Securing the Overlap: Where Endpoint Meets Cloud

### Overview Recorded live at RSA Conference 2025 in the Cyber Risk TV studio, host Mandy Logan interviews Rob Allen, Chief Product Officer at ThreatLocker. While ThreatLocker is traditionally recognized for endpoint protection, Allen discusses the company's expansion into cloud security—specifically addressing the intersection of endpoints and cloud environments like Microsoft 365, Git, and G Suite—through a zero-trust model of default deny.

### Key Topics - **Extending Endpoint Controls to Cloud:** Addressing customer concerns around cloud data breaches, email takeover, and token theft by bringing endpoint visibility and dynamic controls into cloud platforms. - **Token Theft Realities:** Highlighting how stolen authentication tokens bypass standard multifactor authentication (2FA), prompting ThreatLocker's special projects team to research and build storage control policies to defend against token exfiltration. - **Cloud Control Architecture:** Using agents on endpoints and mobile devices to dynamically register authorized external IP addresses with cloud services (such as Microsoft 365 named locations) while blocking all unauthorized IP addresses. - **File-Hash-Based Patch Management:** Introducing an endpoint patch management product that identifies outdated software using file hashes across the entire file system (including portable executables and downloads) rather than relying on registry entries or Add/Remove Programs. - **Pragmatic Views on AI:** Explaining ThreatLocker's stance against relying on AI for core security controls, sharing experiments using LLMs for website categorization with mixed results, and critiquing industry overhype.

### Technical Details - **Cloud Control Implementation:** ThreatLocker agents on Windows, Mac, and Linux machines—alongside mobile apps on iOS and Android—continuously report the user's current external IP address. These addresses are pushed dynamically into cloud conditional access policies or named locations (e.g., in Office 365). Only verified IP addresses are permitted to access tenant resources, enforcing a "deny by default, permit by exception" rule similar to ThreatLocker Network Control. - **Token Protection & Special Projects:** The team validated how easily scripts can steal session tokens and reuse them on separate machines without logging in. Storage control policies were designed to restrict programmatic access to sensitive tokens. - **Patch Management Engine:** Traditional patch managers can miss software that does not register via standard installers. ThreatLocker leverages existing endpoint visibility to scan actual file hashes. Internally, this approach uncovered 413 machines running 28 outdated software packages that a third-party registry-based tool had missed. The tool also supports automated patch policies (e.g., delaying updates by a defined window such as three days). - **Web Control & LLMs:** For web filtering categorization, ThreatLocker relies primarily on human analysis ("cyber heroes"). LLM trials demonstrated inconsistent results, frequently exhibiting confident hallucinations when classifying websites.

### Takeaways ThreatLocker's approach emphasizes that core security relies on consistent, deterministic policies—specifically blocking by default and permitting by exception—rather than trying to chase specific attacker tactics or rely on AI heuristics. By dynamically tying cloud access to known, verified endpoint IP addresses and protecting token stores, organizations can mitigate token theft and unauthorized access across SaaS platforms with minimal configuration overhead.