ThreatLocker is an endpoint security platform using default-deny application allowlisting, ringfencing to restrict approved applications, and includes privileged access management, web content control, EDR threat detection, and 24/7 managed detection and response through its Cyber Hero team.
Listing updated . Checked by MSP Software .
ThreatLocker takes a default-deny approach to endpoint security: instead of trying to detect malicious behaviour after it starts, it blocks any application, script or driver that has not been explicitly allowed to run, and ringfences approved applications so they cannot be misused to reach other parts of the system they were not intended to touch. It suits MSPs willing to invest time in building and maintaining allow lists for each client in exchange for stopping unknown threats, including novel ransomware, that signature or behaviour-based detection tools might miss entirely. It is not an install-and-forget product, and MSPs expecting a set-and-leave EDR agent should understand the ongoing policy management involved before adopting it.
Pricing is per endpoint per month, quoted through a ThreatLocker account manager rather than published, and it usually includes onboarding support to help build a client's initial allow-list policies rather than leaving an MSP to work out ringfencing rules alone from a blank slate. ThreatLocker integrates with most PSA and RMM platforms for deployment and ticketing, and it also offers a Cyber Hero support team available 24/7 that can help triage and approve new software requests so legitimate software is not left blocked for long while a technician is unavailable. The platform includes additional capabilities such as privileged access management (removing standing admin rights), web content filtering to block phishing sites, and external storage device control. Before buying, ask how much ongoing time the Cyber Hero support team is actually expected to save versus how much policy management remains the MSP's own responsibility, since that balance affects the real workload of running a default-deny model across many clients. It is also worth asking how ThreatLocker handles a newly deployed client during the initial learning period, since building an accurate baseline for a new environment typically takes longer than maintaining an already-tuned one.
CrowdStrike Falcon Cloud-native EDR with behavioral detection, threat hunting and managed response via OverWatch. No reviews yet · from US$7.99 vs CrowdStrike Falcon
Microsoft Defender for Business Endpoint security for small businesses, from $3 per user per month or included in Microsoft 365. No reviews yet · from US$3.00 vs Microsoft Defender for Business| Feature | Supported | Note |
|---|---|---|
| Behavioural detection | no | ThreatLocker uses default-deny allowlisting rather than behavioural detection; it blocks unapproved applications instead of detecting malicious behaviour. |
| Automated remediation | yes | Automatically isolates compromised machines and protects data in real time. |
| Rollback to pre-attack state | no | Not mentioned in platform documentation. |
| USB and device control | yes | External storage device control and USB management are platform capabilities. |
| Application allow-listing | yes | Core feature; allowlisting blocks any unapproved applications, scripts and drivers. |
| Offline protection | unknown | Not explicitly stated in public documentation. |
| Threat hunting console | unknown | Includes EDR real-time threat detection but no explicit threat hunting console mentioned. |
| Managed MDR add-on | yes | Includes 24/7 Managed Detection and Response through Cyber Hero team. |
| SIEM and SOAR integration | unknown | Not mentioned in public documentation. |
| RMM integration | yes | Integrates with most PSA and RMM platforms for deployment and ticketing. |
| macOS support | yes | macOS support confirmed. |
| Linux support | unknown | Not mentioned in public documentation. |
| Feature | Supported |
|---|---|
| Multi-factor authentication | unknown |
| Single sign-on | unknown |
| Conditional access and device trust | unknown |
| Privileged access management | unknown |
| Passwordless and passkey support | unknown |
| Directory sync | unknown |
| Session and risk monitoring | unknown |
| Legacy VPN and app support | unknown |
| Self-service password reset | unknown |
| Breach monitoring | unknown |
| RADIUS and SAML support | unknown |
| Admin audit log | unknown |
| Feature | Supported |
|---|---|
| DNS-layer blocking | unknown |
| Content category filtering | unknown |
| Roaming agent for off-network devices | unknown |
| Secure web gateway | unknown |
| Multi-tenant dashboard | unknown |
| Per-site policy | unknown |
| RMM integration | unknown |
| Threat intelligence feed | unknown |
| SafeSearch enforcement | unknown |
| Reporting and audit log | unknown |
| Custom block and allow lists | unknown |
| Network-wide router deployment | unknown |
| Feature | Supported |
|---|---|
| Network vulnerability scanning | unknown |
| Authenticated scanning | unknown |
| Missing patch detection | unknown |
| Compliance framework mapping | unknown |
| Risk scoring | unknown |
| Dark web monitoring | unknown |
| External attack surface scanning | unknown |
| PSA integration for remediation tickets | unknown |
| Scheduled recurring scans | unknown |
| Client-facing reports | unknown |
| Multi-tenant console | unknown |
| Automated evidence collection | unknown |
ThreatLocker requires ongoing policy management, not a one-time setup. Because ThreatLocker blocks anything not explicitly allowed, an MSP needs to build and maintain allow lists per client and handle requests when a user needs new, legitimate software approved. ThreatLocker's included onboarding support and its Cyber Hero team help with this, but they do not remove the need for an MSP to stay involved in the policy management process.
ThreatLocker's Cyber Hero team, based in Orlando, Florida and available 24/7/365, can triage and approve new software requests around the clock, so legitimate software a user needs is not left blocked for long periods when an MSP technician is unavailable. It reduces, but does not eliminate, the ongoing policy management involved in running a default-deny model, since an MSP still sets and reviews the underlying rules.
ThreatLocker allowlisting decides which applications, scripts and drivers are permitted to run at all. Ringfencing then restricts what an already-approved application is allowed to do, such as preventing a legitimate tool from reading unrelated files or launching other processes, so it cannot be misused to reach parts of the system it was not intended to touch even once it is allowed to run.
ThreatLocker pricing usually includes onboarding support to help build a client's initial allow-list and ringfencing policies rather than leaving an MSP to design them from a blank slate. This is significant given how much of running ThreatLocker well depends on getting the initial policy set right, so confirm what onboarding support is actually included at the quoted price.
ThreatLocker includes privileged access management (elevation control) to remove standing admin rights, web content control to block phishing and malicious sites, external storage device control to manage USB and removable media, data storage access control to prevent unauthorised data exfiltration, and zero trust network and cloud access controls. The platform also provides EDR real-time threat detection and includes 24/7 Managed Detection and Response through its Cyber Hero team.
Reviews are moderated. How reviews work.
Share what it is like to use this product day to day. Your experience helps other MSPs choose with confidence.
Write the first review
