Try our new research platform with insights from 80,000+ expert users

Morphisec vs ThreatLocker Zero Trust Endpoint Protection Platform comparison

 

Comparison Buyer's Guide

Executive SummaryUpdated on Jan 11, 2026

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Categories and Ranking

Morphisec
Ranking in Endpoint Protection Platform (EPP)
52nd
Ranking in Advanced Threat Protection (ATP)
32nd
Average Rating
9.2
Reviews Sentiment
7.4
Number of Reviews
21
Ranking in other categories
Vulnerability Management (54th), Endpoint Detection and Response (EDR) (60th), Cloud Workload Protection Platforms (CWPP) (34th), Threat Deception Platforms (20th)
ThreatLocker Zero Trust End...
Ranking in Endpoint Protection Platform (EPP)
6th
Ranking in Advanced Threat Protection (ATP)
6th
Average Rating
9.2
Reviews Sentiment
7.4
Number of Reviews
40
Ranking in other categories
Network Access Control (NAC) (4th), Application Control (1st), ZTNA (4th), Ransomware Protection (1st)
 

Mindshare comparison

As of February 2026, in the Endpoint Protection Platform (EPP) category, the mindshare of Morphisec is 0.6%, up from 0.4% compared to the previous year. The mindshare of ThreatLocker Zero Trust Endpoint Protection Platform is 1.1%, up from 0.7% compared to the previous year. It is calculated based on PeerSpot user engagement data.
Endpoint Protection Platform (EPP) Market Share Distribution
ProductMarket Share (%)
ThreatLocker Zero Trust Endpoint Protection Platform1.1%
Morphisec0.6%
Other98.3%
Endpoint Protection Platform (EPP)
 

Featured Reviews

reviewer1739325 - PeerSpot reviewer
CISO at a media company with 10,001+ employees
Easy to deploy and configure, stable, and has good support
The weakest point of this product is how difficult it is to understand the reasons for an alert. This is a problem because it is hard to determine whether an attack is real or not. It blocks the behavior automatically but it is quite difficult to check the reason for this, and it is something that we are discussing with Morphisec. We need to have better reporting features that are able to produce KPIs that we can show to management. Improved analytics reports would help us to understand what type of attack it is and how it was able to reach a particular computer.
CL
Supervisor, Client Security at a consultancy with 11-50 employees
World-class support and highly effective for application control and elevation
Their product is solid. I have a hard time complaining much about it because when we do find little things, they are usually interface-related or related to things that would be nice to have. Their idea portal, unlike so many other vendors we deal with, shows movement. At least four to eight features of ThreatLocker exist because I made a request in the last five years, and it became a feature of the actual product. When it comes to improvements, we moved the product as customers, and we got to move the product by making suggestions. They seem to be very reactive to it, so there is not a whole lot that they actively need to change right now. It is one of those situations where when we run into something that would be nice to have, it happens. They make it work.

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Pros

"Morphisec makes use of deterministic attack prevention that doesn’t require investigation of security alerts. It changes the memory locations of where certain applications run. If you think of Excel, opening a PDF, running an Excel macro, or opening a webpage and clicking on a link, all of those actions run in a certain area of memory. Morphisec changes the memory locations of where those run."
"Morphisec's in-memory protection is probably the most valuable feature because it stops malicious activity from occurring. If something tries to install or act as a sleeper agent, Morphisec will detect and stop it."
"It also provides full visibility into security events from Microsoft Defender and Morphisec in one dashboard. We've always had that capability with Morphisec. The more recent version appears to do that even a little bit more natively and it's given us visibility that we didn't have otherwise."
"Morphisec has enabled us to become a lot less paranoid when it comes to staff clicking on things or accessing things that they shouldn't that could infect the whole system. Our original ransomware attack that happened came from someone's Google drive and then just filtered on through that. It has put our minds at ease a lot more in running it. It's also another layer of security that has been proven to be effective for us."
"What's valuable is really the whole kit and caboodle of the Morphisec agent. What it does is genius, in a way, until the bad guys get wise to it. You set it up and then you watch the dashboard. There isn't really much tinkering."
"Morphisec also provides full visibility into security events for Microsoft Defender and Morphisec in one dashboard... in the single pane of glass provided by Morphisec, it's all right there at your fingertips: easy to access and easy to understand. And if you choose to go down further to know everything from the process to the hash behind it, you can."
"We don't have to do anything as a user or as an admin. It does everything by default with its coding and inbuilt AI-based intelligence. We don't have to instruct it about what to do. It automatically takes corrective actions and quarantines or deletes a virus, malware, etc. That is the best part that I like about it."
"Morphisec stops attacks without needing to know what type of threat it is, just that it is foreign. It is based on injections, so it would know when a software launches. If a software launches and something else also launches, then it would count that as anomalous and block it. Because the software looks at the code, and if it executes something else that is not related, then Morphisec would block it. That is how it works."
"The unified alerts are useful."
"The biggest improvement has been knowing that something unauthorized isn't going to get installed on anyone’s machines."
"The customer service is amazing."
"The control list is the best feature. For our company, it provides value to our customers since they can see we are improving our security."
"Unified Audit is excellent for identifying our denies and using those to dynamically create rules, as opposed to manually observing the logs and creating them. It saves so much time."
"Being able to protect and trust nothing by default, known as zero trust, is the most important feature to me."
"Overall, everything is excellent, and everything is well-prepared, from the laptops provided to the overall setup."
"The sandbox functionality is fantastic."
 

