What is your primary use case for ThreatLocker Allowlisting?

My main use case for ThreatLocker Zero Trust Platform is that it helps to prevent somebody from accessing scripts. It will allow access if it is a valid one; otherwise, we can reject it. This helps to prevent a threat from the initial stage itself. For example, if an end user is running a script that came through email or was shared by someone, and that user has privileges, the script automatically accesses other systems once it runs and can corrupt them. For instance, if it is a ransomware attack, it will spread across the system and affect other machines as well. In those cases, if somebody is running a script that came through email or was shared by someone, it can be easily prevented. Additionally, if users are downloading torrent files from certain sites, those downloads will be blocked and immediately notified, which helps to prevent threats at the starting stages. We can do multiple things from ThreatLocker Zero Trust Platform. I can restrict people and restrict devices. We can enable certain features alone for end users, such as accessing an application in a shared environment. We can segregate user-specific things. It offers centralized management and is user-friendly to access the portal.

Our main purpose for using ThreatLocker Zero Trust Platform is blocking malicious files that affect our system. We use ThreatLocker Zero Trust Platform so it cannot execute any files related to malicious attacks or security threats that affect our system. ThreatLocker Zero Trust Platform operates under a zero tolerance policy, meaning no files can execute without approval. When our users are developing code, ThreatLocker Zero Trust Platform cannot execute DLL files without approving the projects. We can approve those projects, then the developer can complete their work. Otherwise, their work cannot be completed before approval. Our project developments already include blocking DLL files and blocking web browser security related to different links blocked by ThreatLocker Zero Trust Platform's web securities. The platform also blocks malicious links from executing files from where ThreatLocker Zero Trust Platform is installed. This is a very powerful tool for our company, which makes our organization more secure and more reliable.

My main use case for ThreatLocker Zero Trust Platform is that our organization is an MSP provider. We provide solutions and scripts to automate processes. Whenever ThreatLocker blocks anything, we become involved and have to whitelist and allow those scripts and URLs through ThreatLocker so nothing gets blocked on the machine. A specific example of when ThreatLocker blocked something is when I was working on an onboarding script for a client in which six software applications needed to be installed on the machine. ThreatLocker was blocking some of them, so I whitelisted our Proval certificate into ThreatLocker and added the certificate in PowerShell as well in those scripts. After the next run, all scripts ran fine. We can also add the file hashes of PowerShell in ThreatLocker to whitelist it. If we want to allow something for one time only, there is an option in ThreatLocker where all blockings are available for a single machine. We type the name of the machine and can see what has been blocked or permitted, and we just have to approve that. This is currently how we use ThreatLocker Zero Trust Platform. Moving forward, our organization is opting for this EDR for managing partners, and soon we will be handling EDRs from A to Z.

My main use case for ThreatLocker Zero Trust Platform is generally allow listing, elevation, and storage control.For example, in my day-to-day work, for storage control, whenever we have USB devices that we don't want production to use, we use the storage control. Whenever there is a shared folder that we don't want people to access, we use storage control. Allow listing is used so that people don't execute files that are not approved. This is zero trust—by default, everything is denied and we specify what we need to allow. Elevation is something I would like to add. The elevation control is very good. We use it all the time for those applications that require one-time admin privileges, such as QuickBooks. When you need to update QuickBooks, we use elevation so that users can run QuickBooks as an administrator and update it themselves. We use this for applications that require elevation or one-time elevation. My use cases for the data storage access control and storage control feature are mainly for storage, such as USB devices and shared folders.

I use ThreatLocker Zero Trust Platform for application control to manage any applications coming in and out. When a user clicks on an application they are not supposed to be using or accidentally downloads something from a website, ThreatLocker blocks it automatically. I appreciate the zero trust approach. I have policies in place that specify which applications are allowed and how they can be used, with applications ring-fenced accordingly. The application control feature works really well. When you run an application and it gets blocked automatically, it demonstrates the effectiveness of the solution.

My main use case for ThreatLocker Zero Trust Platform is blocking certain applications, running updates, and managing similar administrative tasks. A quick specific example of how I use ThreatLocker Zero Trust Platform to block applications or manage updates is that if there's an application that we no longer allow, we'll put it into the system and then it sends it out to the company. It can also do the same thing for updates.

My main use case for ThreatLocker Zero Trust Platform includes creating rules and approving software. Rule creation is mainly because ThreatLocker automatically creates blocks, so we create rules to allow legitimate software to be used in the company. Approvals occur when there is already a rule in place and we discover new software that needs to be allowed, so we go there and approve it.

