It’s honestly a great platform overall for its purpose. Once you understand what it’s trying to do, it’s easy to use, and the support the Cyber Heroes provide is a real game-changer. It runs smoothly, and so far we haven’t had any PCs run into issues with the agent or performance. Review collected by and hosted on G2.com.

I think the biggest struggle has been understanding the policies and how everything works together. That feels less like a problem with the platform itself and more like a learning curve tied to everything the platform can do. Once you start to understand the logic behind what it’s doing, the structure makes more and more sense; it’s really just a matter of getting used to it and understanding the purpose behind it. From time to time we do run into difficult configurations where it would be easy to solve if we could do xyz with the policy, but normally we talk with the cyber heroes and can find a way to make it work. Review collected by and hosted on G2.com.

I find the UI of the platform to be user friendly and easy to navigate. It's clear what module I'm in, how to get support, and how to deploy new policies. It integrates well with our RMM and ticketing system, allowing us to efficiently approve requests and update applications. The portal is responsive and quick to navigate. Support is excellent, and the CyberHeros never fail to offer an answer to my questions. Review collected by and hosted on G2.com.

Threatlocker does seem to slow down some older hardware, especially devices with low system resources. It's understandable, but we do need to keep an eye on it for clients that use older hardware. Review collected by and hosted on G2.com.

The strongest part of ThreatLocker is its application allowlisting. Once it's configured correctly, it does an excellent job of preventing unauthorized software from running. I also appreciate the visibility the platform provides across endpoints. That said, getting to that point takes significant effort, and some features—particularly the learning mode—didn't work as well as I expected. It's a powerful product, but it requires a substantial investment of time to manage effectively. Review collected by and hosted on G2.com.

The biggest challenge has been the amount of time required to manage the platform. The learning mode didn't work as well as expected, so creating and maintaining policies required significantly more manual effort than anticipated. False positives and application approvals can also create additional administrative overhead, especially in environments where software changes frequently. ThreatLocker is a powerful security tool, but organizations should be prepared to invest time in tuning policies and ongoing management to get the most value from it. Review collected by and hosted on G2.com.

Reducing Security risk. Software vulnerabilities are also reduced as we have no admins, Supply chain issues mostly mitigated for the application and software side. User's systems just seem to just work now and the old adage of reloading windows never happens. Plus the ability to elevate the program for certain applications gives the user some power to perform duties. So seeing better system performance and happy clients. Deploying ThreatLocker is one of the easier tasks, it integrates very well. The platform is easy to use and intuitive, aunified audit helps not just for using ThreatLocker but also general system and logging needs. Pricing is inline and not as high as other platforms so an easy sell. Cyber Heros has a very fast response time for support and many times they will help or just take care of the rule. Review collected by and hosted on G2.com.

I always say I have a love hate relationship. The only downside is how Zero Trust Works. So when applications change that do not have a built in rule or they change how they work with a computer. You do have to do some lifting or relearning of the application. not the end of the world it is a step. We find explaining to the user and client what and why usually helps here. You can use the cyber hero auto approval, This service help with this lift if you have a small team or struggle with understanding the platform or are busy with other tasks. Review collected by and hosted on G2.com.

What I like most about ThreatLocker is the level of control and visibility it provides. Application Allowlisting prevents unauthorized or unknown software from running, while Ringfencing limits what approved applications can access or communicate with. It helps us move beyond traditional antivirus by enforcing a true least-privilege, Zero Trust approach without creating unnecessary disruption for users. Review collected by and hosted on G2.com.

The biggest downside is the administrative overhead, especially during the initial learning and policy-tuning phase. Legitimate applications, updates, scripts, and installers can be blocked until they are reviewed and approved, which can create extra work for a small IT team. The platform is very powerful, but the interface and policy structure can feel complex, and troubleshooting why something was blocked is not always immediately obvious. Once properly tuned, it works well, but it requires ongoing attention to avoid unnecessary user disruption. Review collected by and hosted on G2.com.

ThreatLocker provides a very robust security layer that is a key part of our security stack. The idea of blocking everything and then allowing only what is really needed for your users to function makes your IT infrastructure much safer that trying to find and block every possible malicious action and realted processes. Review collected by and hosted on G2.com.