Cons

"We sometimes have to depend on the support team to know what action we should take. If the solution for an alert can be built into the report that we are getting, it will save time, and the interaction with support would be less. At times, corrective action is required, but at times, we don't need to take any action. It would be good if we get to know in the report that a particular infection doesn't require any action. It will save us time and effort."
"We wanted to have multi-tenants in their cloud platform, so every entity can look into their own systems and not see other systems in other entities. I have a beta version on that now. I would like them to incorporate that in the cloud solution."
"Sometimes it generates false positive alerts. They need to continue working on that. They have provided solutions for it and have fixed issues with updated versions. The service is quite good but they need to work on it more so that there are no false positive alerts."
"Automating reports needs improvement. I would like to have better reporting capabilities within it or automated reporting to be a little bit more dynamic. That's something I know they're working on. We literally are in the process. We started the process a week and a half ago of going to their latest version, so I've not seen their latest one up and running yet."
"The weakest point of this product is how difficult it is to understand the reasons for an alert. This is a problem because it is hard to determine whether an attack is real or not."
"If anything, tech support might be their weakest link. The process of getting someone involved sometimes takes a little time. It seems to me that they should have all the data they need to let me know whether an alert is legitimate or not, but they tend to need a lot of information from me to get to the bottom of something. It usually takes a little longer than I would expect."
"From a company standpoint, a little more interaction with the customers throughout the year might be beneficial. I would like check-ins from the Morphisec account executives about any type of Morphisec news as well as a bit more interaction with customers throughout the year to know if anything new is coming out with Morphisec, e.g., what they are working on in regards to their development roadmap. We tend not to get that up until the time that we go for a yearly renewal. So, we end up talking to people from Morphisec once a year, but it is usually at renewal time."
"It might be a bit much to ask, but we are now beginning to use Morphisec Scout, which provides vulnerability information. At this time, it's recognizing vulnerabilities and reporting them to us, but it's not necessarily resolving them. There's still a separate manual process to resolve those vulnerabilities, primarily through upgrades. We have to do that outside of Morphisec. If Morphisec could somehow have that capability built into it, that would be very effective."
"We use other vendors for other components. I'd like one vendor to control all aspects of the business, including backup, EDR solutions, email monitoring, and control, rather than using multiple vendors."
"A valuable addition to ThreatLocker would be a column in the audit page displaying a VirusTotal score for each file."
"We also have customers who are frustrated because they cannot do what they used to do, which was run anything they wanted to."
"The user experience could be improved. Most complaints we get are based on users wanting certain functionality."
"The portal can be a little overwhelming at times from an administration point of view. It displays a lot of information, and it's all useful. However, sometimes there is too much on the screen to sift through, especially if you're trying to diagnose a client's problem with a piece of software. Maybe something has stopped working since they updated it, and we need to see if ThreatLocker is blocking a component of that software."
"ThreatLocker could offer more flexible training, like online or offline classes after hours. The fact that they even provide weekly training makes it seem silly to suggest, but some people can't do it during the day, so they want to train after work. They could also start a podcast about issues they see frequently and what requires attention. A podcast would be helpful to keep us all apprised about what's going on and/or offline training for those people who can't train during the week."
"If ThreatLocker can design or build something for mobile devices, that would be brilliant."
"ThreatLocker Allowlisting needs to improve its user interface and overall workflow."
 

