Try our new research platform with insights from 80,000+ expert users
IT Service Desk Analyst II & Endpoint Administrator at a insurance company with 201-500 employees
Real User
Top 20
Feb 26, 2025
Unified Audit has uncovered hidden application interactions and improved access control
Pros and Cons
  • "Unified Audit is excellent for identifying our denies and using those to dynamically create rules, as opposed to manually observing the logs and creating them. It saves so much time."
  • "Overall, I would rate ThreatLocker Zero Trust Endpoint Protection Platform a ten out of ten."
  • "To become the best solution, some sort of integration or remote management, like remotely connecting, could be beneficial."

What is our primary use case?

I use all of the modules except for Detect right now. We use application control because we have many enterprise applications. Many of them require different levels of elevation or different access to various endpoints. Leveraging that, in addition to storage control, has been significant. We have not yet built out our network control but have been using application control.

How has it helped my organization?

ThreatLocker Zero Trust Endpoint Protection Platform has not only served well in replacing some other security applications; it has also helped uncover application interactions that we were not aware of with Unified Audit.

ThreatLocker Zero Trust Endpoint Protection Platform has been incredibly useful. I have completed the online Cyber Hero training. After going through that, I feel I have a pretty comprehensive understanding of the product. Using that knowledge, we have been able to uncover some application interactions we were not even aware of before.

ThreatLocker Zero Trust Endpoint Protection Platform has not yet helped us consolidate applications and tools. We brought it on just recently. We previously had a fairly complete suite, but it will be replacing several of the tools. It has not yet helped our organization save on operational costs or expenses, but it will do that soon.

ThreatLocker Zero Trust Endpoint Protection Platform is highly capable of blocking access to unauthorized applications. I am very satisfied with the granularity of control.

ThreatLocker Zero Trust Endpoint Protection Platform has not yet helped reduce help desk tickets. We still use some other applications to manage configurations. We will be using ThreatLocker's Configuration Manager for one point of control. It will help in the future. It has not yet, but I can see it coming. I am really excited about it.

ThreatLocker Zero Trust Endpoint Protection Platform has freed up help desk staff for other projects with Unified Audit. Dynamically adding to the application definitions or modifying policies is quick and easy. We work in health care, so everything is very thoroughly audited. There are times when I lose an entire day because the security auditor does not have access to everything going on. We then have to pull reports from everywhere. With Unified Audit, we have all the information we need in one location. It saves about at least four or five days out of the month, which is pretty significant.

What is most valuable?

Unified Audit is excellent for identifying our denies and using those to dynamically create rules, as opposed to manually observing the logs and creating them. It saves so much time. It ensures that the Zero Trust Platform functions effectively. Otherwise, the manual labor required would render it unusable.

It combines application control and network control. It brings all the Windows settings that we were previously controlling through GPOs and Intune configuration settings into one place. We have been able to watch all of these critical controls from one place through Unified Audit.

What needs improvement?

I have not run into any shortcomings yet. To become the best solution, some sort of integration or remote management, like remotely connecting, could be beneficial. I can adjust many configuration settings, but being able to perform remote maintenance when the device is unattended and providing remote support would be helpful.

Buyer's Guide
ThreatLocker Zero Trust Endpoint Protection Platform
January 2026
Learn what your peers think about ThreatLocker Zero Trust Endpoint Protection Platform. Get advice and tips from experienced pros sharing their opinions. Updated: January 2026.
881,114 professionals have used our research since 2012.

For how long have I used the solution?

I have been using it for about a month and a half.

What do I think about the stability of the solution?

It is 100% stable. I have confidence in it. It has been doing everything that we hoped it would do.

What do I think about the scalability of the solution?

We do not have all of our endpoints locked down yet. With the flexibility of both the stub and the MSI installer, scaling it to the rest of the organization is going to be very easy, likely requiring just two clicks.

How are customer service and support?

Their support has been fantastic. It has been absolutely outstanding. We have Cyber Hero support, and they are always so quick and super knowledgeable. The rest of our representatives have been very friendly and quick to help. I would rate them a ten out of ten. 

How would you rate customer service and support?

Positive

Which solution did I use previously and why did I switch?

We use a handful of solutions. I have recently been brought onto our security team. We use CrowdStrike as our main security vendor at present.

How was the initial setup?

Deployment is very easy. There are, I believe, three or four different installation options. We use Intune for managing our applications. I was the one who built the installer, and it was a five-minute process. There was no additional scripting involved, which was amazing.

What about the implementation team?

We did it in-house.

What was our ROI?

There has been more granular control, especially with locking things down by processes and files. There are a lot of gaps that it is filling. It is addressing many of my needs. It gives me more confidence. I have been able to sleep better at night.

