What is our primary use case?
We use ThreatLocker Protect along with ringfencing and elevation.
We include it as part of our managed service for our clients. Our clients are aware of the tool, but they are not buying it. We package it as a part of a service.
How has it helped my organization?
When we look at security on the endpoint, there are two parts to it. One is blocking known bad things and then setting an allowlist for the things that you want to run. Defining allowlisting reduces the attack surface just to the known good applications. It also reduces the number of false positives that we need to chase when it comes to things that hit our endpoint detection or response, which is more of our known bad or behavioral-based security endpoint. So, we pair the two together.
Allowlisting helps to keep the environment clean. More and more applications do not require admin rights to install. Even if you limit the ability for a user to install applications, they can still run some things on their own such as browser plugins. We know that browser plugins can be potentially very dangerous because they sit in a browser, and that is where most people do their work. They can become a problem. Allowlisting helps to put guardrails around what is allowed to run. By keeping the environment clean, the programs perform better. They are more secure, and there is less noise for us to chase when it comes to actual security events.
It is easy for administrators to approve or deny requests using allowlisting. They have two ways for administrators to approve or deny requests. They can do it in a managed way, where they do it for you using Cyber Hero. We do not do it that way. We are an old customer of ThreatLocker. We have been using it before they had Cyber Hero in place. Originally, we thought it was going to be problematic because allowlisting tends to be very hard to implement. Most of the other allowlisting systems, such as Microsoft's AppLocker, are very difficult to implement and maintain, but ThreatLocker does two things. When it comes to very common applications, they work with vendors. They are always looking at the new installations and making sure they are constantly up to date, so you do not have to always approve those things. But, of course, things happen, and sometimes they happen in the middle of the night when somebody is doing something and needs help. The nice thing about it is that it is fairly easy to approve. We can approve even with a mobile app. I have had the ThreatLocker mobile app since they introduced it a year or two years ago. If one of our clients in Australia or somewhere else is doing something, I can easily approve it without having to get up from my chair. I can approve it after doing a quick review of what they are installing. If I want to do a little bit deeper check, I can do that, but most of the time, there are just basic things, and we can approve them on the fly. The portal gives us a lot of granularity in terms of not only approvals but also how to approve them. We can choose to approve something for a person, the entire company, or all of our clients. We can choose to approve only the hash or a particular version of a particular executable or any application that is signed by a company. We can define how loose or tight we want to be when it comes to certain applications. They have recently also introduced time-based approval. We can give approval for only a period of time, and then the approval goes away. If somebody needs to run something, but we do not want it to be allowed to run for a long period of time, we can implement that.
In terms of access requests, we control what is allowed and what is not allowed. They have curated things on our behalf for Windows, Office, Chrome, Firefox, and a whole slew of other applications, but you do not have to add those. You can curate your own list. For example, we have an engineering company, and the applications that they use are not used by anybody else. They are very bespoke for their specific industry. We get new requests from them all the time. We check if it is something that looks nefarious. Is it on VirusTotal? Are there any other scans that show that it could be potentially malicious? If we are still not sure, ThreatLocker now has a sandboxing feature where we can watch the application execute in a secure environment and see if it is doing anything potentially bad and if it is touching files that it should not be touching. By doing that, we have some more comfort. We know that the program we are allowing is safe.
We were able to see some of its benefits immediately and some were over time. We were using an EDR tool before ThreatLocker about six years ago. It was very noisy. A lot of alerts came up on that EDR. We were chasing a lot of ghosts, trying to figure out whether it was malicious or not. A lot of it was not malicious, but we still had to do all that checking. When we put ThreatLocker in place, one of the things that we immediately noticed was that it was blocking everything by default and only allowing things that we approved. It reduced the ticket noise. We mostly had things that needed investigation and more likely were malicious and needed to be reviewed. That was an immediate change. Over time, we got other benefits. We got a better grasp of what is being run on our clients' desktops. In the rare cases where because of the nature of their work, we allow them to have admin rights, we can still control what applications are being installed. Could they bypass it? Potentially and theoretically, yes, but that would be very difficult and require some technical skill. We at least have some verification of what applications are run and what applications are allowed. So, its long-term benefit was much more control over the clients' environments and the short-term or immediate benefit was a reduction in ticket noise that we were having to deal with chasing a lot of false positive alerts.
Allowlisting helped us reduce our organization’s help desk tickets. We were able to reduce our security alerts by 75% to 85% after its implementation, and now, it is practically down to zero. We have very few alerts that we need to chase at this point.
Allowlisting has technically helped us to free up help desk staff for other projects, but we have not quantified the savings. Because we are not having to do these other things, we are able to work on helping clients and get their work done better rather than just chasing security events.
Allowlisting has not helped us consolidate applications and tools because our usage is quite narrow. We are just using allowlisting, ringfencing, and a little bit of elevation. They have other products in their mix, but we already have other products that do some of those things. I do not see us necessarily replacing all of that with other parts of ThreatLocker, so there is no tool reduction. However, it fits nicely into our workflows. In other words, it integrates into our PSA. Tickets come in there, and from there, we can go directly to ThreatLocker and do approvals. We also have the pop-ups on the mobile device.
What is most valuable?
Allowlisting, in general, is valuable because it allows us to have a lot more granular control over what is executed on a desktop. We are also able to ringfence known vectors of attack through Office applications, email, browsers, etc. By doing that, we can also limit the exposure of those applications for the company. This encapsulates how we are trying to protect the clients. We can tell them the applications that they need to run and what they are allowed to do, and that is it.
