment through its unified audit feature. This allowed us to quickly identify and eliminate unwanted software from our environment. Additionally, we could revisit applications that had been vetted or cataloged and decide to block them if they were no longer deemed necessary. Overall, the time to value for ThreatLocker was within the first 30 to 45 days.

ThreatLocker is used by all of our clients and on all of our endpoints. We currently have over 250 endpoints protected by ThreatLocker.

From a maintenance standpoint, ThreatLocker is relatively straightforward. While application signatures inevitably change, the most frustrating aspect is the lack of consistent code signing by software publishers. Despite the current cybersecurity emphasis and efforts to minimize risk, it's baffling that reputable software developers often fail to sign their code. This necessitates an additional vetting process to verify the code's authenticity and ensure it hasn't been tampered with. One of ThreatLocker's strengths is its audit service. Upon request, their system engineers conduct a thorough audit of our client's environment via a Webex or Zoom session. They examine what's being blocked, what's not, our configurations, best practices adherence, and potential changes. This proactive approach ensures we're on the right track and adhering to best practices.

First and foremost, it is crucial to thoroughly understand the clients' environments and develop a tailored strategy for each one before implementing ThreatLocker. A one-size-fits-all approach is ineffective as every client environment has its unique set of applications and requirements. Thorough education is key. When rolling out ThreatLocker, we spend a considerable amount of time educating our customers about its purpose, functionality, and potential impact. We address their concerns and explain the rationale behind the restrictions. This education process should be ongoing for end customers. In the technology industry, there is a tendency to focus on the latest bells and whistles, neglecting the importance of educating end users about the benefits and implications of new technologies. This oversight can hinder the successful implementation of security solutions like ThreatLocker. It is essential to dedicate sufficient time to educating end users to ensure a smooth and effective rollout.
Know the environment. Before implementing ThreatLocker, thoroughly document and understand the client's environment. Initially, run ThreatLocker in learning mode to capture all applications used in the environment. Fine-tune the policy. Before switching to secure mode, collaborate with a Cyber Hero or solutions engineer to identify and address potential application conflicts or redundant applications. Leverage ThreatLocker University. Encourage the team to participate in ThreatLocker University training to gain in-depth product knowledge. Test in the environment first. Before deploying ThreatLocker to clients, thoroughly test it in your own environment to gain familiarity and expertise. ThreatLocker is not suitable for every organization. It is not intended for those who lack a serious commitment to security or are unwilling to invest the time and effort required to properly vet and configure the product for their specific environment. ThreatLocker is most effective for organizations that are willing to take advantage of its comprehensive features and dedicated support to tailor the solution to their unique needs. Remember, the success of ThreatLocker implementation depends on thorough planning, education, and a commitment to security.

I primarily use it for protecting my clients.

I can sleep well at night. At the end of the day, it provides me with peace of mind.

It has helped to eliminate other security solutions. We do not need as many. We do not use many because we can trust the solution. We were using Sophos. That is completely gone. We are using Penetrates as well because it works very well with ThreatLocker.

It has been great at blocking access to unauthorized applications. It is almost perfect. We deal with developers who use a lot of tools. From a security standpoint, it is very important because we know what is going on. It gives us more visibility.

It has not reduced helpdesk tickets. It has probably increased them by blocking applications and doing its job, resulting in people raising more tickets to know why they cannot use certain things.

It has not freed up the IT team’s time for other projects or tasks, but it is doing its job. It is a good one.

The Zero Trust factor is valuable because it blocks everything. That helps us to stay ahead of bad actors. We do not have to be in recovery mode. 

It is light. It does not give that weird heaviness. It just works. 

So far, it has been great. The Cyber Hero support system is excellent. I have no complaints, but a little bit more Mac support would be great.

It is very easy, but having a dashboard so that we can visualize more might be helpful.

I have used the solution for about a year.

It is great. We have had no issues so far.

It seems great, but we are still growing. We will know in a year.

Cyber Hero's support is excellent, allowing me to talk to a live person, which is significant. It has been amazing.