Which other solutions did I evaluate?

I did not consider any alternate solutions.

What other advice do I have?

Overall, I would rate ThreatLocker Zero Trust Endpoint Protection Platform a ten out of ten. 

Which deployment model are you using for this solution?

Public Cloud

If public cloud, private cloud, or hybrid cloud, which cloud provider do you use?

Microsoft Azure
Disclosure: My company does not have a business relationship with this vendor other than being a customer.
PeerSpot user
reviewer2665902 - PeerSpot reviewer
Systems Security Analyst & Deputy Security Officer at a financial services firm with 201-500 employees
Real User
Top 20
Mar 2, 2025
Pre-built policies and immediate notifications streamline application requests
Pros and Cons
  • "The pre-built policies and the fact that I get notified when a user requests an application are significant."
  • "The customer service is excellent, ten out of ten."
  • "One of the things I would really like is the ability to create custom groups and assign machines to them."

What is our primary use case?

I am currently using it mainly for application control on our endpoints and servers.

How has it helped my organization?

Something that I actually really like is that it can block the file extensions for scripting files like Python. Our current tool can't do that. So if somebody had the permissions to actually write code, they could bring it in and just run it without any kind of block. I'm really enjoying that we now have more control over that.

What is most valuable?

The pre-built policies and the fact that I get notified when a user requests an application are significant. My current tool does not do that, so requests sometimes remain pending for days. 

Additionally, I really like that it can block file extensions for scripting files like Python and bash. My current tool cannot do that, so if someone has permission to write code, they can bring it in and run it without any block. I am really enjoying that particular feature.

It's easy for IT teams to use for reducing attack surfaces. It has a good UI and is easy to use. It's simply blocking items that aren't allowed, however, with the easy to use interface, it makes the process of control easier. 

We are in the process of removing other solutions. For example, we're going to eliminate ManageEngine's app control.

We expect the solution will save costs. For example, in the future, we expect that we won't have to have our IT staff waiting for 90 minutes to finish an installation of a new application or have our employees not be able to use their computer if they're waiting for that installation

It's very good at blocking unauthorized applications. We have a lot of users that don't care about security, and they will download anything that they see from any link that they're given. This helps stop that behavior.

We haven't rolled out production, although it likely will help us reduce help desk tickets. 

What needs improvement?

One of the things I would really like is the ability to create custom groups and assign machines to them. Right now, I can apply policies, kind of, however, it would be nice to have an 'all users' group and then multiple overlapping groups for application control. That would be a beneficial feature.

For how long have I used the solution?

I used ThreatLocker for a month or two under the trial version, and I will start rolling it out to our production environment.

What do I think about the stability of the solution?

I do not see any issues with stability at all.

What do I think about the scalability of the solution?

Scalability it will be fine. It seems to primarily operate on the endpoints rather than at a central location pushing out policies. This setup is advantageous as it will not take an extended amount of time to deploy things.

How are customer service and support?

The customer service is excellent, ten out of ten. They have been very responsive, helpful, and knowledgeable.

How would you rate customer service and support?

Positive

Which solution did I use previously and why did I switch?

I am going to eliminate Manage Engines App Control. I absolutely hate that product. It has a very unintuitive UI/UX, does not provide notifications, and takes ninety minutes to roll out any change.

How was the initial setup?

The initial setup was straightforward. I encountered a minor issue where it accidentally blocked our DNS server, which is the primary financial server, while I was on vacation. Resolving it took two days. Aside from this small issue, it has been very good.

What about the implementation team?

We are proceeding directly through ThreatLocker.

What was our ROI?

We will see a significant return on investment since it will reduce the downtime for users waiting for applications.

Which other solutions did I evaluate?

I considered alternatives. I looked at AppLocker and another solution besides the one I am currently using. AppLocker responded the fastest, and after trying it, I appreciated its UI and features.

What other advice do I have?

Overall, I would rate this solution nine out of ten.

Which deployment model are you using for this solution?

On-premises
Disclosure: My company does not have a business relationship with this vendor other than being a customer.
PeerSpot user
Buyer's Guide
ThreatLocker Zero Trust Endpoint Protection Platform
January 2026
Learn what your peers think about ThreatLocker Zero Trust Endpoint Protection Platform. Get advice and tips from experienced pros sharing their opinions. Updated: January 2026.
881,114 professionals have used our research since 2012.
Cybersecurity at a tech services company with 11-50 employees
Real User
Top 20
Feb 23, 2025
No-sweat security with excellent application control and alerting
Pros and Cons
  • "ThreatLocker Zero Trust Endpoint Protection Platform provides no-sweat security that we can easily deploy. We do not worry about our habitual clickers because we receive an alert if they try to do something, and we know ThreatLocker has already taken care of it."
  • "ThreatLocker Zero Trust Endpoint Protection Platform provides no-sweat security that we can easily deploy."
  • "The Cyber Hero certification exam could use a bit of love, but overall, I have been very satisfied with the platform."

