Attivo Endpoint Detection Net (EDN) vs. ThreatLocker

Attivo Endpoint Detection Net (EDN) is a suitable option in mid level and large companies to detect insider threats and stealthy attackers. It is highly recommended where data is highly sensitive and there are chances of attack to get access to critical revers to get saves credentials and stored files. for small and medium business this solution is not recommended where perimeter security is already configured.

Incentivized

I have tested two of software besides ThreatLocker. ThreatLocker by far, was the easiest of the 3 to work with and setup. One of the companies' software was too complicated to run and setup. The other one lacked a lot of the features that ThreatLocker had. ThreatLocker came with many prebuilt template for common software and utilities, like Office365, putty, Firefox, Google, etc. It came with a bunch of prebuilt blocking/ringfencing rules for utilities like powershell, hyper-v psexec, and many others. This saves setup time. Unfortunately, ThreatLocker will let you download something from the MS Store, sometime it will let you execute and sometimes it won't. I would like to see this to be able to block the download from MS Store until ThreatLocker approves the download.

Incentivized

• To mimic production servers to deceive attackers
• To detect the lateral movements of adversary through machine learning algorithms
• To feed dummy data on production servers through threat strike feature

Incentivized

• Application Control
• Privileged Access Management
• Storage access control

Incentivized

• Attivo Endpoint Detection Net (EDN) should have capability for getting forensics packages from compromised systems in my opinion.
• I believe Auto phishing email detection capability should be improved to meet industry requirements to tackle phishing attack vector
• Malware detection capabilities should be improved to work to kernel level for better visibility in my opinion.

Incentivized

• Ease of moving between organizations
• Removing agents from clients who depart
• Some UNC path definitions for local files and folders

Incentivized

ThreaLocker has done its job and has prevented malware from executing. It has stopped an encryption process once already. It has kept a user from going to a bad website. He tried twice and was wondering why he was getting an error message from ThreatLocker and ESET both.

Incentivized

ThreatLocker ease of use allows me to get the answers I need to any threats or denied action that ThreatLocker took. The "Unified Audit" is a great tool to show what is happening/executing on a user's computer or on a server. Unified Audit will allow to look at what steps a programs takes when it executes. It will show you if it calls on Powershell or what DLL's it is executing and many other things.

Incentivized

There is rarely ever an outage. I have seen slowness in ThreatLocker service. But that is very rare too!

Incentivized

ThreatLocker is always available. The admin's console loads very fast and report runs almost instantly. It does not interfere with operating system.

Incentivized

You can email, call or do online chat with tech support. I love their online chat. They are quick and friendly. Also, if you need to show them something, you can give the chat technician permission from your Chat box to allow the tech access to your computer. They also can pull out your admin console on their side. They can look at your "Unified Audit" log and see the same thing that you can. They have a good KnowledgeBase that you can look for answers. They have what is called "ThreatLocker University" where you can go through tutorials and take tests.

Incentivized

The owners and co-founders work with you through Zoom Meetings. They walk you through how to use and setup ThreatLocker. They also have webinars. You also can go through ThreatLocker University online training.

Incentivized

Using ThreatLocker University online training is very easy and informative. You take online tests to see how well you learned the material. It is great!

Incentivized

ThreatLocker is a family ran business. The owners, co-founders work with you to ensure you are up and running as quickly as possible. They went to ensure your success with ThreatLocker.

Incentivized

Attivo provides a user friendly management with a centralized manager. We can do configuration of Attivo Endpoint Detection Net (EDN) from a centralized console and deploy the Attivo Endpoint Detection Net (EDN) very easily. In other deception tool like forti deceptor etc, they have a bit poor user interface in my opinion and use-ability feature are improved in Attivo as compared to its competitors solutions I believe

Incentivized

I honestly have not seen many other programs like Threatlocker so I do not have any to compare to. Auto-Elevate may be the closest, however I did not evaluate them as part of my decision. Threatlocker does do a great job at onboarding which made deploying, setting up, and troubleshooting the program a breeze

Incentivized

ThreatLocker is very easy to add new ThreatLocker agents on computers and servers. It is very easy to do. You can install an agent on a computer or server in about 2 minutes or less.

Incentivized

• Attivo Endpoint Detection Net (EDN) helps to protect information hence Attivo Endpoint Detection Net (EDN) is securing sensitive data therefore ROI is better as loosing the data is much more costlier as per Business Impact Analysis.
• In small organization ROI is not effective as cost of Attivo Endpoint Detection Net (EDN) is a bit high and data being protected through EDN is not high value asset in my opinon.
• It is a better technology to detect cyber threats so anyway it is recommended to use for better security posture.

Incentivized

• Too early on to tell, however, if ThreatLocker ends up blocking just one ransomware attack for any of our clients, I'd argue that it payed for itself.

Incentivized