Positive

We had a bad experience with Sophos. We have industrial printers that we use, and they would just lock in. There was no visibility. We did contact Sophos, but they did not have any solution. The manufacturer also did not have a solution. We just could not figure it out. It was hindering the production.

The initial setup was seamless and very easy. We use Datto RMM.

We implemented it ourselves.

We are still small. We are still growing, so we are not at the stage to know about the ROI or any reductions in the operational costs.

So far, it has been great. I have no complaints. Of course, everybody wishes it was cheaper.

It does what it is supposed to do. Just knowing that it works as intended is reassuring. There are a lot of other EDR software, but you do not know if they are doing their job. With ThreatLocker, I can tell that it works.

I would rate it a ten out of ten.

We use ThreatLocker for application allowlisting to enhance security. This is particularly beneficial in school environments, where it prevents students from bypassing security measures by downloading unauthorized applications like VPNs and elevation control, enabling specific local users to gain temporary administrator privileges when running designated applications.

ThreatLocker utilizes a cloud-based system where an agent is deployed on a server or workstation, either on-premise or in a cloud environment like Azure. This agent connects to the ThreatLocker cloud for management and security functionalities.

ThreatLocker simplifies the process for administrators to approve or deny requests. Built-in applications streamline approvals as ThreatLocker manages all associated rules. If a built-in application exists, administrators simply select and allow it. However, if a built-in application is not available, administrators can select from various parameters to create a customized rule. Overall, ThreatLocker provides a relatively easy and efficient approval process.

We use ThreatLocker's ringfencing feature to implement the principle of least privilege. This allows us to control applications like Microsoft Word and Chrome by permitting them to run while restricting potentially malicious actions, such as Word executing PowerShell scripts. This granular control enhances the security of our environment by limiting what applications can do.

ThreatLocker enhances security by verifying the trustworthiness of all access requests, regardless of origin. Its built-in checks ensure applications match their claimed identities, such as confirming that "Word" is indeed Microsoft Word. Additionally, ThreatLocker provides a testing environment to execute executables and scripts in a virtual machine, verifying their legitimacy. Finally, integration with VirusTotal allows for hash analysis, providing further validation. These combined checks offer a robust system for confirming the authenticity of user application requests.

We saw the benefits of ThreatLocker quickly, especially during security incidents. For example, we had a customer where ThreatLocker successfully blocked a threat actor's attempts to install malware and exfiltrate data using legitimate tools. This immediate visibility is crucial, particularly in environments like schools where students might use various unapproved Chrome extensions. ThreatLocker allows for swift action, like blocking ten different VPN extensions, preventing further unauthorized activity.

ThreatLocker has allowed us to consolidate applications by deciding which ones we permit, such as choosing between Firefox or Chrome, while not permitting Opera or Brave. This means we only focus on two browsers for patching and security purposes. It helped us to immediately identify and block unnecessary Chrome extensions in schools, like VPN extensions. We have experienced quick visibility into what students are trying to use and gained more control over our applications.

I find the application control valuable. ThreatLocker provides visibility into user activity and application usage, empowering organizations to define acceptable applications and web browsers. Additionally, elevation control eliminates the need for local administrators by streamlining privilege elevation for specific applications and updates, resolving the challenges customers previously faced with managing local admin rights.

A valuable addition to ThreatLocker would be a column in the audit page displaying a VirusTotal score for each file. This would allow for quick identification of potentially malicious files during allowlisting. Currently, ThreatLocker has a risk scoring system, but integrating VirusTotal results would provide more granular insight. This would enable users to efficiently assess the safety of audited files and prioritize those flagged by multiple antivirus engines for further investigation.

I have been using ThreatLocker for about two years.

The system is generally stable, with one exception during a customer demo where the portal froze and some applications failed to load.

ThreatLocker is scalable. We have customers with ten endpoints to thousands of endpoints. It scales well across different customer sizes and requirements.