What is our primary use case?

We work with small businesses, and we are slowly rolling it out. We have implemented ThreatLocker for about 30 clients to protect those who are habitual clickers and those with compliance demands. 

How has it helped my organization?

ThreatLocker Zero Trust Endpoint Protection Platform provides no-sweat security that we can easily deploy. We do not worry about our habitual clickers because we receive an alert if they try to do something, and we know ThreatLocker has already taken care of it.

We are large for an MSP, but we are relatively new to security. We only have about three people. It helps us because we know that things are automatically going to be blocked. We do not have to worry about somebody at a company downloading Epic Games installers every fortnight or every Ccleaner app they can find. We know that will be taken care of. It just allows us to focus on other areas where we need to be. We are trying to get big clients. It allows us to focus on that and not worry about applications.

The automatic script generation and the number of install methods make it incredibly easy to put out. It automatically adds them to the portal. It is very easy to implement as long as you have tools in place that allow you to access those systems. For example, if you are implementing for the first time and do not have remote access to your system, it could be difficult. For us, it is incredible. We do not have to be hands-on. We just push it out.

ThreatLocker Zero Trust Endpoint Protection Platform has saved operational costs or expenses. Especially with clients who are heavy clickers, the work on remediation has been amazing. Once deployed to a client, we do not worry about them anymore. Manpower reduction has been significant. It is deployed to a small percentage of our clients, resulting in a 30% to 40% reduction in manpower for those clients.

Knowing that it automatically blocks unwanted applications allows us to focus on other areas. The other day somebody downloaded a fake Geek Squad, and I did not have to worry about it. I got the alert. 

ThreatLocker Zero Trust Endpoint Protection Platform has helped a little bit to reduce help desk tickets. It is for our heavy clickers group, but they are still a very small portion. Once we get it out to more and more clients, it will do even more.

ThreatLocker Zero Trust Endpoint Protection Platform allows us to focus on other areas. We are working towards compliance and other things, without worrying about their applications. It saves at least 10 to 15 hours a month, which does not seem like a lot, but we have a very small team. It adds up quickly. 

What is most valuable?

Currently, we are only using default-deny application control and ringfencing. We are considering implementing elevation control and storage control, but those are in the beta stages. Application control and ringfencing are what we use most, and we rely on them for many of our clients. 

What needs improvement?

That is challenging to answer because, in the areas we are working, we have been very happy. The improvements we need are more focused on user training than on ThreatLocker itself. They are constantly improving the platform. The Cyber Hero certification exam could use a bit of love, but overall, I have been very satisfied with the platform.

For how long have I used the solution?

As a company, we have used it for almost four years. I am new to the team, so it has been about eight months for me.

What do I think about the stability of the solution?

I have not experienced any downtime with it, so I would rate it very high. We thought we had a ThreatLocker issue once, but it turned out to be a Comcast issue blocking ThreatLocker access.

What do I think about the scalability of the solution?

The scalability is very high. It is very easy to scale.

How are customer service and support?

Customer support has been very good. Whenever we have had issues with a couple of scripts, we contacted Cyber Heros support and said, "We need to figure out how to get this blocked without allowing that," and they have always been very quick to assist.

I would rate them a ten out of ten. I have never had an issue with contacting them or them not being able to help.

How would you rate customer service and support?

Positive

Which solution did I use previously and why did I switch?

We did not use any other solutions for application security before this. It was the first one we implemented after discovering a need.

How was the initial setup?

The setup was pretty seamless. We generate a script and deploy it through our infrastructure and managed service team. We verify that everything is in place, and during the onboarding process, within a few hours, the machines report that it is already implemented.

What about the implementation team?

We implement it in-house.

What was our ROI?

It has saved time and provided safety. We are also able to work on compliance. We were able to get more business from someone because we could do this. It got us some more work.

What other advice do I have?

I would rate ThreatLocker Zero Trust Endpoint Protection Platform a ten out of ten. It is the only solution we know that does what it does. Customer service is a significant factor. We had a client who was a habitual clicker, and after implementing ThreatLocker, I received a call saying, "I did something," but I could see it was already blocked. The difference in response between reacting to a malware alert and knowing ThreatLocker handled the issue is substantial. 

