The new Zero Trust AI Control offering from ThreatLocker aims to keep access restrictions in place as agents interact with other applications—giving MSPs a way to help customers adopt AI while protecting sensitive data, ThreatLocker CEO Danny Jenkins tells CRN.
Zero Trust For Agents
ThreatLocker announced a new offering Tuesday that aims to make enabling secure AI adoption a bigger opportunity for MSPs, with new capabilities that bring a zero-trust approach to controlling what AI agents can access, according to ThreatLocker Co-founder and CEO Danny Jenkins.
The cybersecurity vendor unveiled Zero Trust AI Control, which offers capabilities that are specially designed to enforce permissions in a way that remains independent of the AI system itself, Jenkins told CRN.
[Related: ThreatLocker Lands $190M In New Funding: 5 Key Things To Know]
The approach therefore is able to keep restrictions around an AI agent in effect, even as the agent communicates with other software—rather than depending on the agent itself to follow instructions for its behavior, he said.
The distinction matters, Jenkins noted, because an AI agent can interact with applications that often have much broader access to corporate data than the agent actually requires.
An agent using Excel to create a spreadsheet, for instance, shouldn’t automatically gain access to every file Excel is permitted to open, he said.
“By having this AI Control policy, it follows Claude everywhere it goes,” he said, giving the example of Anthropic’s Claude platform as one AI system that can be controlled more effectively with ThreatLocker.
“You’ve said Claude is allowed access to these files. It’s allowed to access them from PowerShell. It’s allowed to access them from Excel. But it’s not allowed access to these files,” Jenkins said.
With ThreatLocker’s Zero Trust AI Control, “we’re now saying we’re going to treat it like an identity,” he said. “You’re going to be able to assign those permissions throughout and follow them—so you’ll give it access to Excel, but the Claude policy is going to apply, not the Excel policy.”
Notably, the offering includes suggested policy configurations that security teams can customize, according to ThreatLocker. It also works in tandem with ThreatLocker’s application allowlisting and web filtering capabilities, as a way to help organizations make a determination about which AI tools and web services should be sanctioned to use for employees, the company said.
Meanwhile, capabilities for restricting employees to corporate AI accounts on work computers—and requiring device verification before allowing access to company AI accounts—are also a key part of the offering, Jenkins said.
The approach builds on ThreatLocker’s long-running focus on only permitting necessary activity, but now extended to the massive security risks posed by increasing agentic AI usage, he said.
The reality is that “you can’t find all bad in the world. There’s too much nuance in it,” Jenkins said. “Just look for what you need. And everything else, therefore, is bad.”
For MSPs, the ultimate opportunity is to help businesses decide which agents to deploy—as well as to determine which information those agents can access and whether they should be permitted to take other actions, he said.
All in all, “this creates massive opportunities for MSPs,” Jenkins said.
What follows is more of CRN’s interview with Jenkins.
What prompted you to develop AI Control? And how does it build on ThreatLocker’s overall zero trust approach?
The basis of ThreatLocker is zero trust. We genuinely believe that there is no way in the world we can stay on top of all threats. So historically, we’ve dealt with app control. [A significant portion of] ransomware is now created by AI. And app control has been the most effective way at stopping this new ransomware, these new threats. Our ringfencing has been absolutely imperative to limiting things like PowerShell and living-off-the-land attacks. As the world changes, so are the threats changing. And like every other business, we’ve had to learn how to be an AI-forward-thinking company. Now we’re also in this world where judgment day is getting really, really close. You can see that AI is really accelerating attackers’ ability to launch attacks. The nice thing is, when you’re using ThreatLocker, you’re protected against all those threats. But the new threats that are coming out now are these agents that everyone is putting on their machines. We have people using shadow IT agents that haven’t been approved by the company. We have agents that are not controlled, so they can access all of your files. So, very easily, you can ask your agent to do something. It can hallucinate and send the wrong data to the wrong person. What we wanted to do in ThreatLocker was solve all of these problems in one go. So if you’re using AI, you should be able to do that easily, fast, without any negativity. First of all, we created AI Control, so you can go and put policies around your agents.
How does AI Control work? And what kinds of restrictions can organizations now put around AI agents?
