A Fortify 24x7 brand. Nothing we do for you gets talked about anywhere.Client sign inReach a person
CelebrityBytes
File B2 / The spike

If nobody approved it, it does not start.

Most products wait for software to misbehave and then argue about whether it did. Execution control skips the argument entirely. Each machine holds a list of what it may run, and anything outside the list is refused the instant it tries to start. Whatever came in through that message never gets as far as its first instruction.

ThreatLockerRefuse by defaultLearn first, enforce after
B2 1 line on this file
Lines here1
Made byThreatLocker
CountedBy the endpoint
Set up asA learning period, then enforcement

Why a list beats a judgement call

Detection products have to work out whether something is hostile. That is a genuinely hard question and it gets answered wrong in both directions every day. This asks an easier one: did anybody approve this. Approved things start. Everything else does not, and refusing it costs nothing at all.

The list is not something we invent on your behalf. The agent sits and watches a machine for a while and learns what genuinely runs there: the edit suite, the accounting package, the peculiar little utility a producer has been carrying around for a decade. That becomes your baseline, and anything added later goes through an approval a person handles.

The part everybody worries about first

One question comes up every time, and it deserves answering: does this end up locking somebody out halfway through a middle of a job. Vendor updates are tracked, so an ordinary new version is not mistaken for an intruder on a Tuesday afternoon. Requests to run something unfamiliar go to the desk, and a person answers them rather than a form.

Ringfencing is the other half. Being approved does not mean a program may then reach for anything it likes. What it may launch, what it may read, and where it may connect are all pinned down, so a legitimate tool cannot be borrowed as a delivery van.

Approved software starts. Everything else is turned away at the door.
Lines on this file

What each is, and what it comes to

The rates underneath arrive from billing as this page opens. Anything you set is held in the running order meanwhile.

Fortify-ZeroTrustLine

Execution Control

Allowlisting, ringfencing, and elevation, run by ThreatLocker

Refuse by default on the machines that hold anything worth taking. Software nobody approved gets no say in whether it runs, and software that was approved is kept on a short leash afterwards.

  • The list is assembled during a learning period, out of what the machine genuinely uses.
  • Ordinary vendor updates are tracked so that nobody is stopped mid job.
  • Ringfencing decides what an approved program is allowed to open, start, or reach.
Made byThreatLocker
Starting positionRefuse, unless it is already on the list
First fortnightLearning, then enforcement once the list looks right
ApprovalsElevation and approval requests go to the Fortify 24x7 desk
RingfencingHolds an approved program inside what it actually needs
CountedOne per endpoint
Reading rateper endpoint
billed a month ahead
COUNT
Honest scope

Where this file stops

This is the bluntest instrument on the site, which is exactly why it works, and it is also narrow. Here are the edges of it.

  • It governs software, not people. A person entitled to read a document can still forward it to a reporter. No list has an opinion about that. Reviewing who has access, and what your agreements say, are the controls that meet it.
  • It needs a settling in period. The learning phase exists because a list written blind is a wrong list. Rushing to enforcement by Friday is how people end up unable to open a project on a shoot day.
  • Browsers and documents stay hard. An enormous amount now happens inside a browser tab or a cloud document, where there is no program to permit or refuse. The tip line and the paper trail are the files that meet that problem.
  • One control is not a plan. A machine that refuses unknown software can still be signed into by somebody holding a working password. Read this next to the night desk.
  • It only works where the agent sits. A personal laptop that never gets enrolled is outside this line, exactly as it is outside every other line here.
STET

Heads up: card statements show FORTIFY 24X7 - Celebrity Bytes is a Fortify 24x7 brand, and your subscription is billed by Fortify 24x7.