Disclosure: My company does not have a business relationship with this vendor other than being a customer.
PeerSpot user
Security Analyst at a consultancy with 1-10 employees
Real User
Top 20
Feb 23, 2025
Ringfencing and elevation streamline administrative tasks and enhance workflow efficiency
Pros and Cons
  • "I really enjoy ringfencing and elevation features. It makes my life easier because I do not have to get on a computer to elevate a prompt to allow users to run something they run every day as an admin."
  • "Overall, I would rate ThreatLocker Zero Trust Endpoint Protection Platform a ten out of ten."
  • "I cannot suggest anything that they are not already doing. They should keep adding features as they have been."

What is our primary use case?

We use this solution for Zero Trust application installations, as well as ringfencing those applications and elevating administrative rights.

How has it helped my organization?

ThreatLocker Zero Trust Endpoint Protection Platform cuts down on ticket times for a couple of my employees. They are able to get tickets done faster. Elevation helps with that, and throwing a computer in learning mode is super easy for them, so it just works in their workflow.

They are able to get the work that they need to do faster because they are not being bogged down with needless tickets.

It has helped free up our IT team’s time for other projects or tasks. On average, it has saved about two hours a week of work time.

ThreatLocker Zero Trust Endpoint Protection Platform is not difficult. It is easy for IT teams to use. They just need to install an agent.

ThreatLocker Zero Trust Endpoint Protection Platform has not consolidated any of our tools. It has just added to our stack and helps us sleep at night.

ThreatLocker Zero Trust Endpoint Protection Platform has not saved us costs because purchasing the agents costs money, but it helps in generating revenue because it is another thing that we can add to contracts to help our clients be more secure. I do not do the finances for the company, but I know it produces revenue because we are keeping the product.

ThreatLocker Zero Trust Endpoint Protection Platform is great for blocking access to unauthorized applications. We test it for when we need it. We have never come across any issues. Cyber Heroes are great. They resolve many issues that we find in a matter of minutes.

What is most valuable?

I really enjoy ringfencing and elevation features. It makes my life easier because I do not have to get on a computer to elevate a prompt to allow users to run something they run every day as an admin. 

What needs improvement?

They have a good foothold in the game right now. They are doing everything right, and as long as they keep improvising and adapting, they will continue to overcome. I cannot suggest anything that they are not already doing. They should keep adding features as they have been.

For how long have I used the solution?

We have used the solution for a little bit over a year.

What do I think about the stability of the solution?

It is excellent. They are constantly pushing out updates. They are always putting out webinars and keeping everyone informed. They are great.

What do I think about the scalability of the solution?

Scalability is easy. Their policies, the grouping of the policies, and the way the hierarchy works for all of their policies are excellent.

How are customer service and support?

The customer service is a ten out of ten. It cannot get better.

How would you rate customer service and support?

Positive

Which solution did I use previously and why did I switch?

We did not use any previous solutions.

How was the initial setup?

We have a hybrid environment. We are an MSP, and we have 40 different clients. We adopt the environment they come with. We use Microsoft Azure Cloud.

The setup was easy. It was just deploying the agent and letting it learn for 21 days. It then just goes, and you do not hear much from it after that. It is super simple. The only time you hear from it after that is when there is a new application or it is not a built-in.

What about the implementation team?

We have a technical representative from ThreatLocker who assists us.

What was our ROI?

It is the fact that I am sleeping at night. I know that my systems are secure. They are not going anywhere. Nothing is happening to them. Any policy I put in place is a policy that stays in place, and it knows it is going to protect my system.

What other advice do I have?

It is a great platform all around. It has great support. People developing it know what they are doing. They see a future. They see a path, and they are going down it. I like it. I like what I see. 

Overall, I would rate ThreatLocker Zero Trust Endpoint Protection Platform a ten out of ten.

Disclosure: My company has a business relationship with this vendor other than being a customer. Reseller
PeerSpot user
System Administrator at a non-tech company with 1-10 employees
Real User
Top 10
Feb 23, 2025
Provides centralized management and consolidation of security products
Pros and Cons
  • "It is a comprehensive platform that allows you to do a lot of things."
  • "Customer service is good. The Cyber Hero program ensures there is always someone available to help."
  • "The company should strive to stay ahead of all the developments happening externally. If their progress accelerates more rapidly than the ongoing changes outside, it would prove advantageous."
  • "It has not helped reduce our help desk tickets. We are still in learning mode, and after we are fully knowledgeable, we will be able to see some ticket reductions."

What is our primary use case?

We have deployed it across many clients, including a major client in the caretaking business. They need to be protected well. I am quite satisfied with the product.

