What is our primary use case?
We have been using the solution for about five years now. We started shortly after our company was acquired by an ISP that was looking for a managed services provider solution. I was looking at our stack and deciding which one would answer the pressing questions, which usually involved cyber insurance questions, such as if we have application whitelisting. I happened to call ThreatLocker and fell in love with the offerings. At the time, it had application control, ringfencing, and elevation. They have, of course, advanced their platform a lot since then.
How has it helped my organization?
The biggest benefit is application whitelisting. We have customers who have a set of products that they expect their users to use, and we have the ability to enforce that policy by restricting them from adding additional software on their own. It helps reduce the risk of the shadow IT type of solutions being brought in by users who think they know better or do not realize the risks.
In the beginning, it was almost an augmentation to antivirus, but now, antivirus is almost an augmentation to Zero Trust. If the applications do not run, the antivirus does not have to block them, so the antivirus is almost the second layer. With the layered protection approach, it is one of our key layers at the endpoint to keep the endpoint from running ransomware or unknown software packages.
A number of times, we have had customers who did not see the need for it until the first time we called them and said, "Hey, did you realize so-and-so wants to run this application?" and they went, "Why would they be doing that?" The ability for us to let the end-users or customers know the things going on in their environment and to stop attacks dead in their tracks has been great. We have seen it multiple times where a bad actor would have gotten a whole lot further along if they had been able to run the software they wanted to. ThreatLocker stopped that.
It is not hard to use, but it also depends on the customer base that you are working with. It can be a challenge to educate the end user and the customer with regard to why this is the right answer. A lot of times, if you have customers who have older applications, custom-written applications, and things like that, dealing with updates and dealing with changes can be time-consuming. It is not hard. None of it is particularly difficult, but it can be a bit of a draw on time.
We have been able to do consolidation primarily in the antivirus realm. Because of the fact that the applications are never allowed to run, we have been able to reduce some of our costs by not having to go to top-line AVs. We can go to Windows Defender, which is a good antivirus, but it is not centrally-managed SentinelOne or something like that. We have been able to see some big advantages in cutting back. Some of the other tools do not have to carry the heavy load. ThreatLocker carries a heavier load of protection.
I do not know if it has helped our organization save on operational costs or expenses. It has to be manned by people. We are not using the functionality where ThreatLocker Cyber Heroes respond to the tickets. Instead of hiring two people, if we let ThreatLocker manage that, we would see some definite advantages cost-wise.
It is priceless in its ability to block access to unauthorized applications. We have had everything from attacks on financial institutions to shutdown holds where the attacker was about to exfiltrate four years of data, but the PowerShell script was still sitting on the screen, unable to run because ThreatLocker blocked it. It is well worth it.
It has helped reduce help desk tickets because we get a lot fewer situations where end users are running software that they should not be and are causing conflicts with the business protection software. There are a lot fewer situations where someone is compromising the machine.
We run on a very lean team, and we have been able to maintain that status reasonably well because, with ThreatLocker, we do not have to chase things that cannot happen.
What is most valuable?
All the features are very useful. The biggest one that we focus on is the application control with ringfencing. That combination is very beneficial. We have had some recent benefits. Especially with the elevation functionality, we could remove the local admin requirement for applications that constantly required us to make users local admins on their machines. We take that risk away with elevation control, where we can elevate applications that need elevation instead of all of them.
What needs improvement?
Their product is solid. I have a hard time complaining much about it because when we do find little things, they are usually interface-related or related to things that would be nice to have. Their idea portal, unlike so many other vendors we deal with, shows movement. At least four to eight features of ThreatLocker exist because I made a request in the last five years, and it became a feature of the actual product. When it comes to improvements, we moved the product as customers, and we got to move the product by making suggestions. They seem to be very reactive to it, so there is not a whole lot that they actively need to change right now. It is one of those situations where when we run into something that would be nice to have, it happens. They make it work.
For how long have I used the solution?
We have used the solution for about five years.
What do I think about the stability of the solution?
The product is highly stable. Obviously, as they add features, every once in a while, there is something that catches us off guard, and we will have to get support. They have the answers right then and there. As a result, it has never been something that has brought us down. We have never had a customer who is down because ThreatLocker is not working. By the nature of what it does, it could be a big problem for a customer, but we have never had it. It has been stable. For five years, we have not had a problem. Customers cannot do what they want to be able to do within reason, and we have never had ThreatLocker be the cause of that.
What do I think about the scalability of the solution?
The solution is very scalable. We started with just our office, and now we have over 3,000 endpoints on it. It scales up very easily. Once again, cloud deployment of the agents and everything else makes it very easy to add new computers to it. It is literally a matter of buying licenses, and it does not seem to care how big our environment is for the most part. The product just handles it.
How are customer service and support?
Their support is world-class. You cannot beat ThreatLocker support. I started a request at eleven at night, and someone started to chat within 30 seconds to a minute. They can easily go to Zoom for conferences and have conversations. Their answers are usually immediate, and if not, it is because they have to go to the engineering team for answers or solutions. If it is an actual feature problem or something like that, it is very fast. We have said more than once that if all of our vendors would act and support us like ThreatLocker does, we would be happy. It would be a perfect world. I would rate them a ten out of ten.
How would you rate customer service and support?
Which solution did I use previously and why did I switch?
This is the first time we have done application whitelisting. We brought it in about five years ago looking for an application whitelisting solution, so it was the start of our experience.
How was the initial setup?
We use our own RMM solution for deployment. The setup was definitely easy. Tech support provided us with the scripts and resources needed to push it. It is all pushed from PowerShell scripts, and that downloads straight from ThreatLocker, so we do not have to ever be on-site to do anything. When we are offboarding customers, it is just as easy. We can turn off the self-defense in ThreatLocker and run scripts to uninstall it. Generally, there is no on-premises requirement for it. From an MSP standpoint, it is truly cloud-managed.
What about the implementation team?
We contacted ThreatLocker directly.
What was our ROI?
From the reputation capability or the ability to show customers that we are doing what we say we do, the return on investment is immense. We also have customers who are frustrated because they cannot do what they used to do, which was run anything they wanted to. However, the first time we save them from something that would have been really bad had we not been there, that instantly changes.
What's my experience with pricing, setup cost, and licensing?
We have not had any real issues with the pricing. As they have added more features, due to the way our contracts are structured with our customers, we have had to hold off on adopting the new features because they do add costs. We have to be able to price them into our contracts. That has probably been our biggest challenge. Once we are in with a customer for one to three years on a contract, bringing in those new features at an additional cost is a challenge.
We are moving towards the Unified solution, where they basically bundle everything together, providing us better stability with the ability to bring in new product offerings without having to go back to the customer and say, "This is going to cost you."
Which other solutions did I evaluate?
We looked at a few others. A customer we had many years ago had brought a solution that I helped them with to some degree. I do not remember the name of it, as it was fifteen years ago. It was one of the early ones and was a management nightmare. The amount of effort and work it took to make it work and keep it working was a lot. Compared to that, ThreatLocker is amazing.
What other advice do I have?
Overall, I would rate it a solid nine out of ten. It is a complex solution if you are like me and do not necessarily want to call for help frequently. They have help available all the time and will walk you through the process of setting it up if you are trying to figure it out on your own. That is not going away, in my opinion. It is not really a bash against it; it is just a fact about ThreatLocker Zero Trust Endpoint Protection Platform.
Which deployment model are you using for this solution?
Public Cloud
If public cloud, private cloud, or hybrid cloud, which cloud provider do you use?
Other
Disclosure: My company does not have a business relationship with this vendor other than being a customer.