My main use case for ThreatLocker Zero Trust Platform is to enroll devices and to implement policies for specific application blocking. A specific example of how I use ThreatLocker Zero Trust Platform for device enrollment and application blocking is that we have integrated it with our RMM tool, which is Datto RMM. Whenever we install the RMM agent on any device, it automatically enrolls into ThreatLocker Zero Trust Platform and the policies we have set on ThreatLocker Zero Trust Platform portal are automatically applied on the device. We are also exploring new features which can help us block ransomware attacks. We are still in the research and development phase, and if we find anything useful, we will definitely test it and implement it.

My main use case for ThreatLocker Zero Trust Platform is application control. I use application control with ThreatLocker Zero Trust Platform to avoid any malicious software being installed or any software outside the company's scope of workflow. I work with the client to make sure that their policies are tailored to what they need and ensure that any sketchy software reported through requests is brought to the attention of the point of contact to either create a policy or reject it.

My main use case for ThreatLocker Zero Trust Platform is deploying it to the servers and then maintaining accessibility from a user standpoint. When users try to access any file, I ensure that bypassing ThreatLocker is permitted and create policies for predefined scripts and tasks. For example, if there is a VBS script running on a system that the client customizes very often, I create a rule by full path instead of the hash. This ensures that whatever path is provided, if the file is being edited multiple times, it should not block it every time.

For day-to-day use of ThreatLocker Zero Trust Platform, we are ensuring that if there is a breach, attack, or anything that happens with our endpoint systems, we make sure that they are detected, remediated, and informed through the dashboard to the administrators so we can take quick action on them. If there is any incident, ThreatLocker Zero Trust Platform is our defense that provides an alert. Not only that, we are also using it for preventive measures, so it is not only corrective, but preventive measures are one of the very important aspects of ThreatLocker Zero Trust Platform that we will be using, which allows us to stop or block various websites or any objects. We are not using the endpoint feature of ThreatLocker Zero Trust Platform right now, which impacts our ability to manage network traffic across our endpoints and servers.

My main use case for ThreatLocker Zero Trust Platform is allow listing software, as well as Elevation Control and Storage Control. For a specific example of how I use allow listing or Elevation Control in my day-to-day work, I set a list of what software is allowed on our network computers and any software that is not those programs is simply not allowed to run. ThreatLocker makes that really easy to deploy.

ThreatLocker Zero Trust Platform's main use case for us was data storage access control.We used ThreatLocker Zero Trust Platform for identifying the most critical and sensitive information of the organization. We used controls, preventive controls, and restricted access to the employees. We monitored other high-sensitive information as well, such as data tracking to see where it goes. We used ThreatLocker Zero Trust Platform for external device management as well, but I do not have much experience from that module.

Our main use case for ThreatLocker Zero Trust Platform is to provide endpoint security and to control each and every application end-to-end that can run on the company's devices, primarily to secure company devices and prevent unauthorized software that may be downloaded by employees. Our main objective is to ensure that each device and each client is secured so they cannot download any third-party or unauthorized applications from the internet.

My main use case for ThreatLocker Zero Trust Platform is that it helps us with endpoint security platforms and unauthorized application and process running. It also helps us with storage control and elevations. I use ThreatLocker Zero Trust Platform for ransomware protection, such as when ransomware.encrypt.exe tries to execute and encrypt files. I also use it for server protection, only approving services and applications that can run in production on the server.

My main use case for ThreatLocker Zero Trust Platform is endpoint protection, a zero trust platform for applications, We use ThreatLocker Zero Trust Platform for application whitelisting and blacklisting for certain purposes on different machines and computers as a specific example of how we use it for one of those purposes.

I currently work in the Enterprise GitLab platform for Scania where we have a lot of users using our GitLab platform for code pull and push, and our main use case for ThreatLocker Zero Trust Platform was improving endpoint security and enforcing least privilege across cloud and engineering environments. I have used different tools earlier, but in this particular GitLab team, it's deployed on AWS and Kubernetes platform, AWS EKS, and it's an auto-scalable system. So we wanted stronger control over which applications and scripts or tools could run in production-related systems. ThreatLocker Zero Trust Platform helped us reduce operational risk by standardizing application control or limiting unnecessary privileged access. Since we are in cloud environments, it's a pretty common practice that people have more access than they need, and we wanted to bring that down to least privileges. That is why we searched for options and found this. A recent specific example of how ThreatLocker Zero Trust Platform helped us enforce least privilege or improve endpoint security in our environment is that we have a bunch of DevOps engineers working on the AWS setup, and some engineers occasionally needed elevated permissions for troubleshooting or deployments into production. For deployments, we generally use only pipelines, but for troubleshooting and fixing some things, we may need those elevated accesses. Before ThreatLocker Zero Trust Platform, there was more dependency on persistent admin access, with administrator role on AWS, providing access and then if you don't remove it, it stays there. That is called prolonged access. We don't want to have that. With ThreatLocker Zero Trust Platform, we were able to enforce more controlled and temporary privilege elevations while restricting unauthorized scripts and applications from running. That improved endpoint security and reduced our operational risks overall. ThreatLocker Zero Trust Platform fits into almost everything where we want least privileges, but I think this is one primary scenario for which we chose this particular tool.