I use the product to monitor what users can or cannot do, with variations for each type of customer. We are starting to consolidate all clients into one comprehensive map.

How has it helped my organization?

The portal is easy to use and provides a centralized region for management, which is beneficial.

It helped us to consolidate security products. We previously worked with another product but switched to ThreatLocker. It eliminated the need for another product, as ThreatLocker combines multiple functionalities. We used to have antivirus, but if you can block computers from doing anything, the virus has no chance or very little chance.

What is most valuable?

The endpoint protection itself is very valuable because that is the primary feature I am using. We deal with a lot of users who are not always aware of what they are doing while using their computers for business. In the caretaking business, you have several people who are not IT-minded. Phishing emails or things like that can happen very easily.

It is a comprehensive platform that allows you to do a lot of things. We are not using all the things yet, but it keeps our clients safe, which is the main service we aim to deliver as an IT partner.

What needs improvement?

The company should strive to stay ahead of all the developments happening externally. If their progress accelerates more rapidly than the ongoing changes outside, it would prove advantageous.

For how long have I used the solution?

I have been using the solution for more than a year. 

What do I think about the stability of the solution?

The stability is satisfactory.

What do I think about the scalability of the solution?

It is scalable.

How are customer service and support?

Customer service is good. The Cyber Hero program ensures there is always someone available to help. It was one of the reasons to go with this solution.

How would you rate customer service and support?

Positive

Which solution did I use previously and why did I switch?

We worked with Enable. We changed it because our company saw ThreatLocker at a convention. They were convinced that the product would do better.

How was the initial setup?

The setup was straightforward. We utilized another platform to deploy ThreatLocker, and this eased the process.

What about the implementation team?

We implemented it ourselves.

What's my experience with pricing, setup cost, and licensing?

I do not deal with pricing, but I assume it is cost-effective for us. We choose a solution based on functionality and affordability.

Which other solutions did I evaluate?

We did not evaluate other products.

What other advice do I have?

It is easy to use, but we are having some difficulties as we are still learning how to best deploy it for our customers and adjust the endpoints so that they can work efficiently and do whatever they need to do. Even though you put machines in learning mode, it requires finetuning. For some business clients, it is okay, but other clients, particularly the smaller ones, have to be able to do a lot of things. It can be difficult to have that balance.

It has not helped reduce our help desk tickets. We are still in learning mode, and after we are fully knowledgeable, we will be able to see some ticket reductions.

I would rate it eight out of ten. Nobody deserves a ten.

Which deployment model are you using for this solution?

Public Cloud

If public cloud, private cloud, or hybrid cloud, which cloud provider do you use?

Microsoft Azure
Disclosure: My company does not have a business relationship with this vendor other than being a customer.
PeerSpot user
reviewer2594715 - PeerSpot reviewer
IMS ENGINEER at a tech vendor with 1,001-5,000 employees
Real User
Top 20
Nov 24, 2024
Comprehensive endpoint security with real-time protection
Pros and Cons
  • "ThreatLocker's most valuable feature is its scanning capability, which executes all types of executable files."
  • "ThreatLocker has significantly improved numerous techniques that mitigate vulnerabilities and viruses initiated on the back end of a network."
  • "ThreatLocker would benefit from incorporating an antivirus feature or comprehensive 24-hour log monitoring, a valuable enhancement for both business and enterprise-level users."
  • "ThreatLocker's technical support process could be streamlined by reducing the number of steps required to reach a human agent."

What is our primary use case?

We are a managed service provider offering comprehensive network and security monitoring for other service providers. We remotely monitor our clients' systems, many of which utilize ThreatLocker. This application allows us to provide end-to-end technical support, including proactive protection against malicious scripts and applications. ThreatLocker prevents unauthorized installations and execution of potentially harmful programs, such as PowerShell or CMD scripts, by blocking them in real-time. Essentially, it's a comprehensive security application that logs events, captures data, and aids in recovery and analysis, enabling us to understand and respond to security incidents effectively.

We have deployed ThreatLocker in the Azure and AWS clouds for some of our customers, while others utilize it in a hybrid model.

How has it helped my organization?

Administrators can easily approve or deny requests using their ThreatLocker allow list. With full access, an administrator can enable learning mode or create exclusions for any user, allowing them to execute specific files or actions within their user space.

The software provides superior visibility into end-user software approval requests compared to other EDR applications I've encountered. Real-time scanning is available when an exclusion occurs, and the software captures comprehensive logs of all activity on the machine.

We use allowlisting once a user access request is submitted. We verify the reason for the request and, once verified, we send an email notification to the requesting user. After approval through the ThreatLocker console, the user can access and execute the requested resources.

