What needs improvement with ThreatLocker Allowlisting?

ThreatLocker Zero Trust Endpoint Protection Platform can be improved by providing admin rights that allow us to manage it from the server by providing some token IDs or any kind of OTP if someone has rights and is on leave. This would be helpful so we do not need to wait for someone or for admin rights; they can easily generate the OTP, and then we can use it.

ThreatLocker Zero Trust Endpoint Protection Platform is already an optimized platform. I have a great experience with this, so I don't think anything needs to be improved. There might be a small thing, but I would need to assess that further. I took off one point because sometimes it can be a bit complicated for new engineers, such as my teammates, especially for those who don't have hands-on experience. They occasionally find it difficult to check application approvals. Overall, for me, it's good.

Going with the theme of ThreatLocker Zero Trust Endpoint Protection Platform being a one-stop shop where they have just about everything, and they have a really good product stack as is. However, the one last thing I would want to see is mail security implemented similar to how Mail Protector does theirs, except obviously managed and included in a subscription tier with ThreatLocker Zero Trust Endpoint Protection Platform. It's pretty easy to deploy as far as this functionality goes. However, it's very annoying to uninstall. You have to go into the online control panel and disable tampering for a device before it'll let you uninstall it without complaining really loudly. This is actually one of those things that is annoying in day-to-day operation because it assumes you don't know what you're doing. However, I would rather it let me know when it doesn't need to than have a situation where our protection is just being disabled and nothing's being done about it. On a scale of 1 to 10, I would rate ThreatLocker Zero Trust Endpoint Protection Platform a nine. There's a little bit of smoothing they could do, but most of my annoyances with it are with the concept as a whole and there's not really anything anyone can do to fix them. It comes with the territory. It's not really something that they in particular could improve upon.

For the space that it's in, it's already there. I don't know of another product that compares to its level. Even recently, with the addition of the detect module is a very nice add-on to the packet we already have. We have all that auditing, logging, and visibility for which we don't need to go to an endpoint. Adding more direct integrations with cloud platforms and services would greatly improve it. When managing file control or storage control, having the capability to manage more granular access within platforms such as SharePoint or OneDrive would be beneficial. Controlling the cloud environment, not just endpoints, is crucial.

I find that the learning mode is too accessible. Technicians sometimes default to it instead of manually building policy controls. I would prefer the learning mode to be harder to access, ideally hidden behind a layer that requires creating at least one policy first before using the learning mode as a supplement. Because of the accessibility of things like the learning mode, it moves towards defeating the purpose. The level of learning and the processes required to use ThreatLocker properly is high. You require a very high-tech person to truly understand its in-depth nature. We have tried it with our junior techs, and they just default to throwing learning mode on everything. It is too easy and allows techs to push through things that they should not. When you are using it properly, it has a high learning curve and a high difficulty level. It requires quality-of-life enhancements from an administrative perspective. Currently, there is a strong technical focus but less emphasis on the business aspects, such as billing and portal administration.

They have a good foothold in the game right now. They are doing everything right, and as long as they keep improvising and adapting, they will continue to overcome. I cannot suggest anything that they are not already doing. They should keep adding features as they have been.

That is challenging to answer because, in the areas we are working, we have been very happy. The improvements we need are more focused on user training than on ThreatLocker itself. They are constantly improving the platform. The Cyber Hero certification exam could use a bit of love, but overall, I have been very satisfied with the platform.

ThreatLocker University offers many good training modules, but more in-depth training for advanced platforms would be beneficial. I believe having more detailed information would be great. There could be a portal where others can provide suggestions that we can review.

The company should strive to stay ahead of all the developments happening externally. If their progress accelerates more rapidly than the ongoing changes outside, it would prove advantageous.

ThreatLocker would benefit from incorporating an antivirus feature or comprehensive 24-hour log monitoring, a valuable enhancement for both business and enterprise-level users.

A valuable addition to ThreatLocker would be a column in the audit page displaying a VirusTotal score for each file. This would allow for quick identification of potentially malicious files during allowlisting. Currently, ThreatLocker has a risk scoring system, but integrating VirusTotal results would provide more granular insight. This would enable users to efficiently assess the safety of audited files and prioritize those flagged by multiple antivirus engines for further investigation.

