What ThreatLocker does
- 01 · Allowlist
Only approved software runs
Every program, script and library has to be on your approved list. Ransomware, unknown tools and anything a user downloads by mistake simply won’t start.
- 02 · Ringfence
Approved apps stay in their lane
Even trusted software is limited to what it needs, so a compromised Office macro or PDF reader can’t launch PowerShell, reach your file shares or talk to the internet.
- 03 · Elevate
Admin rights only when needed
No one works as a local administrator. When an approved installer or tool needs elevated rights, it gets them for that task only.
- 04 · Storage
USB and file access control
Block or limit USB drives and control which applications can open sensitive folders, with a full audit log.
- 05 · Requests
One-click approval requests
When someone needs new software, they request it from the block message. Our engineers review it and approve it for that person, a team or everyone.
- 06 · Report
Evidence for audits and insurers
A record of what ran, what was blocked and who approved what, useful for CMMC, compliance and cyber insurance questionnaires.
How we roll it out
- Learn. ThreatLocker runs in learning mode on every computer and server, recording the software you actually use.
- Review. We turn that into your allowlist and ringfencing rules, and walk you through anything unusual we find.
- Secure. We switch on enforcement in stages, starting with the lowest-risk machines, with our service desk ready for requests.
- Run. We handle approval requests, keep rules current as software updates, and review the logs as part of our monitoring.
Part of your security stack
ThreatLocker adds a zero-trust layer to the protection already in Managed Care: managed detection and response, vulnerability management and 24×7 monitoring by our NOC & SOC. It’s added per device, and our team runs it day to day.