ThreatLocker's customer support is exceptionally fast, typically connecting me with a representative within a minute of submitting a ticket and enabling a Zoom call within three to five minutes. While the support team demonstrates knowledge about ThreatLocker, they occasionally provide hasty answers without proper verification, leading to subsequent revisions.

Positive

The initial setup was easy and well-supported by ThreatLocker's documentation and training.

Most new onboardings require approximately 21 days of learning mode before transitioning to secure mode. Therefore, it typically takes about 21 days to a month for an environment to reach secure mode.

I am the one responsible for all the ThreatLocker deployments.

The implementation was completed in-house.

I handle the technical aspects, while my manager deals with pricing. Although the pricing seems good, there have been inconsistencies in contract negotiations. What we are told during calls sometimes differs from what is communicated later causing frustration.

We considered CyberFOX, but it prioritized elevation over allowlisting. ThreatLocker remains the only effective allowlisting tool we've found.

I would rate ThreatLocker nine out of ten.

The agent can be set to update automatically, which is the default setting. ThreatLocker handles the maintenance of the agents. Once in secure mode, the primary maintenance task is approving new application requests from users.

I am one of two internal support staff for our company of approximately 60 employees. We manage roughly 80 devices, including servers and similar equipment, and utilize ThreatLocker Protect for internal support only. We do not resell this product.

Approving or denying software requests is a simple process for administrators. We have a well-defined workflow, and one of the most convenient aspects is how it handles individual user and computer requests. The beauty of ThreatLocker Protect lies in its ability to approve individual requests while also offering broader deployment options. For example, if a work operation requires specific software and John Smith initiates the request, I can not only approve it for him but also wildcard it. This means that if another member of the same team or someone else in the company wants the same software, they don't need to submit a new request; it's automatically approved based on the initial approval for John Smith. This saves everyone time and simplifies the process.

The visibility into software requests from users is perfect.

We leverage ThreatLocker's Ringfencing technology, which has proven highly effective in our security strategy. While it allows us to whitelist specific applications, it critically prevents those applications from exceeding their authorized access. Even if an approved program theoretically could access PowerShell, the command line, Regedit, or other restricted features, Ringfencing intervenes and blocks such attempts. This granular control is crucial for maintaining a strong security posture.

The need for establishing trust for every access request, regardless of its origin, is crucial. Before implementing ThreatLocker, we faced a significant issue. A department member needed a specific program, so he downloaded it from a third-party site instead of the official source. Unfortunately, the site was riddled with malware. Unaware of this danger, he downloaded and installed the program. Three of us spent two days not just cleaning up the mess, but also verifying that the malware hadn't infiltrated our network. This is where ThreatLocker shines. Even if a trusted program like "Program A" is installed from the official source, ThreatLocker can be configured to only allow future requests from the program's parent company with a valid signed certificate. Any request for the same program from an unauthorized third-party source with an unverified certificate gets automatically blocked. This is truly a powerful feature.

ThreatLocker Protect has significantly reduced our help desk tickets. We used to be bombarded with repetitive requests, particularly software update approvals. The ability to use wildcards for both users and versions in ThreatLocker is fantastic. Previously, when new versions of software were released (e.g., Software A version 1.1), we'd receive up to 15 separate requests for approval. Thankfully, ThreatLocker allows us to whitelist both users and versions. Once we approve Software A from the authorized vendor for version 1.0, we can create a wildcard rule that automatically approves future updates (1.1, 1.2, etc.) from the same vendor. This eliminates the need for manual intervention, saving me an incredible 80 percent of my time. ThreatLocker Protect is truly a game-changer!

ThreatLocker Protect helps our staff focus on other projects.