My main use case for ThreatLocker Zero Trust Endpoint Protection Platform is to secure the server.A specific example of how I use ThreatLocker Zero Trust Endpoint Protection Platform to secure my server is that nobody can install any application without my permission, which is helpful. I use ThreatLocker Zero Trust Endpoint Protection Platform by installing it on every server to monitor it from the portal, where I can grant access if an application needs to be installed or deny it if it does not. This approach is helpful for us.

As the administrator for ThreatLocker Zero Trust Endpoint Protection Platform, I manage it, deploy it for new clients, and if someone installs an application that ThreatLocker stops, I have to allow that. So we can say I am the admin of ThreatLocker in my day-to-day life. Once, one of our big clients in the US installed a new application, but it was stopped by ThreatLocker. They emailed me that their application was not working, and then I reviewed it. I took approval from their senior managers before allowing that application in their environment, and afterward, I approved it. I just do daily tasks where I create policies for the applications they use. There are some generic applications which they use, so I create policies for them to ensure new users will not encounter issues. Sometimes, I have to approve applications, but I need to get approval from their manager or some senior engineer before real-time approval. Ring-Fencing technology helps me day-to-day by monitoring application behavior. If it thinks the application is malicious or has code that shouldn't run in the environment, it stops that. For example, if an SQL application throws some codes, and if the application stops working, we need to check why it stopped, and then we can approve it if it's justified.

We're a managed service provider, mostly dealing with small business office environments, so ThreatLocker Zero Trust Endpoint Protection Platform is used in the context of many different tools. It's a unification of several different tools. Their front and center is their Application Control, where I believe the older, less correct name for it would be application whitelisting. Basically, it ensures that nothing can run within a given environment. As long as the machine is protected by ThreatLocker Zero Trust Endpoint Protection Platform, nothing can run within an environment that is not considered kosher by the admin. If you don't allow it, it doesn't run with ThreatLocker Zero Trust Endpoint Protection Platform. It's as simple as that. I've had it block PowerShell scripts that my RMM has sent through. It's one of those things that in the moment, it's really annoying. However, the implication is that if that were anybody else, they wouldn't have been able to allow it.

I deploy it on every endpoint that I can, primarily focusing on application control, ring-fencing, and elevation control.

When we assessed application whitelisting and ringfencing controls, we decided to sign on with ThreatLocker. The way we operate our business is that it is deployed across all our clients. Once we identified the benefits of application whitelisting, we knew it belonged in every client's setup, and we implemented it for all our clients.

We use this solution for Zero Trust application installations, as well as ringfencing those applications and elevating administrative rights.

We work with small businesses, and we are slowly rolling it out. We have implemented ThreatLocker for about 30 clients to protect those who are habitual clickers and those with compliance demands.

Our use case involves endpoint protection, ensuring that nothing harmful reaches any of our clients' workstations.

We have deployed it across many clients, including a major client in the caretaking business. They need to be protected well. I am quite satisfied with the product. I use the product to monitor what users can or cannot do, with variations for each type of customer. We are starting to consolidate all clients into one comprehensive map.

We are a managed service provider offering comprehensive network and security monitoring for other service providers. We remotely monitor our clients' systems, many of which utilize ThreatLocker. This application allows us to provide end-to-end technical support, including proactive protection against malicious scripts and applications. ThreatLocker prevents unauthorized installations and execution of potentially harmful programs, such as PowerShell or CMD scripts, by blocking them in real-time. Essentially, it's a comprehensive security application that logs events, captures data, and aids in recovery and analysis, enabling us to understand and respond to security incidents effectively. We have deployed ThreatLocker in the Azure and AWS clouds for some of our customers, while others utilize it in a hybrid model.

