

Anomali and ThreatLocker Zero Trust Platform are competing products in the cybersecurity space. Anomali holds an advantage in pricing and general support, while ThreatLocker excels with comprehensive features.
Features: Anomali offers robust threat intelligence capabilities, streamlined incident response mechanics, and credential monitoring. ThreatLocker Zero Trust Platform emphasizes application control, real-time policy enforcement, and allows list management.
Room for Improvement: Anomali could improve its integration options, expand data set limits, and refine its UI. ThreatLocker may benefit from simplifying initial setup, enhancing real-time alerts, and optimizing onboarding processes.
Ease of Deployment and Customer Service: Anomali's straightforward deployment is supported by accessible customer service. ThreatLocker Zero Trust Platform requires more initial setup but features extensive support options.
Pricing and ROI: Anomali offers competitive pricing with a strong ROI through embedded intelligence capabilities. ThreatLocker has a higher initial cost but provides enhanced security returns over time.
Analyst productivity has improved significantly, with hours saved because of automation and AI-driven work that Anomali performs.
There is a return on investment concerning time and effort saved by 40% after implementing Anomali.
If something were to happen without ThreatLocker, the cost would be huge, and thus, having it is definitely worth it.
Based on what we use ThreatLocker Zero Trust Endpoint Protection Platform for with the same functionalities and packaging, it was around 13 or 14 hours.
We have the MDR package as well, and just knowing someone is watching those endpoints at 3:00 a.m. is a lifesaver that you cannot put a dollar figure on.
They have strong onboarding and deployment assistance, provide a dedicated technical account manager for large customers, and engage in regular product updates and customer interaction.
The technical support at Anomali is excellent.
It doesn't seem very professional how they're handling support anymore.
They have been very responsive, helpful, and knowledgeable.
I would rate their customer support a ten out of ten.
Their support is world-class.
The scalability is massive, allowing us to store millions of indicators.
I believe Anomali's scalability is good; whether it is an organization for ten people or one hundred thousand people, the job a threat intel platform has to do will be the same.
Anomali's scalability is impressive as a mature platform capable of processing large amounts of threat intelligence and indicators of compromise data.
I started off with just the servers, and within a month and a half, I set up the entire company with ThreatLocker.
It seems to primarily operate on the endpoints rather than at a central location pushing out policies.
ThreatLocker Zero Trust Endpoint Protection Platform scales very smoothly with our growing needs.
From a reliability perspective, Anomali consistently injects threat feeds, works on automation, performs reliable API integrations, and supports enterprise scale globally.
For example, while Microsoft allows ample time for users to adapt to deprecated features, Anomali only gave us three weeks before switching, so they need to be more cognizant of customer use cases from their engineering side.
The good thing is that they have a health check page, and if any issues arise, they notify us.
For five years, we have not had a problem.
Once deployed, it downloads the policies locally, so even if the computer doesn't have internet, it doesn't matter.
It has been very stable, reliable, and accessible.
Combining all aliases into a coherent solution would be beneficial, as we had to review each individual source ourselves.
Anomali should increase their capability to fetch details from various dark web solutions where threat actors post compromised credentials.
Anomali's ability to correlate and integrate different Threat Intel platforms, such as Mandiant and PolySwarm, is another valuable feature, removing duplicacy and enabling the application of specific IOCs across various security controls.
Controlling the cloud environment, not just endpoints, is crucial.
ThreatLocker Zero Trust Endpoint Protection Platform could improve by being a little more hands-off, perhaps by having a team inside ThreatLocker that does all the vetting of patches; having one person hired by ThreatLocker to check out patches means that a million other industries using ThreatLocker Zero Trust Endpoint Protection Platform do not have to vet the same patch, ultimately saving time and money around the world.
This feedback would help us understand what is learned in real-time, especially during a one-hour learning mode setup, ensuring we remain aware of potentially unnecessary learned items.
Pricing and licensing are good, but the costs for purchasing threat feeds are somewhat complicated and a bit on the higher side.
After conversations with other partners, it became clear we underpriced it initially, which caused most of our issues.
We are moving towards the Unified solution, where they basically bundle everything together, providing us better stability with the ability to bring in new product offerings without having to go back to the customer and say, 'This is going to cost you.'
Money is saved because it is not costly, and I would suggest it for other companies.
Regarding integration, Anomali has capabilities to integrate with different downstream applications such as Palo Alto, allowing us to create playbooks to block domains, URLs, or IPs directly within the firewall.
Correlating IOCs with the telemetry data we are ingesting from our data sources allows us to pull monthly reports identifying how many assets and users interacted with malicious content, giving insight into whether communications failed or users accessed restricted content, providing complete visibility of the IOCs traveling throughout our environment.
It aggregates intelligence from hundreds of sources, automatically de-duplicates, applies risk scoring, applies context, and reduces much manual effort.
ThreatLocker Zero Trust Endpoint Protection Platform's ability to block access to unauthorized applications has been excellent.
It protects our customers.
The major benefit is fewer breaches overall, as nothing can be run without prior approval. This helps my company protect its data and secure itself effectively.
| Product | Mindshare (%) |
|---|---|
| ThreatLocker Zero Trust Platform | 2.7% |
| Anomali | 3.4% |
| Other | 93.9% |


| Company Size | Count |
|---|---|
| Small Business | 2 |
| Midsize Enterprise | 1 |
| Large Enterprise | 14 |
| Company Size | Count |
|---|---|
| Small Business | 53 |
| Midsize Enterprise | 13 |
| Large Enterprise | 11 |
Anomali delivers user-friendly cyber threat intelligence, offering concise insights with robust capabilities for evolving scenarios.
Anomali offers a powerful platform for cyber threat intelligence, allowing organizations to efficiently stream and analyze threat feeds. It excels in threat modeling, prioritizing intelligence, and supporting large-scale automation through its API, fostering a proactive security approach.
What are Anomali's Key Features?Anomali serves as a crucial tool for threat intelligence in industries ranging from finance to healthcare. Organizations stream threat feeds into Anomali to correlate and aggregate data, enhancing security measures and facilitating thorough threat investigations. Its adaptability makes it suitable across different sectors.
Gain proactive, industry leading Zero Trust cybersecurity capabilities with ThreatLocker. By employing a deny-by-default approach, you will greatly enhance your security and operational efficiency. Solutions from ThreatLocker are focused on precise application control and
streamlined access management without administrative rights.
ThreatLocker Application Control solutions include Zero Trust Alllowlisting, Zero Trust Ringfencing and Privilege Access Management, significantly reducing any unauthorized software activities in your environment. Granular controls improve your overall security, while ringfencing enhances application behavior monitoring. Elevation requests will allow users to gain administrative access without IT intervention. The platform's ease of policy management and real-time threat visibility contribute to reduced help desk tickets and operational costs, ensuring protection against ransomware and
unauthorized applications.
What are the key features of ThreatLocker Zero Trust Platform?
What benefits and ROI should users expect?
Organizations often deploy ThreatLocker to ensure endpoint security in industries requiring stringent application control and administrative access management. Its functionalities are critical for managing Shadow IT, creating policies, and overseeing software installation approvals. Common usage spans sectors demanding robust security and compliance, such as finance and healthcare, where maintaining high
security and efficiency is crucial.
We monitor all Advanced Threat Protection (ATP) reviews to prevent fraudulent reviews and keep review quality high. We do not post reviews by company employees or direct competitors. We validate each review for authenticity via cross-reference with LinkedIn, and personal follow-up with the reviewer when necessary.