ThreatLocker
ThreatLocker is a cloud-delivered security platform built around default deny: only explicitly approved activity is allowed.
What ThreatLocker is
ThreatLocker is a cloud-delivered security platform built around default deny: only explicitly approved activity is allowed. It is designed to stop ransomware, rogue applications, and zero-day exploits before execution. Modules include allowlisting, Zero Trust Network Access, a Zero Trust Endpoint Firewall, Web Content Control, Privileged Access Management, patch management, external storage control, data storage access control, real-time EDR detection, MDR, and controlled application testing. An agent is required on each computer, with installation guidance for Windows, macOS, and Linux. Web Control policies currently support Windows and Mac agents, while Linux support is coming soon; browser extensions cover Chrome, Edge, Safari, and Firefox. Executable activity, file access, and network communications are logged in a searchable audit trail that ThreatLocker says supports SOC 2, HIPAA, PCI-DSS, ISO 27001, and other frameworks. Integrations include ConnectWise, Kaseya, SolarWinds, and Datto. Support is available 24/7/365, with responses around 60 seconds. Pricing is on request, and a 30-day trial is listed.
Good
- Default-deny activity approval model
- Broad endpoint and network security modules
- Searchable compliance audit trail
- ConnectWise, Kaseya, SolarWinds, and Datto integrations
- 30-day trial available
Watch out
- No free plan
- Requires an agent on each computer
- Linux Web Control support is coming soon
- Pricing depends on endpoint and control needs
Who it suits
ThreatLocker fits organizations seeking default-deny endpoint controls, device management, and audit records. It supports Windows, macOS, Linux, web, and browser-extension use cases.
Verdict
ThreatLocker offers a wide set of controls under one cloud-delivered, default-deny approach. Check the Linux Web Control limitation and request pricing based on your environment.
Plans and prices
From ThreatLocker's own pricing page, checked 1 Oct 2026.
| Plan | Price | What it gives you |
|---|---|---|
| ThreatLocker | Priced on request | price based on endpoint count · application landscape · control needs |
The facts
Each one read from ThreatLocker's own pages, with the date it was checked.
Where it runs
- Browser extensions
- ThreatLocker Web Control supports Google Chrome, Microsoft Edge, Safari, and Firefox extensions.checked 1 Oct 2026
- Core approach
- ThreatLocker uses a default-deny model in which only explicitly approved activities are allowed.checked 1 Oct 2026
What it does
- Cloud delivery
- ThreatLocker is delivered from the cloud and requires an agent on each computer.checked 1 Oct 2026
- Compliance logging
- Executable activity, file access events, and network communications are logged, indexed, and searchable for audit evidence.checked 1 Oct 2026
- Datto integration
- Datto RMM integration can deploy the ThreatLocker component to selected sites daily through Auto Push, and Datto PSA supports company mapping and ticket settings.checked 1 Oct 2026
- Deployment
- ThreatLocker says the first agent can be deployed within 15 minutes and thousands of endpoints can be deployed within the first hour using an RMM.checked 1 Oct 2026
- Frameworks
- ThreatLocker says its audit trail supports SOC 2, HIPAA, PCI-DSS, ISO 27001, and other frameworks.checked 1 Oct 2026
- Integrations
- ThreatLocker lists integrations with ConnectWise, Kaseya, SolarWinds, and Datto.checked 1 Oct 2026
- Operating systems
- The help center provides installation guidance for Windows, macOS, and Linux agents.checked 1 Oct 2026
- Security modules
- Capabilities include Allowlisting, Zero Trust Network Access, Zero Trust Endpoint Firewall, Web Content Control, Privileged Access Management, Patch Management, External Storage Device Control, Data Storage Access Control, EDR Real-Time Threat Detection, MDR, Controlled Application Testing, Centralized Configuration Management, DAC, and Cyber Hero Approvals.checked 1 Oct 2026
- Support
- The Cyber Hero Team is available 24/7/365 with responses in around 60 seconds.checked 1 Oct 2026
- Threat prevention
- The platform is designed to stop ransomware, rogue applications, and zero-day exploits before they run.checked 1 Oct 2026
- Web filtering limit
- Web Control agent policies currently support Windows and Mac, while Linux support is coming soon.checked 1 Oct 2026
The company
- Company history
- Danny Jenkins, Sami Jenkins, and John Carolan incorporated ThreatLocker and launched Allowlisting in 2017.checked 1 Oct 2026
- Founded
- 2017checked 28 Sep 2026
- Headquarters
- ThreatLocker says its Cyber Hero Team is based in Orlando, Florida.checked 1 Oct 2026
Alternatives to ThreatLocker
- 1
Wazuh
Free planOpen sourceWebAPILinuxmacOS8.4From $571 a month - 2
Comodo Advanced Endpoint Protection
Free planAndroidiOSWebAPI8.2From $18 a year - 3
FortiClient
Free planAndroidiOSLinuxmacOS7.8Free plan - 4
CrowdStrike Falcon for Mobile
AndroidiOSWebAPI7.7 - 5
Microsoft Defender for Business
AndroidiOSAPImacOS7.5 - 6
LimaCharlie
Free planWebAPILinuxmacOS7.2$3 usage-based