We use ThreatLocker for application allowlisting to enhance security. This is particularly beneficial in school environments, where it prevents students from bypassing security measures by downloading unauthorized applications like VPNs and elevation control, enabling specific local users to gain temporary administrator privileges when running designated applications. ThreatLocker utilizes a cloud-based system where an agent is deployed on a server or workstation, either on-premise or in a cloud environment like Azure. This agent connects to the ThreatLocker cloud for management and security functionalities.

We use ThreatLocker Protect along with ringfencing and elevation. We include it as part of our managed service for our clients. Our clients are aware of the tool, but they are not buying it. We package it as a part of a service.

I primarily use the solution for access control. We have customers and even though there is an antivirus, sometimes users might open some unapproved files. This solution will flag them for approval or rejection.

I am one of two internal support staff for our company of approximately 60 employees. We manage roughly 80 devices, including servers and similar equipment, and utilize ThreatLocker Protect for internal support only. We do not resell this product.

Users submit applications for installation, and I typically review them, granting or denying access as needed. While the volume isn't high, ThreatLocker Protect provides significant peace of mind knowing users aren't installing unauthorized or malicious software. Our biggest challenge has been user errors causing support requests. To address this, I've implemented rules for applications frequently used in daily operations. It's had a learning curve, but the effectiveness has been noticeable.

We're an IT service provider that acts as an IT department for companies that don't have one. We take over a company's IT infrastructure, look after, manage, and secure it. ThreatLocker is a part of our security stack. We've got multiple products and vendors that we use, and ThreatLocker is a tool we provide to clients who need it. We use it to control access, block specific programs or activities, and manage things like USBs and other devices. For example, if no one's allowed to use the USB device on the computer, we can do that with ThreatLocker.

We provide IT security or cybersecurity services to our customers. ThreatLocker is a key component of our security stack, and we roll it out to every one of our customer's endpoints. It's not an optional component, but a must-have because we are strong proponents of zero trust. We provide remote monitoring and management services, which can be considered remote IT security for our clients. Our clients have minimal interaction with ThreatLocker Protect directly. It is one of the security tools we install on their systems to secure their networks and end devices. More importantly, it allows us to manage and control the specific applications and services running on their endpoints. For instance, we can maintain a pre-approved list of applications that are allowed to run in the environment, while preventing unauthorized applications from executing. Even for permitted applications, we implement additional security measures. ThreatLocker's unique capabilities are particularly evident in its handling of Adobe Acrobat, a common PDF reader. PDFs can be exploited by malicious actors, or hackers, to gain access to systems. Typically, a user clicks on a PDF, it opens, and without their knowledge, malicious code executes on the system, interacting with other components to enable hacker access. With ThreatLocker, we can restrict Adobe Acrobat to only accessing the official Adobe update servers on the internet, preventing it from accessing any other websites. Additionally, we can restrict Adobe's access to other applications and underlying files on the computer, preventing hackers from utilizing the program to compromise the system. ThreatLocker is a cloud-based endpoint protection platform that utilizes endpoint agents installed on each device. The deployment of these agents can be automated through Microsoft Intune or RMM, depending on the specific scenario. The ThreatLocker portal is also cloud-based, and once the agent is installed, it communicates directly with the ThreatLocker cloud. One of the key advantages of ThreatLocker is the instantaneous implementation of changes made in the cloud to the endpoints. This ensures that devices are always protected with the latest security policies.

We use the solution as a zero-trust application. We put it on all of our customer machines. We're a security operations company that performs, security, and compliance services for different companies. For all of the companies that we support, we put Threat Locker on. As a zero-trust application, we know the only applications that we've approved are going to be able to function in those customer environments and be that much more secure.

We use it over our 31 clients, and twelve hundred devices. We use it over all of our Windows workstations and Mac workstations to prevent unauthorized installs and downloads of applications.

ThreatLocker is our standard security stack, with very few exceptions. We use it for all of our MSP clients, MSSP clients, and recently for IR response cases. We use ThreatLocker to control application installations and take advantage of its ring-fencing option, which prevents otherwise good applications from interacting maliciously.

It's a solution for software whitelisting. It blocks applications from running. If there is any DLL or something else running on your computer, the admin or admins of the service get an alert. If an end-user is trying to install something that has been blocked by the organization, the admins get alerted.

Our clients require a zero-trust solution for their servers. They need to ensure that nothing happens to the server without authorization — nothing comes in, goes out, or gets corrupted. We put ThreatLocker on the server to block anything that attempts to run without permission. We use ThreatLocker across our whole platform. We continue to pound the table on how great it is and tell our customers that they need it. It is currently deployed for multiple MSP and MSSP clients on their servers and workstations.