We saw the value of ThreatLocker Protect shortly after deployment, but it's important to understand how the initial stage works. After signing up and installing the program, the machines enter a learning mode. During this period, ThreatLocker observes and analyzes the software on our devices, identifying common applications and their components (DLLs and EXEs). This learning phase typically lasts around 30 days. While we might not see immediate results during learning mode, it's crucial as it lays the foundation for secure operation. Our first audit review, conducted ten days after deployment, revealed a large number of identified applications because the system was still learning. However, our assigned systems engineer provided excellent explanations and handled the back-end processes seamlessly, eliminating the need for manual intervention. This is one of the program's key strengths. While ten days might seem like a short time to realize the value, it's important to remember the learning phase is essential for effective protection. The automatic learning environment and subsequent transition to secure mode ensure a smooth and efficient deployment process.

I'm deeply impressed with ThreatLocker Protect, and I've been in IT for over 40 years, including four years as a school administrator and teacher. The software is incredibly intuitive and easy to use, even for non-technical users. The interface is clean and well-organized, making it simple to navigate and find what we need. The support team is truly exceptional. They are responsive, knowledgeable, and genuinely helpful. Whether it's a quick question or a complex issue, they are always available to assist. My wait time has never exceeded 15 seconds, and resolutions are typically within five minutes. They even offer regular audit reviews to proactively identify and address any potential problems. ThreatLocker University provides comprehensive, self-paced training that is easy to follow and understand. It empowers users to effectively utilize the software and maximize its benefits. Overall, ThreatLocker Protect stands out for its intuitive design, exceptional support, and comprehensive training. It's a fantastic product backed by a remarkable company culture, making it a true pleasure to use.

The snapshots used in the ThreatLocker University portal are outdated snippets and have not been updated in conjunction with the portal itself.

I have been using ThreatLocker Protect for two years.

We have never had stability issues with ThreatLocker Protect.

ThreatLocker Protect is easily scalable.

The technical support is great.

Positive

Deploying ThreatLocker was surprisingly straightforward. Their documentation guides users through the process clearly, offering multiple options for deployment. From traditional MSI installers to EFCs, users have the flexibility to choose the method that best suits their needs.

It took just five minutes to deploy the software on a single machine. However, for the network-wide rollout, we opted for a cautious, phased approach to minimize potential conflicts. Out of our 60 machines, we selected 10-15 users or computers as a test group. After pushing the update to this initial group, we monitored closely for any red flags or issues. As no problems arose, we gradually added more computers to the deployment in 15-user increments until everyone was covered. This approach, while slower, allowed us to identify and address any potential issues before impacting the entire network.

While two of us were involved in the deployment planning, the actual execution was carried out by one individual. Once they started rolling out the machines, I joined in to monitor the results and provide support. It's worth noting that this single person successfully deployed the software to 60 machines.

The implementation was completed in-house.

ThreatLocker's pricing seems justifiable. We get a lot of value for what we pay, with excellent support, the program itself, and everything related to it being top-notch. If my CTO ever suggested dropping it due to budget constraints, I'd be concerned. While I don't have access to the exact cost, even if it was around five thousand dollars annually, I'd suggest reallocating that amount from my salary to keep ThreatLocker Protect. That's how strongly I believe in the program's effectiveness.

I would rate ThreatLocker Protect ten out of ten.

ThreatLocker Protect is not a significant CPU consumer. We've had it for over three years, and while there have been a few minor conflicts with other programs, they were easily resolved. This is to be expected with any software.

I have a biweekly call with an analyst from ThreatLocker, and they treat our organization, which has only 60 computers, the same way they treat businesses with 4,000 computers.

ThreatLocker Protect is incredibly easy to install. I highly recommend engaging their system engineer for assistance. Don't hesitate to reach out with any questions, no matter how simple they may seem. The ThreatLocker support team is known for its patience and willingness to help. They're happy to answer anything you ask, regardless of your initial perception of the question's importance. So, feel free to be open and honest with them; they'll treat you with the utmost respect.

We're an IT service provider that acts as an IT department for companies that don't have one. We take over a company's IT infrastructure, look after, manage, and secure it. ThreatLocker is a part of our security stack. 

We've got multiple products and vendors that we use, and ThreatLocker is a tool we provide to clients who need it. We use it to control access, block specific programs or activities, and manage things like USBs and other devices. For example, if no one's allowed to use the USB device on the computer, we can do that with ThreatLocker.