ThreatLocker has significantly improved numerous techniques that mitigate vulnerabilities and viruses initiated on the back end of a network. This prevents recurring attacks that utilize script files or various hacking methods by stopping them at the network level.

Previously, users with installation privileges often installed various third-party applications without oversight. ThreatLocker prevents unauthorized application execution, requiring users to submit installation requests. Since most users are reluctant to request third-party applications, this policy significantly reduces the volume of help desk tickets related to software installation and troubleshooting.

ThreatLocker helps consolidate applications and tools.

What is most valuable?

ThreatLocker's most valuable feature is its scanning capability, which executes all types of executable files. Rather than denying specific applications, it denies all applications originating from the back end, providing comprehensive protection.

What needs improvement?

ThreatLocker would benefit from incorporating an antivirus feature or comprehensive 24-hour log monitoring, a valuable enhancement for both business and enterprise-level users.

For how long have I used the solution?

I have been using ThreatLocker Protect for approximately seven to nine months.

What do I think about the stability of the solution?

I haven't experienced any performance or stability issues with ThreatLocker.

What do I think about the scalability of the solution?

ThreatLocker is highly scalable and useful for real-time protection.

How are customer service and support?

ThreatLocker's technical support process could be streamlined by reducing the number of steps required to reach a human agent. Currently, users must navigate through multiple chatbot interactions before being connected, which can be time-consuming and frustrating.

How would you rate customer service and support?

Neutral

How was the initial setup?

The initial setup involves deploying the solution through an agent procedure within cloud platforms. Configuration is done according to system administrator instructions, and policies are set accordingly.

What about the implementation team?

A team of five is involved in deploying and configuring ThreatLocker, as well as monitoring its use.

What was our ROI?

The measurable benefits of using ThreatLocker include ensuring real-time protection of organizational resources and maintaining user authentication and protection levels to reduce risks. It fosters business growth by securing the business module.

What other advice do I have?

I rate ThreatLocker Protect eight out of ten.

There is no maintenance required by the customers.

The endpoint value typically falls within the range of 300 to 450 per MSP, although this can vary depending on the client. Larger enterprise-level clients may have up to 500 endpoints.

I recommend purchasing the exact number of agent subscriptions needed for the environment to avoid unnecessary expenditures.

Which deployment model are you using for this solution?

Hybrid Cloud

If public cloud, private cloud, or hybrid cloud, which cloud provider do you use?

Microsoft Azure
Disclosure: PeerSpot contacted the reviewer to collect the review and to validate authenticity. The reviewer was referred by the vendor, but the review is not subject to editing or approval by the vendor. The reviewer's company has a business relationship with this vendor other than being a customer: MSP
PeerSpot user
IT Analyst at a computer software company with 51-200 employees
Real User
Top 10
Feb 14, 2024
The software is incredibly intuitive and easy to use, even for non-technical users
Pros and Cons
  • "The interface is clean and well-organized, making it simple to navigate and find what we need."
  • "The snapshots used in the ThreatLocker University portal are outdated snippets and have not been updated in conjunction with the portal itself."

What is our primary use case?

I am one of two internal support staff for our company of approximately 60 employees. We manage roughly 80 devices, including servers and similar equipment, and utilize ThreatLocker Protect for internal support only. We do not resell this product.

How has it helped my organization?

Approving or denying software requests is a simple process for administrators. We have a well-defined workflow, and one of the most convenient aspects is how it handles individual user and computer requests. The beauty of ThreatLocker Protect lies in its ability to approve individual requests while also offering broader deployment options. For example, if a work operation requires specific software and John Smith initiates the request, I can not only approve it for him but also wildcard it. This means that if another member of the same team or someone else in the company wants the same software, they don't need to submit a new request; it's automatically approved based on the initial approval for John Smith. This saves everyone time and simplifies the process.

The visibility into software requests from users is perfect.

We leverage ThreatLocker's Ringfencing technology, which has proven highly effective in our security strategy. While it allows us to whitelist specific applications, it critically prevents those applications from exceeding their authorized access. Even if an approved program theoretically could access PowerShell, the command line, Regedit, or other restricted features, Ringfencing intervenes and blocks such attempts. This granular control is crucial for maintaining a strong security posture.

The need for establishing trust for every access request, regardless of its origin, is crucial. Before implementing ThreatLocker, we faced a significant issue. A department member needed a specific program, so he downloaded it from a third-party site instead of the official source. Unfortunately, the site was riddled with malware. Unaware of this danger, he downloaded and installed the program. Three of us spent two days not just cleaning up the mess, but also verifying that the malware hadn't infiltrated our network. This is where ThreatLocker shines. Even if a trusted program like "Program A" is installed from the official source, ThreatLocker can be configured to only allow future requests from the program's parent company with a valid signed certificate. Any request for the same program from an unauthorized third-party source with an unverified certificate gets automatically blocked. This is truly a powerful feature.