What needs improvement?
It would be beneficial to have a tighter integration into PSA systems so that approvals can be done directly without having to leave the PSA.
Additionally, having their Cyber Hero support available during non-working hours could improve service for clients. They have a managed version of allowlisting with Cyber Hero so that their Cyber Heroes can approve things. It would be nice if I could implement that during the hours we are not working so that clients who work during our night would have a better experience and do not have to wait till morning to get their applications approved.
For how long have I used the solution?
I started Triada Networks in 2008, which makes it 16 years. However, we started using ThreatLocker about six years ago.
What do I think about the stability of the solution?
We have had very few stability issues. Occasionally, the portal has become unresponsive, but the product itself continues to function without interruption. I do not remember the last time that happened. It was maybe about two years ago. They have fairly solidly developed this product.
What do I think about the scalability of the solution?
We have not encountered any scalability issues. I know colleagues with thousands of endpoints on ThreatLocker with no reported problems. I do not anticipate having scalability problems at all.
How are customer service and support?
To contact ThreatLocker, we go through their chat service. They have a live chat where they typically get somebody on in a minute or two. They always have somebody who is available and starts to work with us on any issues. We had to contact them more frequently when we were learning ThreatLocker Protect and ran into weird issues, but we do not contact them too often now just because we are managing it ourselves. Once in a while, we do get their support. They are very fast and helpful regardless of what time it is.
Their support is a ten out of ten. They are one of the best support teams that we run into product-wise. I do not give that rating lightly. Most of our vendors are in the six or seven range. ThreatLocker does an exceptional job when it comes to support.
How would you rate customer service and support?
How was the initial setup?
The management console is in the cloud, and the endpoint agent is on the device.
Its deployment was very easy. They provided installation scripts for Windows. We were easily able to put it into our RMM tool and deploy it to the devices of our clients. In fact, we do that today when we onboard a new client. As soon as our RMM agent is installed, one of the first things that gets installed in that stack is ThreatLocker, so we have it automated so that as soon as a client is onboarded or we install a new PC, ThreatLocker gets installed.
We deployed it client by client. We were onboarded very early. We would do one client a month and ramp that up until we got to month three, and then we deployed everything else. That was the process. In about three months, we were comfortable enough with the platform that we were able to manage it going forward on our own. After 90 days, we went to town and deployed the rest of our fleet. It was en masse at that point.
What about the implementation team?
The implementation was done in-house with support from ThreatLocker during onboarding. We had a couple of weekly or biweekly sessions to learn troubleshooting and approvals.
Of course, things have changed since then, so you learn those along the way. One good thing they do is that once a quarter, they do a check-in with their technical account manager. We go over any issues or things that we would like to bring up. They do a nice job of taking that information back to their development team or their product teams to make adjustments in the solution over time.
What's my experience with pricing, setup cost, and licensing?
Its price is fair. They have added some additional things to it beyond allowlisting. They are up-charging for them, but in terms of the value we get and the way it impacts us, we get a bang for our buck with ThreatLocker than a lot of our other security tools. We have a few tools that would fit into that category, but then there are some that are more expensive than they need to be. ThreatLocker is definitely not one of them.
It is one of the reasons why we have eliminated other tools, but ThreatLocker has not necessarily replaced them. It was because ThreatLocker and some of our other things were doing so much that we did not necessarily need them. We were able to remove that redundancy. So, its price is fair. Hopefully, they do not take this to raise their prices.
Which other solutions did I evaluate?
We looked at Microsoft AppLocker but found it difficult to manage and maintain. We also considered Airlock Digital and other security tools but found that they lacked the ability to manage at scale. That is what ThreatLocker does very well. We are a small team. We are managing 400 or so computers with a small staff, and we are still able to do that because the tools do a lot of the heavy lifting for us. If we had to do that with AppLocker, AirLock Digital, or any other security tools, it would have been a lot more time-consuming. We probably would have needed more staff to do that.
When we went with ThreatLocker, there were not a lot of allowlisting companies out there. Some of them were more enterprise and mid-market. The concept of ringfencing was not the one that the others were even talking about.
When we are at a conference or business meeting, a lot of times we do a hacker demo. Usually, the demo involves a Word document that downloads something malicious or runs something malicious that gives you backdoor access. Ringfencing is designed to prevent that from happening. When you have a Word document, Word does not need to execute other programs. Chrome does not need to execute other programs. Excel does not need to execute other programs. Excel does not need to beacon out and connect to the Internet. Locking these little avenues greatly diminishes your chances of getting compromised. Nothing is 100%, but controlling what each application can do can make everything work better.
What other advice do I have?
I would rate ThreatLocker Protect a ten out of ten. It is a great product. At times, it might block something, and we are not aware that it is being blocked and are trying to troubleshoot something. It is one of those things that we always have to remember. We bring up ThreatLocker and see if something is going on. In the past, we had to go to the portal, and there was a delay by the time that the agent would report to the portal for that information, but now, we have the ability to, at least on the device, see in real-time what is happening so that we can troubleshoot it and more. We just need to check this, but it is solid. It would probably be one of the last tools that we would remove if we ever remove anything.
Disclosure: My company has a business relationship with this vendor other than being a customer. Partner
