What is our primary use case?
Our clients require a zero-trust solution for their servers. They need to ensure that nothing happens to the server without authorization — nothing comes in, goes out, or gets corrupted. We put ThreatLocker on the server to block anything that attempts to run without permission. We use ThreatLocker across our whole platform. We continue to pound the table on how great it is and tell our customers that they need it. It is currently deployed for multiple MSP and MSSP clients on their servers and workstations.
How has it helped my organization?
I don't know if ThreatLocker has improved the organization itself, but it has prevented a few clients from doing the dumbest things possible. Our clients are sleeping better at night. I was at dinner with a rep from ThreatLocker when my client accidentally fell for a scam and contacted a fake number for Apple support. She got a message saying that her IP had been stolen. She tried to let them access the system, but ThreatLocker wouldn't allow anything to load. My phone blew up with alerts.
Meanwhile, my client called, asking me to give "Apple Support" access. I told her to hang up because her IP couldn't be stolen. She was arguing about fake support, and I told her to Google "Stolen IP address scam." She looked it up and realized it was fake, so she hung up with him. She was mad at me for a bit but apologized the next day. If she didn't have ThreatLocker, they would be holding her files for ransom, or she would be leaking data.
It hasn't reduced our help desk tickets so far, and this is something they warn you about. They told us that it was going to be messy in the beginning. They didn't beat around the bush. They said we should expect some dust when we break ground. There will be dust and dirt everywhere, and we'll track it in many places. However, we will clean it up, put some sod down, and make it look beautiful. Until then, the house will be muddy. We expected some pain initially, which is why they do weekly calls with us until we get it to run correctly.
They provide fast access to Cyber Hero support, so they can help you at the drop of a hat. They also put a secure app on your phone to approve things on the fly if the clients are trying to do an update over the weekend. ThreatLocker provides everything you need to get the plane off the ground, and it flies well. Sometimes, clients get annoyed because they can't access something, but I tell them it's a necessary evil.
I tell them that their network is like flying on a plane. I say, "I know that you want TSA precheck and to be right at the front of the line, but your network doesn't have that. You didn't pay for it with the government." I point out that their security is more important than speed and access. We don't live in a fast-network world anymore. Everything has to be checked and double-checked.
I think it will free up help desk staff after we get past the initial stage, but the clients need to be trained the same way they do with emails. They need to understand that we won't blindly allow anything to work on their network. We will look at it first and ensure everything is how it should be. Finally, we will let it in, but everything will be ring-fenced or limited once it's in. We won't run that program until we figure out how to do that. If my clients are expecting an update, they can't keep that information to themselves. They need to let me know so we can arrange an upgrade time, and I can provide them with a window. We'll run it with some restrictions to ensure they're okay.
Allowlisting hasn't enabled us to consolidate tools. It's another tool in the toolbox, and everything has its place. After the Colonial Pipeline cyber attack, the president issued an executive order requiring zero trust. ThreatLocker fills that gap. You still have other blind spots, though. We need an email security solution and network monitoring to identify suspicious devices on our network searching for a vulnerability. You can't have ThreatLocker on everything. You can't have it on a printer or a specific firewall, but you can have it on an operating system. There are other blind spots that require attention.
What is most valuable?
Using ThreatLocker is effortless because I can access it from an app on my phone, so I can help clients after hours. My client had an issue while I was at dinner, and I didn't have a tech on the problem, but I could deal with it from my phone. I can see what the client is doing and approve or deny it. It helps me deliver better service to my clients when they need it.
ThreatLocker also has a service where one of their techs can call you on Zoom and go through anything denied for the last week. They will train you until you feel comfortable enough to do it yourself. I've dealt with one of their techs from the UK, who was knowledgeable, friendly, and an excellent teacher.
I only needed about six or seven sessions before I didn't need him anymore, but the training didn't stop. They continue to train until you can handle each client request, see what was blocked, and determine why. You can understand why something was blocked and how to dive deeply into it. You can also click "Chat With a Cyber Hero," and somebody will help. It has been a wonderful experience overall.