ThreatLocker has freed up help desk staff for other projects by saving us time. We don't need to do workarounds to get things to work. It's effortless to deploy. We send out the software to the machines as we would any other piece of software, and it automatically sets up everything in the portal. It works most of the time without the need to configure anything manually.

Adopting ThreatLocker has helped us consolidate solutions. For example, we previously used another product for USB blocking, local administrator access, and things like that. Now, we have that functionality built into ThreatLocker. We can deploy different policies to machines to do other things. And I think there's a community where people can make policies for all the tools. Those solutions were separate paid products, so eliminating them reduced our operational costs. 

The most valuable feature is probably the ability to block programs from running. ThreatLocker has some built-in features that make it super easy. You can also contact their support within the program. If you're having issues, you can click on that button and connect with someone in five to 10 seconds. 

It's easy for administrators to manage requests through ThreatLocker. It's set up so we can get notifications in our ticketing system. Every notification ThreatLocker sends contains a link that we can click. We sign in, look at the options, and select the one we need to apply.

The process is straightforward from the end users' perspective. If they try to run something that they're not allowed to run, they get a popup saying that in plain English. There's a little button they can click to cancel it or request access. If they request access, they're asked why they want to run this and then they click send. That's all they need to do. They don't have to call anyone.

ThreatLocker's ring-fencing capabilities are excellent. I haven't seen any other products that do it. It's certainly not built into Windows. It's quite good, but it could be a bit more granular with the options that it gives you. However, the existing options are enough to cover 90 percent of scenarios.

The solution is effective for establishing trust for requests. For every request that comes in, it tells you who sent it and the reason why. It also gives you a breakdown of the application the user wants to run, and it'll tell you things like the company that published it. It also has links that will take you to a virus-scanning website that has scanned the file in the past, so we can see straight away if it's trustworthy or not.

The portal can be a little overwhelming at times from an administration point of view. It displays a lot of information, and it's all useful. However, sometimes there is too much on the screen to sift through, especially if you're trying to diagnose a client's problem with a piece of software. Maybe something has stopped working since they updated it, and we need to see if ThreatLocker is blocking a component of that software. 

We must look through the logs, and there's an awful lot of information to go through. It has many options to filter out that information, and it becomes much easier once you've had some training. Still, there is so much information on the screen. 

I have used ThreatLocker Protect for around two or three years.

Yeah. Never never noticed it. So Yeah.

I can imagine it's very scalable. Yeah. We've got it, like, clients many two people up to, like, fifty. So, yeah, it seems for it's got I think, obviously, you can go much much higher I

I rate ThreatLocker support 10 out of 10. They're quick and helpful. Whenever I've had a problem, they've fixed it for me. They have this Cyber Heroes feature, which is a button built into the solution that connects you to support within seconds. I've only used it a few times, but they have been spot-on every time. 

Positive

The deployment was straightforward, but we had a lot of hand-holding from the ThreatLocker team, and they did regular review meetings with us to ensure we're on track. We would do a Zoom meeting where a guy would go through it and do a lot of the work for us.

It doesn't take long to set ThreatLocker up for a client. It takes around 30 minutes to add the client to the portal, get the software, and deploy it to the machine. After that, we let it run in learning mode. It runs in the background for about a week. That part is automated, so we don't need to do anything. Once that's done, we probably spend an hour or so just looking through what it found and ensuring everything's all settled. After deployment, it doesn't require much maintenance aside from keeping everything up to date. 

I can't complain. Cheaper would always be nice, but I think it's reasonable compared to other software in the cybersecurity market.

I don't think there was anything else on the market that does all the same things as ThreatLocker. If there was, I was unaware of it. 

I rate ThreatLocker eight out of 10. Before implementing ThreatLocker, you should consult one of the company's support engineers. Don't try to do it by yourself because there's a lot of information there. They've got some excellent documentation, but I personally like to be shown how to do it. 

