Darknet Diaries
Default to Deny: Why Network Security Is Shifting to "Zero Trust" Ep. 167 ThreatLocker
Episode Summary
AI-generated · Mar 2026AI-generated summary — may contain inaccuracies. Not a substitute for the full episode or professional advice.
Jack Rhysider opens by highlighting ThreatLocker, then introduces an anonymous IT operations head of a 1,000-employee manufacturing company across 17 sites in the UK and Europe. This guest recounts the “worst day of his life” (06:10) five years prior when his company was hit by the Kanti ransomware gang. In just fifteen minutes, the attack encrypted all 250 Windows servers and 350 endpoints (04:05, 05:09), forcing the guest to cut short his family holiday and leading to a chaotic, three-week business shutdown for a complete network rebuild. This devastating incident underscores the catastrophic impact of ransomware and the challenge of recovery.
The guest details the immense pressure of the recovery, including manually rebuilding devices after their imaging service was lost and implementing a “red, amber, green” protocol for checking machines (08:13, 09:15). Despite team conflicts, leadership made the crucial decision to take three weeks to rebuild the network properly, rather than a quicker five-day restore, prioritizing long-term security (10:55, 11:25). After finding traditional antivirus like Malwarebytes insufficient (13:33), they discovered ThreatLocker, a solution that stops everything from running unless explicitly allowed, marking a pivotal shift in their security strategy (14:36).
Hunter Clark, a cybersecurity engineer at Ark Technology Consultants, further illustrates the power of this “deny by default” philosophy with a hospital client’s incident. Even though the hospital declined multi-factor authentication due to budget and user complaints (21:03), ThreatLocker successfully blocked a threat actor who gained full domain admin rights via compromised VPN credentials bought on the dark web (22:53, 23:26). While the attacker pivoted to an unprotected, connected hospital system and deployed malware there (24:55), ThreatLocker prevented damage at Hunter’s client, significantly reducing the eventual ransom negotiation by demonstrating what data remained secure (25:57).
Danny Jenkins, CEO and co-founder of ThreatLocker, explains his company's mission to shift the security paradigm from “default allow” to “default deny” (36:56). He argues that traditional antivirus relies on detecting known threats, whereas zero-trust application control blocks all unapproved software, regardless of intent, making it highly effective against ransomware and unknown malware (38:52, 39:32). Jenkins shares that his inspiration for ThreatLocker came from a devastating 2014 ransomware recovery where the victim’s IT team dismissed application control as unviable (28:06, 29:50). He confidently states that among 70,000 companies using ThreatLocker, he has “never had a customer with a ransomware case that wasn’t ignoring obvious signs” (43:53, 44:37).
Listeners will gain a profound understanding of the real-world devastation caused by ransomware and learn how a proactive “deny by default” security posture, implemented through solutions like ThreatLocker, can prevent catastrophic outages, protect critical infrastructure, and strengthen defenses against sophisticated attackers and internal vulnerabilities.
👤 Who Should Listen
- IT directors and CIOs in manufacturing or multi-site organizations
- Cybersecurity professionals and engineers
- Small to large business owners concerned about ransomware and data breaches
- Anyone interested in the practical application of Zero Trust principles
- Executives making budget decisions for IT security
- Professionals involved in incident response planning and recovery
🔑 Key Takeaways
- 1.Ransomware attacks can be devastating, exemplified by a manufacturing company’s entire network of 250 servers and 350 endpoints being encrypted in 15 minutes by the Kanti gang, leading to a three-week business shutdown (04:05, 05:09, 10:23, 11:25).
- 2.Traditional antivirus and EDR solutions may not be sufficient to stop sophisticated ransomware, as one company found Malwarebytes enterprise platform “wasn’t really doing the job that we’d hoped” (13:33).
- 3.The “deny by default” or “Zero Trust” security model, implemented by ThreatLocker, blocks all applications from running unless explicitly approved, acting like a firewall for applications rather than a router (15:02, 36:56).
- 4.Zero Trust is not about saying “no” but granting the least privilege necessary for job functions, contrasting with “detection and response” models that only block detected anomalies (35:54).
- 5.Layered security (defense in depth) is crucial; ThreatLocker successfully stopped a ransomware attack at a hospital even after a threat actor gained full domain admin access via compromised VPN credentials because MFA was not implemented (21:03, 22:53, 23:26).
- 6.The effectiveness of ThreatLocker is supported by Danny Jenkins' claim that among 70,000 companies using the product, there has never been a ransomware case where policies were correctly followed, emphasizing its preventative power (43:53, 44:37).
- 7.Implementing “deny by default” can significantly reduce IT management overhead, as seen in a school where malware went from daily occurrences to never, reducing IT time from full-time to “a couple of hours a month” (32:16, 33:19).
💡 Key Concepts Explained
Zero Trust
A security model that verifies everything by default, granting the least amount of privileges necessary for users and applications to perform their job functions, rather than implicitly trusting entities within the network perimeter (35:24, 35:54). This episode presents it as a paradigm shift from traditional “castle-and-moat” security, offering superior protection against internal threats and sophisticated attacks by making trust explicit and continually validated.
Deny by Default
An approach within Zero Trust where all applications and actions are blocked unless explicitly allowed by an authorized administrator (15:02, 36:56). Danny Jenkins highlights its importance as a fundamental change in security philosophy, making it effective against unknown malware and ransomware by preventing unauthorized execution rather than just detecting known threats, effectively turning application execution into a firewall-like function.
⚡ Actionable Takeaways
- →Evaluate your current security posture to determine if it operates on a “default allow” or “default deny” principle for applications, aiming to shift towards deny-by-default for stronger protection (15:02, 36:56).
- →Implement multi-factor authentication (MFA) on all internet-facing portals and computers, especially VPNs, to prevent initial access even if credentials are compromised (21:03, 23:26, 41:36).
- →Establish clear protocols and playbooks for ransomware incidents, including immediate network shutdown, communication plans, and a structured recovery process like the “red, amber, green” system (03:36, 04:05, 08:13).
- →Consider application control or whitelisting solutions like ThreatLocker to block unapproved software, even if it’s new or unknown malware, thereby preventing its execution (13:33, 14:36, 39:32).
- →Communicate the severity of cyber threats, like ransomware, to users and leadership to gain buy-in for stricter security measures, emphasizing potential business outages (17:41, 18:03).
- →Implement IP restrictions on critical services like Microsoft Office tenants to ensure access only from known, trusted network locations (41:36).
- →Prioritize layered security, understanding that people will make mistakes and detection systems can fail, making strong controls the last line of defense (39:53, 41:00).
⏱ Timeline Breakdown
💬 Notable Quotes
““I say that to everybody I talk to about it, which I don’t actually like talking about it, ‘cause taking myself back to that day, that sinking feeling in your stomach, it is absolutely the worst, stressful — the most stressful situation I’ve been through in my career, hands down.””
““The problem with that is you don’t know whether they’re in the backups. You don’t know whether they were already in the — in your environment and they were just waiting for the right time to push the button, which we already believe they were.””
““What ThreatLocker does is it says, okay, let’s start by blocking every app from opening and running, but if you the user wants to open something, just ask and we’ll let you open it. We just want to block apps that you didn’t try to open or apps that you don’t actually need.””
““My mission is to make sure people understand why this is so important and then also educate them how it can be done.””
More from this guest
Danny Jenkins
Listen to Full Episode
📬 Get weekly summaries like this one
No spam. Unsubscribe anytime. By subscribing you agree to our Privacy Policy.
Continue Exploring