We typically use ThreatLocker with ring-fencing when requested. You only ring-fence applications. For example, Microsoft Office doesn't ever need to open PowerShell. It will get flagged automatically if that happens. We know what programs should and should not have access to. The printer should never open an FTP port. Allowlisting automatically sets those policies and says this device has printing functions but can't access an FTP port.
Allowlisting establishes trust for every access request regardless of origin. In light of new regulations about zero trust, compliance issues, and litigation risks, we must be careful about what gets out and what doesn't get out. Ring-fencing and zero-trust strategies are two ways to do that. We have to run applications, but we don't want them to do anything except what we want. We get the best of both worlds. An application doesn't run if we don't know what it does, and necessary applications will only run with specific rules.
What needs improvement?
ThreatLocker could offer more flexible training, like online or offline classes after hours. The fact that they even provide weekly training makes it seem silly to suggest, but some people can't do it during the day, so they want to train after work. They could also start a podcast about issues they see frequently and what requires attention. A podcast would be helpful to keep us all apprised about what's going on and/or offline training for those people who can't train during the week.
For how long have I used the solution?
I have used ThreatLocker since July 2022.
What do I think about the stability of the solution?
ThreatLocker is highly stable.
What do I think about the scalability of the solution?
ThreatLocker has been very scalable so far.
How are customer service and support?
I rate ThreatLocker support ten out of ten. Everyone else should follow their support model. ThreatLocker has a built-in help desk feature. It's one of the best I've seen. An icon in the bottom right corner says "Chat With a Cyber Hero." When I first clicked on it, someone responded in eight seconds. I was like, "Holy cow, that's fast!" They've solved every issue in under five minutes.
How was the initial setup?
We rolled out Allowlisting from their portal and then deployed it on servers and critical workstations. It was straightforward and reassuring. We have Kaseya, and we didn't know if we had been affected by the breach. ThreatLocker was there with boots on the ground on a Saturday to help us get secure. They reassured us everything was okay.
What was our ROI?
Using ThreatLocker has made us look like real players in the security space. That's a huge deal. You have a seat at the table when you look like a real player. You see value in everything they do. You understand the program and can see what they're pre-populating it with. You can get training from a Cyber Hero almost immediately.
Most importantly, you can get weekly training to teach you along the way. You can stop and pick it up whenever you need. They are that good. I'm going to have some of my other techs go through the training so everybody can be trained to do a ThreatLocker assessment.
What's my experience with pricing, setup cost, and licensing?
Others say ThreatLocker is too expensive, and I tell them they're dreaming. It's well-priced for what it does.
Which other solutions did I evaluate?
Before adopting ThreatLocker, we didn't even know this type of solution existed. We were affected by the Kaseya ransomware attack and forced to shut our server down. We were scared, so we called up ThreatLocker and asked if they could help us.
They asked to get into our server and see if we were hit. They also looked at the program agent mod to help other people who were impacted. They dropped everything to work with me on a Saturday. Who does that?
What other advice do I have?
I rate ThreatLocker AllowListing 11.5 out of 10. It's one of the best products on the market, and every MSP needs it because of the zero-trust rules imposed by the executive order. The product does what it says, and the support is fantastic. The training is excellent. They take care of you. You'll know what's happening, and your client will sleep better at night.
In this industry, companies often promise they will help you when you run into trouble. However, they aren't there more often than not. For example, Microsoft tested its software in the beginning and put out a beta version. When they release a new operating system, everyone knows is the beta version, and we're all beta testers. We have to be the ones to tell Microsoft about our issues through the built-in error reporting, and we don't want to report it to Microsoft because we know they won't do anything with it.
We know that they no longer take it seriously. They let us do their work as testers for their beta product. It's refreshing to deal with a product like ThreatLocker where I get support in eight seconds. As soon as I open the chat, they're there typing away. When I start a chat with AT&T, Spectrum, or any of those, I get a message saying, "Support will be with you momentarily." You see the three little dots don't move, and you need to wait five to twenty minutes to get support. ThreatLocker puts out a great product backed up with excellent support and training. What else do you need?
Disclosure: PeerSpot contacted the reviewer to collect the review and to validate authenticity. The reviewer was referred by the vendor, but the review is not subject to editing or approval by the vendor.