As a Managed Security Service Provider, we have numerous clients. We offer ThreatLocker's application whitelisting as a key component of our security stack, leveraging its capabilities as intended. For client-specific applications, we utilize learning mode to automatically whitelist them. Additionally, we employ global whitelisting for commonly used software such as QuickBooks, Sage, and other applications pre-configured by ThreatLocker. This proactive approach ensures seamless operation of essential enterprise applications.

For administrators, approving or denying requests is a straightforward process. They have three options available. The first is on-site with credentials. When a pop-up notification appears on the computer, an administrator can easily navigate through it, log in with their credentials, and approve the request. The second is a remote administrator. For administrators who work remotely and need to approve requests, an email will be sent to the ticketing queue. This notification allows them to access the tenant and approve the request from anywhere. The third is the mobile app. The top-level administrator and I can use a mobile app to approve requests on the fly, even while traveling. All three options are user-friendly and facilitate a smooth approval process.

The visibility is good. While it doesn't overwhelm users with information, ThreatLocker allows us to tailor the request message when approvals are needed. This means it's not just a generic notification. We can incorporate our branding and write a customized message containing relevant details. For example, in our case, the message would state, "Iowa Solutions is requesting this information." This approach helps avoid appearing malicious or unusual, promotes user comfort due to clear communication, and leverages name recognition to ensure users understand the request and its destination.

We use ringfencing when it's applicable. This can be a bit more challenging, particularly with certain global apps. Nevertheless, we utilize it to ensure that solutions without internet access requirements remain disconnected.

Our initial implementation of whitelisting applications did not seem to reduce the number of support tickets. It may have even generated slightly more. However, this was primarily an issue with the initial setup and the values have since returned to normal levels. The included Elevation module, however, has demonstrably reduced tickets, particularly once properly configured. While we are still experimenting with its optimal configuration, we are confident that it represents an internal process improvement rather than a product issue. The ThreatLocker solutions engineer we work with has guided us through this process. The product's ability to elevate already-approved applications directly addresses a significant source of tickets. We have streamlined operations and reduced support overhead by removing the need for end users to request administrator assistance for installing approved applications.

ThreatLocker has enabled us to effectively eliminate the risk of users introducing unauthorized applications into their environment. Occasionally, clients with on-premises IT teams or trusted individuals with administrative privileges might install software that they deem harmless. However, this software is often not part of the standard deployment or approved image, posing a potential security threat.

ThreatLocker serves as an additional layer of defense, ensuring that only authorized software is installed. For example, we have blocked and consolidated the installation of older Adobe versions, which may be vulnerable due to a lack of security updates. Similarly, when Adobe transitioned to a new licensing model, we prevented users from deploying older versions they might have had on hand, ensuring compliance and mitigating potential compatibility issues with the operating system or modern MSA-related items. One of the most common instances of unauthorized software installation involves printer drivers. Users may attempt to install specific drivers or software packages, which can introduce unwanted bloatware or adware. ThreatLocker effectively prevents this type of installation, ensuring a clean and secure environment. For example, if someone attempts to download Adobe Reader directly, the installer might attempt to bundle McAfee software. ThreatLocker efficiently blocks such bundled installations, preventing the introduction of unwanted adware.

We had already anticipated the benefits of ThreatLocker, and these benefits were subsequently confirmed in real-world scenarios. This prior knowledge solidified our understanding of the value it provides. We have a client who unfortunately fell victim to a compromised campaign that ThreatLocker would have prevented. This specific case serves as a compelling use case demonstrating the product's effectiveness. Notably, we were able to identify this value proposition quickly by reviewing the documentation and implementing ThreatLocker in our test environment. However, having a real-world example—where we can confidently state that ThreatLocker would have stopped the attack—further reinforces the product's potential value.

While it can be frustrating at times, we appreciate the low-level security provided by the application whitelist. Although incorrect implementation can lead to unintended blocking of desired applications, it serves as a crucial layer of defense against unauthorized activity. This whitelist effectively enforces established policies, ensuring minimal potential damage in the event of a malicious incursion.