ThreatLocker Protect has significantly reduced our help desk tickets. We used to be bombarded with repetitive requests, particularly software update approvals. The ability to use wildcards for both users and versions in ThreatLocker is fantastic. Previously, when new versions of software were released (e.g., Software A version 1.1), we'd receive up to 15 separate requests for approval. Thankfully, ThreatLocker allows us to whitelist both users and versions. Once we approve Software A from the authorized vendor for version 1.0, we can create a wildcard rule that automatically approves future updates (1.1, 1.2, etc.) from the same vendor. This eliminates the need for manual intervention, saving me an incredible 80 percent of my time. ThreatLocker Protect is truly a game-changer!

ThreatLocker Protect helps our staff focus on other projects.

We saw the value of ThreatLocker Protect shortly after deployment, but it's important to understand how the initial stage works. After signing up and installing the program, the machines enter a learning mode. During this period, ThreatLocker observes and analyzes the software on our devices, identifying common applications and their components (DLLs and EXEs). This learning phase typically lasts around 30 days. While we might not see immediate results during learning mode, it's crucial as it lays the foundation for secure operation. Our first audit review, conducted ten days after deployment, revealed a large number of identified applications because the system was still learning. However, our assigned systems engineer provided excellent explanations and handled the back-end processes seamlessly, eliminating the need for manual intervention. This is one of the program's key strengths. While ten days might seem like a short time to realize the value, it's important to remember the learning phase is essential for effective protection. The automatic learning environment and subsequent transition to secure mode ensure a smooth and efficient deployment process.

What is most valuable?

I'm deeply impressed with ThreatLocker Protect, and I've been in IT for over 40 years, including four years as a school administrator and teacher. The software is incredibly intuitive and easy to use, even for non-technical users. The interface is clean and well-organized, making it simple to navigate and find what we need. The support team is truly exceptional. They are responsive, knowledgeable, and genuinely helpful. Whether it's a quick question or a complex issue, they are always available to assist. My wait time has never exceeded 15 seconds, and resolutions are typically within five minutes. They even offer regular audit reviews to proactively identify and address any potential problems. ThreatLocker University provides comprehensive, self-paced training that is easy to follow and understand. It empowers users to effectively utilize the software and maximize its benefits. Overall, ThreatLocker Protect stands out for its intuitive design, exceptional support, and comprehensive training. It's a fantastic product backed by a remarkable company culture, making it a true pleasure to use.

What needs improvement?

The snapshots used in the ThreatLocker University portal are outdated snippets and have not been updated in conjunction with the portal itself.

For how long have I used the solution?

I have been using ThreatLocker Protect for two years.

What do I think about the stability of the solution?

We have never had stability issues with ThreatLocker Protect.

What do I think about the scalability of the solution?

ThreatLocker Protect is easily scalable.

How are customer service and support?

The technical support is great.

How would you rate customer service and support?

Positive

How was the initial setup?

Deploying ThreatLocker was surprisingly straightforward. Their documentation guides users through the process clearly, offering multiple options for deployment. From traditional MSI installers to EFCs, users have the flexibility to choose the method that best suits their needs.

It took just five minutes to deploy the software on a single machine. However, for the network-wide rollout, we opted for a cautious, phased approach to minimize potential conflicts. Out of our 60 machines, we selected 10-15 users or computers as a test group. After pushing the update to this initial group, we monitored closely for any red flags or issues. As no problems arose, we gradually added more computers to the deployment in 15-user increments until everyone was covered. This approach, while slower, allowed us to identify and address any potential issues before impacting the entire network.

While two of us were involved in the deployment planning, the actual execution was carried out by one individual. Once they started rolling out the machines, I joined in to monitor the results and provide support. It's worth noting that this single person successfully deployed the software to 60 machines.

What about the implementation team?

The implementation was completed in-house.

What's my experience with pricing, setup cost, and licensing?

ThreatLocker's pricing seems justifiable. We get a lot of value for what we pay, with excellent support, the program itself, and everything related to it being top-notch. If my CTO ever suggested dropping it due to budget constraints, I'd be concerned. While I don't have access to the exact cost, even if it was around five thousand dollars annually, I'd suggest reallocating that amount from my salary to keep ThreatLocker Protect. That's how strongly I believe in the program's effectiveness.

What other advice do I have?