Pricing and Cost Advice

"Licenses are per endpoint, and that's true for the cloud version as well. The only difference is that there is a little extra charge for the cloud version."
"It is priced correctly for what it does. They end up doing a good deal of discounting, but I think it is priced appropriately."
"It is a little bit more expensive than other security products that we use, but it does provide us good protection. So, it is a trade-off."
"It does not have multi-tenants. If South Africa wants to show only the machines that they have, they need their own cloud incidence. It is not possible to have that in a single cloud incidence with multiple tenants in it, instead you need to have multiple cloud incidences. Then, if you have that, it will be more expensive. However, they are going to change that, which is good."
"Our licensing is tied into our contract. Because we have a long-term contract, our pricing is a little bit lower. It is per year, so we don't get charged per endpoint, but we do have a cap. Our cap is 80 endpoints. If we were to go over 80, when we renewed our contract, which is not until three years are over. Then, they would reevaluate, and say, "Well, you have more than 80 devices active right now. This is going to be the price change." They know that we are installing and replacing computers, so the numbers will be all over the place depending on whether you archive or don't archive, which is the reason why we just have to keep up on that stuff."
"Price-wise, it's on the higher side. A traditional antivirus solution is cheaper, but in terms of security and manageability, its ROI is better than a traditional antivirus. I would recommend it to anybody evaluating or considering an antivirus solution. If your system gets compromised, the cost of ransom would be a lot more. This way, it saves a lot of cost."
"It is an annual subscription basis per device. For the devices that we have in scope right now, it is about $25,000 a year."
"The pricing is definitely fair for what it does."
"The price of ThreatLocker Allowlisting is reasonable in the market, but it is not fantastic."
"I do not know about the licensing and price as it comes bundled from our MSP. However, it seems fairly reasonable for us, which is why we chose it."
"Although the pricing seems good, there have been inconsistencies in contract negotiations."
"I find ThreatLocker's pricing to be reasonable for the services it provides."
"I can't complain. Cheaper would always be nice, but I think it's reasonable compared to other software in the cybersecurity market."
"The pricing works fine for me. It's very reasonably priced."
"We have encountered a few challenges regarding pricing, contract renewals, and additions. As we explored adding features like Cyber Hero, it proved to be an increased expense for our clients. This was primarily a mistake on our part due to how we initially priced it to clients."
"ThreatLocker's pricing seems justifiable."
report
Use our free recommendation engine to learn which Endpoint Protection Platform (EPP) solutions are best for your needs.
881,733 professionals have used our research since 2012.
 

Top Industries

By visitors reading reviews
Outsourcing Company
18%
Manufacturing Company
10%
Financial Services Firm
8%
Computer Software Company
8%
Computer Software Company
22%
Retailer
8%
Manufacturing Company
7%
Financial Services Firm
7%
 

Company Size

By reviewers
Large Enterprise
Midsize Enterprise
Small Business
By reviewers
Company SizeCount
Small Business5
Midsize Enterprise8
Large Enterprise8
By reviewers
Company SizeCount
Small Business32
Midsize Enterprise4
Large Enterprise3
 

Questions from the Community

Ask a question
Earn 20 points
What do you like most about ThreatLocker Allowlisting?
The interface is clean and well-organized, making it simple to navigate and find what we need.
What is your experience regarding pricing and costs for ThreatLocker Allowlisting?
Pricing, setup costs, and licensing have been pretty accessible and manageable. It was not too expensive to get started, especially at a small scale for a smaller MSP. It is very accessible, easy t...
What needs improvement with ThreatLocker Allowlisting?
Going with the theme of ThreatLocker Zero Trust Endpoint Protection Platform being a one-stop shop where they have just about everything, and they have a really good product stack as is. However, t...
 

Also Known As

Morphisec, Morphisec Moving Target Defense
Protect, Allowlisting, Network Control, Ringfencing
 

Overview

 

Sample Customers

Lenovo/Motorola, TruGreen, Covenant Health, Citizens Medical Center
Information Not Available
Find out what your peers are saying about Morphisec vs. ThreatLocker Zero Trust Endpoint Protection Platform and other solutions. Updated: February 2026.
881,733 professionals have used our research since 2012.