This is our first time using whitelisting software in a production environment, so I can't speak from experience with other solutions. However, one of the main challenges we've encountered is that whitelisted applications can sometimes result in blocked requests, which disrupts workflows. If there's a way to mitigate these disruptions, it would significantly improve the end-user experience. While I don't have a specific solution in mind, I think ThreatLocker's current implementation is elegant. It allows users to customize what they see, submit a request, or simply exit without creating a ticket. This flexibility avoids forcing users to create tickets unnecessarily. While I think ThreatLocker is doing a good job overall, I believe the biggest pain point is the potential disruption to user workflows.

One area I see for improvement is in the visibility of support tickets within the ThreatLocker ticketing system. While my interactions with individual representatives and my solutions engineer have been excellent, communication through the ticketing system itself lacks transparency. Specifically, when an issue is escalated or marked as "being worked on," I'm not provided with any updates or information about the progress being made. This lack of visibility is frustrating, especially when dealing with complex issues that may take longer to resolve. While I understand that not every problem can be fixed in five seconds, I would like to see improved visibility in the ticketing system. This could be achieved by providing regular updates on the progress of tickets, particularly those that are older than three weeks. I appreciate the responsiveness and expertise of the individual support personnel I've interacted with, but enhanced visibility within the ticketing system would be a welcome improvement.

I have been using ThreatLocker Protect for two years.

One of the recent tickets we opened resulted in stability issues for a very small population of deployed agents less than 0.1 percent. While the scale of the issue is minor and it only emerged recently, with a previously perfect stability record, it does represent a blemish on the otherwise excellent track record. I wouldn't allow this short-term problem to overshadow their previously pristine performance.

I have not encountered any scalability issues.

The technical support team is incredibly fast and efficient. Their live chat feature connects us directly with a support engineer, not an automated system or auto attendant. This direct connection is fantastic and ensures a swift resolution to your issue.

The accuracy of their solutions for common problems is impeccable, consistently exceeding 99 percent. While I've encountered some uncommon issues that required escalation to the development team, this is not a reflection of support's competence. It simply indicates an underlying product issue, not a support-related one.

The team's tier-one support engineers are exceptional, and the solutions engineer assigned to our account is equally impressive. They are both invaluable assets to the support side of the operation.

My only critique concerns the visibility of tickets that aren't resolved immediately. However, every time I've interacted with a support representative, they've been professional and helpful.

Positive

We deployed the agents using our cloud-hosted RMM software, Ninja RMM. ThreatLocker provided us with a script to facilitate the deployment, making it incredibly easy. Management is also handled through the cloud portal, making the entire process cloud-exclusive and efficient for large-scale deployments.

I am involved in the initial deployment process for each newly onboarded client. The process is very straightforward, requiring only a few clicks and confirmation of the organization in the portal pop-up. Issues are extremely rare, and any encountered have been on our end during deployment, not with the product itself.

Deployment is typically a one-person job, especially for new clients. When we first launched the program, we had two people in the testing environment to ensure smooth execution. However, this included ThreatLocker integration, which required two additional key players: our account manager and solutions engineers. Therefore, the initial onboarding process involved two individuals, while subsequent client deployments required only one. This has proven sufficient to manage deployments without issues.

We used an integrator who is the solution engineer assigned to our account and has been very helpful to this day. His involvement extended far beyond the initial 90-day onboarding period, and he remains heavily involved in our ongoing integration efforts. His contributions have been a true boon to our project's success.

I believe ThreatLocker's pricing model is fair and flexible, allowing account managers to offer customized deals based on our specific needs. As a small company internally, we also appreciate the ability to scale our subscription easily to accommodate rapid growth periods, which are common for MSPs like ourselves. The tiered pricing structure based on devices is helpful, and the option to commit to specific modules in exchange for discounts is a valuable feature. Overall, I find their pricing fair and transparent, and I am impressed with their willingness to collaborate with us to achieve our goals.

