Red Canary vs ThreatLocker

About ThreatLocker

ThreatLocker sells an Application Control suite that includes Application Allowlisting, Ringfencing and Privileged Access Management, forming the core of its deny-by-default approach to cybersecurity.

ThreatLocker lets customers define which files agents can read or modify, which applications they can launch, and where they can connect. The boundaries ThreatLocker sets for AI agents remain in force as agents invoke PowerShell, Office, browsers and other tools. ThreatLocker uses deny-by-default application control to prevent unsanctioned applications and executables from operating inside a customer environment.^[2]

Once a ThreatLocker environment is locked in, no apps, scripts or libraries can execute without the customer's explicit permission. ThreatLocker applies deny-by-default execution to unknown binaries, scripts and libraries. ThreatLocker Learning Mode automatically catalogs all apps and dependencies and recognizes over 17,000 pre-built apps. When a customer evaluates an unknown app, ThreatLocker data shows how often the app has been used, in how many environments it runs, and whether other admins have allowed or blocked it. ThreatLocker lets customers publish pre-approved applications with predefined allowlisting, application containment and elevation policies.^[3][4][5][6]

Ringfencing lets customers restrict how applications interact with files, memory, networks, scripts, cloud platforms and sensitive systems. ThreatLocker lets Word open documents but not spawn PowerShell, and lets PowerShell execute approved scripts but not initiate outbound internet connections. For privileged access, ThreatLocker grants admin rights to specific approved applications, not entire user accounts. ThreatLocker restricts elevated applications from launching other applications, creating scheduled tasks, modifying registry keys or accessing credential stores like LSASS.^[2][4][6]

On the network side, ThreatLocker enforces device-level validation across the network so that only explicitly approved devices can communicate. ThreatLocker uses dynamic ACLs that update automatically as IP addresses change, so only validated devices reach protected systems. ThreatLocker restricts administrative protocols such as RDP, SMB, WinRM and SSH to hardened, approved source devices only. ThreatLocker supports micro-segmentation to create fewer pathways for attackers to move. ThreatLocker routes all cloud traffic through a ThreatLocker-managed gateway, and cloud connections originate only from an authorized network. ThreatLocker routes every connection to SaaS applications through a ThreatLocker-managed network and allows only approved devices through. Customers catalog approved endpoints and mobile devices and specify which SaaS services and internal resources those devices may access. With ThreatLocker, the endpoint and the server establish secure outbound connections, with no need to open inbound firewall ports or deploy and maintain a VPN infrastructure.^[4][7][8]

ThreatLocker Endpoint Detection and Response (EDR) analyzes telemetry, behavioral patterns and Indicators of Compromise (IoCs). When suspicious behavior occurs, ThreatLocker automatically isolates compromised machines to cut off lateral movement. ThreatLocker detects abnormal file activity, blocks excessive file writes, restricts share access and triggers device-level lockdown. ThreatLocker detects excessive file reads or writes, triggers automatic device isolation and shuts down suspicious processes. ThreatLocker Cyber Hero Team provides hands-on technical help, strategic consulting, project management and involvement in security events, and is based in Orlando, FL.^[3][4][9]

ThreatLocker is on the FedRamp marketplace. ThreatLocker lists support for security frameworks including CIS Controls, CMMC, GDPR, HIPAA, ISO IEC 27001, NIST 800-53 and PCI DSS. ThreatLocker continuously assesses configuration posture against NIST, CIS, CMMC, Essential 8 and other benchmarks, and performs daily validation at the endpoint level to address configuration drift. ThreatLocker flags risky settings, highlights dormant admin rights and maps gaps against compliance standards. ThreatLocker logs and indexes all executable activity, file access events and network communications, and keeps them searchable. ThreatLocker develops a price quote for a plan tailored to the needs of each customer environment.^{[5][8][9][10]}