A “Best-of” compilation article, sponsored by ThreatLocker
Most security failures don’t begin with a genius attacker. They begin with a setting: a firewall rule left open, a permission never revoked, a default nobody changed. On the Security You Should Know episode “Tackling Misconfigurations with ThreatLocker,” the panel called misconfigurations the unsolved “Gordian knot” of cybersecurity. It’s the problem nearly every organization has and almost none have fully untied.
Part of why it stays knotted is that a secure configuration isn’t a finish line. It’s a moving target, something to monitor continuously rather than set once and trust forever. Every quote below comes from Rob Allen, chief product officer at ThreatLocker, who has spoken extensively on this topic on CISO Series.
Human error remains one of the top cybersecurity threats. Just one wrong click can open the door to ransomware or data loss. With ThreatLocker, unauthorized apps, scripts, and devices are blocked before they can ever run. See how ThreatLocker can help you gain more control over your environment.
Threatlocker.com/CISO
Catch problems before they become breaches
Misconfigured controls account for a striking share of incidents, which is why the problem warrants a dedicated solution.
“Sixty one percent of security leaders have suffered a breach because of misconfigured controls in the last 12 months… the goal is to identify these things, these problems, these misconfigurations before they turn into a breach.”
Listen to the full episode: Tackling Misconfigurations with ThreatLocker (Security You Should Know, 10-06-25)
Visibility comes before control
A misconfiguration can’t be corrected until someone knows it exists. It sounds obvious, yet it’s where many programs quietly fall short.
“If you don’t know about it, you can’t control it. You can’t do anything about it, basically. And that plays out every single day… If you don’t know about it, you can’t protect it.”
Listen to the full episode: Simple Security Solutions That Deliver a Big Impact (Defense in Depth, 02-05-26)
What a misconfiguration check looks for
The problem isn’t abstract. It comes down to a list of specific, checkable settings. Of which, any single missed setting can quietly leave a door open.
“It’s doing 150 checks pretty much every day in every machine, looking for common misconfigurations. So, things like firewall rules, overly permissive firewall rules, or misconfigurations, or if USB drive access is permitted.”
Listen to the full episode: Tackling Misconfigurations with ThreatLocker (Security You Should Know, 10-06-25)
Secure today doesn’t mean secure tomorrow
A single check isn’t enough, because a hardened machine doesn’t stay hardened. Configuration drift happens. A once-a-year audit rarely catches it.
“You want it to be something that happens automatically, ideally daily, because if configuration does drift… What was configured correctly today is out of configuration or out of compliance tomorrow. You want to know about that, so you can resolve it.”
Listen to the full episode: Simple Security Solutions That Deliver a Big Impact (Defense in Depth, 02-05-26)
Even trusted software can act like ransomware
Misconfiguration isn’t only about what’s set wrong. It’s also about what gets allowed in, and even legitimate software can carry risk.
“It stops me from having WinRAR on my computer, which fundamentally has all of the characteristics of ransomware because it can encrypt data, it can transmit data, and it can delete data. And if you’re an attacker, that’s all you need.”
Listen to the full episode: Can You Have a Secure Software Environment Without Traditional Vulnerability Management? (Defense in Depth, 05-08-25)
The bottom line
Misconfiguration isn’t a one-time mistake to fix. It’s an operating condition to manage. Rob is the first to say there’s no magic wand, and configuration hygiene is one piece of a bigger picture rather than a cure-all. But the discipline behind it is unglamorous and effective: see everything, check it constantly, and reduce what’s exposed in the first place. That’s the thinking behind ThreatLocker’s Defense Against Configuration. Listen to the full conversation: “Tackling Misconfigurations with ThreatLocker.”