ThreatKeeper
Zero Trust protection for Windows workstations and servers. Nothing runs unless you have approved it, so ransomware and unknown code are blocked by default instead of being recognized after the fact. Put a machine into learning mode to onboard new software in minutes.
Activity
ProtectedApproveA managed platform run by Tech911. Contact us for pricing and availability for your endpoints.
Default deny, then approve what your business runs
Antivirus waits to recognize something bad before stopping it, which means brand-new ransomware runs first. ThreatKeeper inverts that: unknown code simply never executes.
Application allowlisting
Approved software runs. Unapproved executables, libraries, installers and script files do not, whether or not anyone has seen them before.
Learning mode
Flip a machine into learning mode and it records what the business actually runs. Review the list, approve it, and switch enforcement back on.
Elevation control
Let people run the few applications that need admin rights, with approval and a time limit, so you can take local administrator away from everyone else.
Attack surface reduction
Fleet-wide hardening against the behaviors attackers rely on: Office spawning child processes, credential theft from LSASS, obfuscated scripts and executable content arriving by mail.
Storage and network policy
Apply a removable-media policy across the fleet and enforce a firewall baseline on every protected machine, without disturbing the rules a client already relies on.
One console, full audit
Every execution, block and approval is logged and searchable per client, with one-click approvals and alerting when something is stopped.
From wide open to locked down, without the disruption
Deploy and learn
A lightweight agent installs on each machine and quietly records the software the business already runs.
Build the allowlist
ThreatKeeper proposes a baseline of known-good applications. You approve what belongs; everything else is denied.
Enforce and approve on the fly
Only approved software runs. When someone needs something new, it lands in the queue and you approve it in a click.
What’s included
- Default-deny application allowlisting for executables, libraries, installers and script files
- Learning mode per machine, with a reviewable baseline and one-click approval
- Elevation control, so standard users can run approved apps that need admin rights
- Fleet-wide attack surface reduction rules
- Removable-media policy and a firewall baseline on protected machines
- Full execution audit trail, searchable and separated per client
- Windows workstations and servers, hosted and managed by Tech911
For the MSP running this
- Multi-tenant throughout: policies, approvals and the execution audit trail are separated per client, so approving software for one client never touches another.
- Reporting you can hand over: per-client blocked-execution and approval reporting, the evidence a cyber-insurance questionnaire or a CMMC assessor asks for.
- Monthly, per endpoint: no minimum count, no annual commitment, and no repricing once your fleet is onboarded.
- We do the migration: we run alongside your current allowlisting or EDR add-on on one client you choose, until the data proves itself. Then client by client, at your pace.
- Your data stays yours: exportable if you leave, and we will document that before you sign anything.
What it costs you per endpoint
Application allowlisting is increasingly what cyber-insurance renewals and compliance frameworks require, which makes it something you can package and charge for rather than absorb. ThreatKeeper is monthly per endpoint at a fraction of the established Zero Trust platforms, so the margin on that line stays with you.
Lock down every endpoint you manage
Tell us about your fleet and we will get your machines protected.