I would rate ThreatLocker Protect ten out of ten.

ThreatLocker Protect is not a significant CPU consumer. We've had it for over three years, and while there have been a few minor conflicts with other programs, they were easily resolved. This is to be expected with any software.

I have a biweekly call with an analyst from ThreatLocker, and they treat our organization, which has only 60 computers, the same way they treat businesses with 4,000 computers.

ThreatLocker Protect is incredibly easy to install. I highly recommend engaging their system engineer for assistance. Don't hesitate to reach out with any questions, no matter how simple they may seem. The ThreatLocker support team is known for its patience and willingness to help. They're happy to answer anything you ask, regardless of your initial perception of the question's importance. So, feel free to be open and honest with them; they'll treat you with the utmost respect.

Which deployment model are you using for this solution?

Private Cloud

If public cloud, private cloud, or hybrid cloud, which cloud provider do you use?

Other
Disclosure: PeerSpot contacted the reviewer to collect the review and to validate authenticity. The reviewer was referred by the vendor, but the review is not subject to editing or approval by the vendor.
PeerSpot user
Real User
Top 20
Mar 2, 2025
Zero Trust factor and Cyber Hero support make it a great solution
Pros and Cons
  • "The Zero Trust factor is valuable because it blocks everything. That helps us to stay ahead of bad actors. We do not have to be in recovery mode."
  • "I would rate it a ten out of ten."
  • "I have no complaints, but a little bit more Mac support would be great."
  • "It has not reduced helpdesk tickets. It has probably increased them by blocking applications and doing its job, resulting in people raising more tickets to know why they cannot use certain things."

What is our primary use case?

I primarily use it for protecting my clients.

How has it helped my organization?

I can sleep well at night. At the end of the day, it provides me with peace of mind.

It has helped to eliminate other security solutions. We do not need as many. We do not use many because we can trust the solution. We were using Sophos. That is completely gone. We are using Penetrates as well because it works very well with ThreatLocker.

It has been great at blocking access to unauthorized applications. It is almost perfect. We deal with developers who use a lot of tools. From a security standpoint, it is very important because we know what is going on. It gives us more visibility.

It has not reduced helpdesk tickets. It has probably increased them by blocking applications and doing its job, resulting in people raising more tickets to know why they cannot use certain things.

It has not freed up the IT team’s time for other projects or tasks, but it is doing its job. It is a good one.

What is most valuable?

The Zero Trust factor is valuable because it blocks everything. That helps us to stay ahead of bad actors. We do not have to be in recovery mode. 

It is light. It does not give that weird heaviness. It just works. 

What needs improvement?

So far, it has been great. The Cyber Hero support system is excellent. I have no complaints, but a little bit more Mac support would be great.

It is very easy, but having a dashboard so that we can visualize more might be helpful.

For how long have I used the solution?

I have used the solution for about a year.

What do I think about the stability of the solution?

It is great. We have had no issues so far.

What do I think about the scalability of the solution?

It seems great, but we are still growing. We will know in a year.

How are customer service and support?

Cyber Hero's support is excellent, allowing me to talk to a live person, which is significant. It has been amazing.

How would you rate customer service and support?

Positive

Which solution did I use previously and why did I switch?

We had a bad experience with Sophos. We have industrial printers that we use, and they would just lock in. There was no visibility. We did contact Sophos, but they did not have any solution. The manufacturer also did not have a solution. We just could not figure it out. It was hindering the production.

How was the initial setup?

The initial setup was seamless and very easy. We use Datto RMM.

What about the implementation team?

We implemented it ourselves.

What was our ROI?

We are still small. We are still growing, so we are not at the stage to know about the ROI or any reductions in the operational costs.

What's my experience with pricing, setup cost, and licensing?

So far, it has been great. I have no complaints. Of course, everybody wishes it was cheaper.

What other advice do I have?

It does what it is supposed to do. Just knowing that it works as intended is reassuring. There are a lot of other EDR software, but you do not know if they are doing their job. With ThreatLocker, I can tell that it works.

I would rate it a ten out of ten.

Which deployment model are you using for this solution?

Public Cloud

If public cloud, private cloud, or hybrid cloud, which cloud provider do you use?

Amazon Web Services (AWS)
Disclosure: My company has a business relationship with this vendor other than being a customer. Reseller
PeerSpot user
Buyer's Guide
Download our free ThreatLocker Zero Trust Endpoint Protection Platform Report and get advice and tips from experienced pros sharing their opinions.
Updated: January 2026
Buyer's Guide
Download our free ThreatLocker Zero Trust Endpoint Protection Platform Report and get advice and tips from experienced pros sharing their opinions.