I would rate ThreatLocker Protect a nine out of ten.

Building trust in ThreatLocker's protection relies on the visibility of application requests, demonstrating that the product is actively working. However, this approach may not always achieve the desired outcome. Unfortunately, end users can perceive the constant prompts as a burden, hindering their workflow. While it's crucial to ensure that unauthorized applications are not running, these interruptions can erode trust unless users fully understand the security rationale. Instead of fostering confidence, the prompts can feel like roadblocks, obstructing users' ability to perform their tasks.

Our workflow has generally stayed the same with ThreatLocker. We were not looking for a solution that would save us time. We were looking for a robust whitelisting application software.

End users may not always consider the potential consequences of their actions. As security advisors, it's our responsibility to educate them on safe online practices. Downloading files from unknown sources, clicking links in suspicious emails, and entering passwords carelessly are all risky behaviors. Our "Know Before" training program specifically addresses these vulnerabilities through interactive phishing simulations and social engineering exercises. While some users might find this mandatory training disruptive, it's crucial for building awareness and mitigating cybersecurity risks. Security professionals can't afford to remain passive. While a silent, background approach might be ideal, the reality is that active intervention is often necessary. The end user is dangerous and just like a guardian watching over a child crossing the street, ThreatLocker offers an extra layer of protection, preventing users from making critical mistakes.

Users need to be aware that this feature will bring security to the forefront for them. This visibility is not a negative aspect, but rather a positive one, as it increases user awareness. However, it's important to remember that sometimes even tech professionals and security analysts cannot anticipate how users will think or react. So, it's essential to avoid approaching the situation from a purely technical or analytical perspective, and instead strive for a balanced and grounded approach. Be mindful of the increased visibility and leverage ThreatLocker's exceptional support team. They have likely encountered any unique situations we might encounter and can guide us through the implementation process.

I primarily use the solution for access control. We have customers and even though there is an antivirus, sometimes users might open some unapproved files. This solution will flag them for approval or rejection.

The unified alerts are useful. You get all of your alerts and flags in one place. If you approve something, it will send an email. 

It's very easy for admins to approve or deny results.

The visibility is very good. The only downside is you need to be in the portal to see anything. I'm not sure if there is a way to actually know or approve everything off of the portal. 

ThreatLocker does offer ring-fencing, although I do not use it. 

The unified reports make everything go smoother. You can access requests and you can see, for example, if something is repeatedly approved or denied, it makes it faster to make a decision. It helps me trust decisions. 

It's pretty good at detecting programs and does not allow you to run them if necessary.

I'm not sure if I'm using it wrong; however, I find that I have to babysit it too much.

I've found that if a user opens a file from another location, it might trigger an approval process. The same is true if someone has the same file under a different name.

If anything, we get more tickets while using ThreatLocker. It doesn't help us reduce help desk tickets.

It's hard to manage multiple policies for multiple companies. It gets cumbersome.

I've only used the solution minimally. I've used it throughout the year.

I have not dealt with technical support. 

We tend to use Webroot and ThreatLocker, however, I'm working to get rid of ThreatLocker. Webroot is just an antivirus; ThreatLocker is more robust in that it's an antivirus and good at detecting programs and blocking them.

I wasn't involved in the deployment of the process. There isn't much maintenance, however, you are required to mainly look at logs all day. We'd prefer to be more hands-off.

We have witnessed an ROI as we don't get attacks or anything. The protection has pretty much been 100%. The issue is, however, that we have added overhead as there's more time needed to monitor the applications and deal with the tickets related to approvals. 

The pricing is good. 

I'm considering SentinelOne. I'm looking at reviews to see if they are worth it.

We're solution partners. 

I'd rate the solution seven out of ten. 

I'd advise new users to just make sure they have good policies in place. Otherwise, they'll find themselves babysitting the product all day long. 

We've seen a lot of malicious actors trying to get in and execute stuff and with ThreatLocker, we're able to catch them. We're able to see if it's an admin executing a program or not. If we don't know who's doing what, we're able to block it.