To give you an example, I just go into the portal and I say, “I want to put a policy around Claude [for] the entire organization, every user. And I want to make sure it can’t access any files unless I’ve created exceptions.” This will automatically learn, after a learning period, and show you what you’re currently doing, so you don’t have to suddenly turn everything off. I also want to restrict its access to the internet, and we can create network exceptions as well. We can restrict its interaction with other apps. And we can restrict its changes to the registry. What’s particularly cool about this is, historically we’ve had this ringfencing concept—which is very similar to this. You can restrict its internet access, its files access for all your applications. The problem with AI is, it’s almost a human identity. So when you have a restriction on an app, you say, “This app can’t access these files.” But AI, in itself, can talk to other apps. So AI can now go and talk to PowerShell, and then PowerShell can talk to Command Prompt, and that can open Excel. So now, if you think about the way ringfencing works, you have a policy for Excel that says, “Excel can access all my financial files, all my Excel files.” You have a policy for Claude. Claude needs to talk to Excel. Excel can access everything. So now Claude can access everything.
So how do you prevent an AI agent from getting around those controls by working through other applications?
So it’s tied to the agent’s identity. By having this AI Control policy, it follows Claude everywhere it goes. You’ve said Claude is allowed access to these files. It’s allowed to access them from PowerShell. It’s allowed to access them from Excel. But it’s not allowed access to these files. You can very quickly say, “these are the controls I want to put around Claude.” It’s very easy to do, very quick. Now that was the first part. We wanted to control these agents very, very easily. With AI Control, we’re now saying we’re going to treat it like an identity. You’re going to be able to assign those permissions throughout and follow them—so you’ll give it access to Excel, but the Claude policy is going to apply, not the Excel policy.
How do you control where employees can access their company AI accounts?
The way I have my configuration right now is I can’t log into my company Claude account from my home computer. It will not let me do that because the data that’s in Claude is so sensitive. Just like Office 365, if I get phished with my Claude credentials, I’m going to be destroyed.
What other controls does this give organizations over how employees can use AI tools?
I can limit Claude access to only ThreatLocker Secure Network, and I can say, “Don’t let it go from anywhere else.” If someone phishes my Claude account, they cannot see all my company data because they have to verify the device. I can see every AI tool. I can see who’s using it, when they went to it, what computer they’re on. If you’re a ThreatLocker employee, you can’t go and log into your personal Claude account from your ThreatLocker computer. You can’t paste things into a personal account. You can only paste things into an enterprise account. I can also go in and configure settings inside Claude. Do I enable code access? Do I enable the desktop extensions? Do I enable MCP servers? I can go and configure this all in one place. You can go in one place, see a full snapshot of what files AI is accessing in your environment, what control policies you have in place, what restrictions you have on AI.
Why is this a better approach than trying to detect malicious activity?
What this does is rather than trying to detect malicious behavior, which is impossible, it assumes malicious behavior and it controls the AI agents to what your company wants to give it.
[It’s possible to use] Claude to encrypt all of the company’s files on a machine. This allows you to put those controls in place and stop it. You can’t find all bad in the world. There’s too much nuance in it. Just look for what you need. And everything else, therefore, is bad. The whole world has missed cyber. If we could detect everything that was bad in the world, we wouldn’t have ransomware attacks. Period. The way we’re doing it is, say, “What does it need to access in your environment?” If you want to change that, let’s just say as a company, you say, “Claude needs to access this file system because I’m doing some financials. I need it to be able to read these files so it can create me reports.” The user will say, “It doesn’t currently have access. Let me hit request,” and then the business can approve that access in 60 seconds. This just means that you know exactly what it’s going to be able to do and what it’s not going to be able to do in your environment.
What can you say about what it entails for MSPs to deploy this?
Our goal is, you want to deploy Claude in your organization. This is how you do it. You go into ThreatLocker. You create a permit policy for Claude. You allow it through the web control. This whole process is 10 minutes. You ringfence it to only access what you want it to access. It’s delivered through a secure broker, and it can only be accessed from your computers. You configure your computers so they can only access your instance of Claude in your environment. Every small business in the world knows they have to compete with people who are using AI, and they’re looking for their MSPs: “How do I do this without the world ending?” This creates huge opportunity for MSPs to come in: “We’re going to help you deploy AI in the most secure way possible,” and it’s not going to take them a lot of time. But they can now make security decisions on behalf of their customer and make it very easy.
What decisions can MSPs help customers make about AI access?
The company is going to choose which files can be put into AI, which files are too important to put into AI. Also, do they have read access? Do they have write access to these files? Are we concerned about them leaking it? Do they have access to email clients so they can send it out?
It’s now the company’s decision, and this creates massive opportunities for MSPs because they can go into these companies and say, “Hey, for a very small amount of money, but still making big MRR benefits to MSPs, you can improve your AI. You can secure your AI. You can deploy AI in a secure way, and we’re going to help you do that.”
