Application Allowlisting

The goal of Zero Trust is to only allow what is needed and to block everything else. To stop business interruption, ThreatLocker will automatically learn what your environment requires, and will build policies that include applications and their dependencies in Learning Mode. The first step is to deploy the agent, which can be deployed using various automation tools.

The agent will not block anything during the initial deployment; instead, it will go into Learning Mode. After a week of learning, you can review the list of policies that have been created, then deny or limit any software you do not want and secure your environment.

Yes, in the sense that we do add the newest versions to the application for the customer to make a policy for, but we do not let the user to choose which version of the built-in to approve or anything like that. Assuming that it is an update and not a new product. Kieran says that he believes the built-in applications are continuously monitored and often updated in under 24 hours. Need more clarification/specifics.

Yes, ThreatLocker allows you to create multiple policies for an application to further restrict access by User or by Group. 

Most companies are secured in under a week. Almost all are 10 days or under.

Before you secure your environment, you will have the option to simulate potential denies based on a period of time. This will ensure no strange applications will cause issues.

ThreatLocker will walk you through this process by scheduling weekly calls to deploy, review policies, and help you secure your environment.

A typical deployment in a medium to large business should take about 5 calls from deployment to fully secured.  

Ultimately, your IT administrator decides what should be allowed to run. The ThreatLocker learning process will create a list of policies, which you can review and amend before enabling protection and securing your systems.

ThreatLocker does not allow applications simply because they're from an approved vendor. From a cybersecurity perspective, the fewer applications are permitted to run in an environment, the better. Allowing all applications by a specific vendor or vendors flies in the face of this approach.

ThreatLocker runs at the kernel level, meaning it doesn't matter if something is executed by an administrator, system, or user, if it hasn't been allowed to run via the Allowlist, it will be blocked.

ThreatLocker also has extremely stringent tamper protection, which, combined with its kernel level services, makes it nearly impossible to interfere with its operation.

Allowlisting may block changes to the application if the application updates. ThreatLocker solves this problem by having a predefined list of built-in application definitions. If you have a policy for a built-in application, ThreatLocker will automatically update the policy when new updates are released. Our team monitors over 6,000 tracked applications, and updates the definitions 24/7/365.

For unknown applications that have automatic updates, your Solutions Engineer can help you create custom rules and definitions using a combination of hashes, filenames, calling processes, certificates and creating processes. If the IT team deploys the update, you can use installation mode to track the changes by the installer.

The ratings coming from our internal system based on the business use case of the application as well as both previous and current exploits of vulnerabilities in that application.

At the moment, we cannot make an exception to a Global policy with a policy at another level. You can still use Users/Groups to make exceptions at the Global level.

Yes. Application Control controls any executable's ability to run on your endpoints.

Absolutely. We provide multiple secure ways to allow new applications. You can utilize our built-ins or use installation mode in our virtual testing environment.

ThreatLocker support is available 24/7/365 and is accessed via a chat function on the portal. All chats are answered within 60 seconds, and our Cyber Hero team can assist via chat or Zoom.

We also have an extremely comprehensive knowledge base, as well as ThreatLocker University, which provides self-paced a la carte courses, or pre-determined learning tracks up to Cyber Hero Certification.