ThreatLocker provides advanced endpoint protection through application allowlisting. Unlike traditional security that tries to block known threats, ThreatLocker takes a zero-trust approach: only explicitly approved applications can run. Everything else is blocked by default.
The Gold Standard: Allowlisting
Allowlisting has long been considered the gold standard in protecting businesses from known and unknown executables. This approach gives organizations complete control over which software, scripts, executables, and libraries can execute on endpoints and servers.
Benefits of allowlisting include:
- Protection against unknown (zero-day) malware
- Prevention of unauthorized software installation
- Complete visibility into what runs on your systems
- Compliance with security frameworks that require application control
Key Features
Total Endpoint Control
ThreatLocker gives you complete command over which applications can run on your endpoints and servers. This prevents both malicious and unauthorized applications from executing.
What it blocks: Malware, ransomware, unauthorized software, unapproved scripts, crypto-miners, and any application not on your approved list.
Ringfencing
This secondary defense layer controls how permitted applications interact with each other and what resources they can access, including networks, files, and registries.
Why it matters: Even if an attacker exploits a vulnerability in an approved application, ringfencing limits what they can do. This is particularly effective against fileless malware and software exploits.
Elevation Control
This feature removes local administrator privileges from standard users while allowing controlled elevation for specific applications when needed.
Why it matters: User admin access is frequently the weakest link across your network. Elevation Control addresses this critical security gap without impacting productivity.
Learning Mode and Protect Mode
When ThreatLocker is first deployed, it operates in Learning Modefor 1-2 months. During this time:
- ThreatLocker monitors which applications are used
- It builds a baseline of normal application usage
- Our team reviews and approves legitimate business applications
- No blocking occurs during this phase
After the learning period, ThreatLocker transitions to Protect Mode:
- Only approved applications can run
- Unapproved applications are blocked automatically
- Users can request approval for new applications
- Continuous monitoring ensures ongoing protection
What Happens When Something is Blocked
If you try to run an unapproved application, you will see a ThreatLocker notification with options:
- Request Approval: Submit a request explaining why you need the application
- Cancel: Don't run the application
Requests are reviewed by our security team. For legitimate business applications, approval is typically granted within hours during business hours.
Zero-Trust Security
ThreatLocker embodies the zero-trust security model: never trust, always verify. Instead of trying to identify and block bad applications (an endless game of catch-up), ThreatLocker only allows specifically approved applications to run.
This approach provides superior protection against:
- Zero-day attacks
- Ransomware
- Fileless malware
- Malicious scripts
- Unauthorized software installation
Part of POLARITY
ThreatLocker is included as part of BRITECITY's POLARITY cybersecurity service. Combined with SentinelOne, Cisco Umbrella, and BreachSecureNow, it provides comprehensive, multi-layered protection for your business.
About the Author
Quick Answers
- What is application allowlisting?
- Instead of trying to block bad software (which is impossible to keep up with), allowlisting only permits pre-approved applications to run. If software isn't on the approved list, it simply won't execute - even if it's brand new malware no antivirus has seen before.
- How do I get a new application approved?
- Submit a request to BRITECITY support with the application name, publisher, download source, and business purpose. We verify the software is legitimate and safe, then add it to your allowlist. Typical turnaround is 1-4 hours during business hours.