It would be beneficial to have a tighter integration into PSA systems so that approvals can be done directly without having to leave the PSA. Additionally, having their Cyber Hero support available during non-working hours could improve service for clients. They have a managed version of allowlisting with Cyber Hero so that their Cyber Heroes can approve things. It would be nice if I could implement that during the hours we are not working so that clients who work during our night would have a better experience and do not have to wait till morning to get their applications approved.

I'm not sure if I'm using it wrong; however, I find that I have to babysit it too much. I've found that if a user opens a file from another location, it might trigger an approval process. The same is true if someone has the same file under a different name. If anything, we get more tickets while using ThreatLocker. It doesn't help us reduce help desk tickets. It's hard to manage multiple policies for multiple companies. It gets cumbersome.

The snapshots used in the ThreatLocker University portal are outdated snippets and have not been updated in conjunction with the portal itself.

The current process for viewing software approval requests from end users has room for improvement. While it's generally functional, some users find it confusing. This can be due to either unfamiliarity with the process, unexpected appearance of the request window, or lack of clear instructions. Additionally, the notification box might not be sufficiently noticeable, as some users have reported missing it entirely. Adding applications to the allowlist can sometimes feel overwhelming. The numerous fields, coupled with navigating the unfamiliar portal, can be daunting, especially on our first attempt. Even with explanations, recalling the necessary information and understanding the required actions for file inclusion can be tricky. I believe the initial learning curve for allowlisting is relatively steep. However, once mastered, it proves to be a valuable tool. My main concern lies with the initial learning hurdle.

The portal can be a little overwhelming at times from an administration point of view. It displays a lot of information, and it's all useful. However, sometimes there is too much on the screen to sift through, especially if you're trying to diagnose a client's problem with a piece of software. Maybe something has stopped working since they updated it, and we need to see if ThreatLocker is blocking a component of that software. We must look through the logs, and there's an awful lot of information to go through. It has many options to filter out that information, and it becomes much easier once you've had some training. Still, there is so much information on the screen.

From a reporting perspective, enhancing the ability to customize reports would be beneficial. This could include the option to export reports to a Word document for further tailoring, allowing users to add their own executive summaries and additional content.

The reporting could be improved. They're already working on some things with that. That said, as far as its functionality, its stability, and my trust level in it, I honestly don't know how it could get better.

The new portal that they just released took care of a whole lot of improvements. There are some times when applications get submitted, and the hashes don't really line up. It would be excellent if there was a way for the hashes to point to a known application. The biggest example I have is probably web browser plug-ins. Those come up and they look very gross and don't give you very much information at all so you have to go to Google and look up what they are.

More visibility in the built-ins would be nice. The learning curve is wide because there are a lot of things to learn.

You need to have ThreatLocker agent software on every client or every computer that you want to be protected by the ThreatLocker Allowlisting application. If you have a thousand computers with ThreatLocker agents on them, when you approve or create a new policy saying that Adobe Reader that matches this hashtag and meets certain criteria is allowed to be installed, it applies at the top level or the organization level. It applies to every computer in the company. When you make that new policy and push it out and it goes out and updates all of the clients. Unfortunately, at this time, it does not look like they stagger the push-out. If your company only has a 100-megabytes internet line and you send out that update of 1 megabyte to a thousand computers, because it's sending that out to a thousand at the same time, you're using up a thousand megabytes right there. So, you could saturate your network. We have suggested they stagger it. If the system sees that there are a thousand computers, it should just try to send out to a hundred, and after that's completed, send out to the next hundred. That way, it's not saturating your network. Other than that, feature-wise, it's a great solid product. I have not come up with anything that they should do. Even when I thought I had an issue, they showed me that I have to look here to adjust that setting. For example, when you first join a computer, it automatically puts that computer in learning mode. You can set the time for how long it automatically stays in the mode. I believe the default setting was a month or something like that, and we thought that was too long. Their cyber heroes helped me find the area to adjust that. They already had the solution for that. I just wasn't aware of it.

ThreatLocker could offer more flexible training, like online or offline classes after hours. The fact that they even provide weekly training makes it seem silly to suggest, but some people can't do it during the day, so they want to train after work. They could also start a podcast about issues they see frequently and what requires attention. A podcast would be helpful to keep us all apprised about what's going on and/or offline training for those people who can't train during the week.