Sometimes when you are dealing with application updates, ThreatLocker will block the update files. Due to the way many apps are updated, this can lead to some rather involved policies to allow the updates freely but still block similar malicious actions. Review collected by and hosted on G2.com.

I find ThreatLocker Zero Trust Platform very easy to use, especially when it comes to their unified audit for checking different transactions like executions that have happened on devices. The ability to see what's been blocked and denied in an easy to view window helps us understand what's going on in our environment at a very granular level. It also provides us with much more immediate control in emergencies, allowing us to feel safe. Review collected by and hosted on G2.com.

Maybe the custom reporting could have more options than it currently has. We haven't fully used a lot of additional features. The patch management feature seems useful, but I'm not sure if ThreatLocker Zero Trust Platform is the best way to do patch management. Review collected by and hosted on G2.com.

ThreatLocker Zero Trust Platform delivers a clean, easy-to-navigate interface that simplifies managing complex security policies. It integrates well with existing Windows environments and other security tools, while maintaining strong performance with minimal impact on endpoints. Although pricing may be higher than traditional antivirus solutions, its proactive approach to preventing ransomware and unauthorized software can provide excellent ROI by reducing security incidents and administrative overhead. The onboarding process is well supported with responsive customer service and helpful deployment guidance. Its intelligent policy automation and learning mode help streamline implementation, making Zero Trust security more practical for organizations of all sizes. Review collected by and hosted on G2.com.

One of the biggest drawbacks of ThreatLocker Zero Trust Platform is that it requires careful planning and ongoing policy management to get the most value from it. The default-deny approach can create a steeper learning curve for administrators, and overly restrictive policies may block legitimate applications until exceptions are configured. While the interface is generally intuitive, managing complex environments with many custom applications can become time-consuming. Integrations with specialized or legacy software may require additional testing and policy tuning during deployment. Pricing can also be higher than traditional endpoint security products, making it a larger investment for smaller organizations. Although ThreatLocker's support team is responsive and helpful, successful implementation still requires time and resources, and its AI-assisted learning features are designed to aid policy creation rather than replace administrator oversight. Review collected by and hosted on G2.com.

Deny by default, with an easy-to-manage console. It gives us peace of mind beyond what we’ve gotten from any other security tool. ThreatLocker gives us better control over devices in ways our existing EDR doesn’t catch until something actually happens—at which point it’s already time to react. With ThreatLocker, we can allow what we need to run while still preventing it from going beyond that intended business use. The integration with ServiceNow also helps by automatically spawning a ticket for an application request. Support is amazing, too: we get almost instant access to a cyberhero for a quick question, or an escalation path for anything that needs more attention. Review collected by and hosted on G2.com.

It’s hard to say what I don’t like, because it’s really more about not knowing everything about the product. I can use it for what I need, but a deeper understanding isn’t possible since it’s not the only system I use in my job. Review collected by and hosted on G2.com.

For a MSSP, the standard security stack includes things like EDR, Managed SOC, AV, email protection, security training, ITDR, and things of that nature. Rarely do you see application control. ThreatLocker provides that by using a default deny to block any unapproved applications, enforcing a process known as zero-trust. From a cybersecurity technician's perspective, that is huge. Being able to control the apps that run blocks malware, data loss, and so many other risks.

The management can be difficult at times as learning mode will run through a computer and allowlist everything on it. The best place to start is to create a baseline computer with only the approved software and use that to define policies. Going forward, limiting the learning mode will be the best long-term plan.

The different modules are great for providing further enhanced protection for customers. It also integrates nicely with our PSA and provides APIs for integration with other products and MCP protocols. Review collected by and hosted on G2.com.

It can be difficult to manager if you don't conduct regular audits or checks. Just like a firewall, the policies in Threatlocker can grow out of control rapidly as team members change them. Apparently the cyber hero support teams have resources at their disposal to automate some of these things, but I ended up writing an MCP tool to integrate with ThreatLocker that automatically does a lot of this for me using Claude or whatever AI agent I prefer. Review collected by and hosted on G2.com.