ThreatLocker

Overview

ThreatLocker is an Orlando-area cybersecurity company built around a blunt inversion of the industry’s standard model: instead of trying to detect malicious software after it arrives, its platform blocks everything by default and runs only explicitly approved applications — a “default-deny” or zero-trust approach (SecurityWeek). Founded in 2017 by Danny Jenkins, Sami Jenkins and John Carolan, the company traces its origin to cybersecurity threats at the founders’ children’s school; the software they built in response became the basis of its endpoint security platform (Orlando Economic Partnership). By mid-2026 it reported more than 70,000 customer organizations and had raised nearly $500 million, including a $190 million Series F (SecurityWeek).

Default-deny instead of detect-and-respond

The company’s thesis, in CEO and co-founder Danny Jenkins’s words: “Most cybersecurity tools are still built around identifying malicious activity after it has already entered an environment, when the damage may already be done. We believe the better model is to define what is allowed and deny everything else by default” (SecurityWeek). In practice the platform combines application allowlisting — permit-or-deny control over which software may run — with Ringfencing, which restricts what approved applications are allowed to do: which files, storage, network resources and system actions they can touch (Orlando Economic Partnership, MSSP Alert). To guard against fileless attacks and exploits, it limits the actions of approved applications, manages user privileges, and regulates network traffic based on application identity; policy-based endpoint detection and response monitors indicators of compromise and can respond to anomalies in real time (SecurityWeek).

ThreatLocker has extended the model beyond endpoints. In 2026 it added zero-trust network access and zero-trust cloud access products, and it has been building controls aimed at AI-era risks: AI agents, AI-generated code, unauthorized AI tools, and policies governing AI websites and the movement of sensitive data (MSSP Alert). The broader platform is packaged for managed service providers, letting MSPs administer application control, network access and cloud policies through one stack — a deliberate channel strategy rather than direct-enterprise sales alone (MSSP Alert).

The funding arc and the Orlando bet

ThreatLocker’s capital history tracks its geographic expansion. After a $100 million Series C in April 2022, the company moved its headquarters to 1950 Summit Park Drive in Maitland — the former home of Electronic Arts Orlando — taking 42,000 square feet and growing local headcount from 100 to 215 within months (Orlando Economic Partnership). A $115 million Series D followed in 2024 and a $60 million Series E in 2025 (SecurityWeek). The July 2026 Series F — $190 million led by Elephant with D. E. Shaw Ventures, Arthur Ventures and new investor Koch Disruptive Technologies — was earmarked for AI-security development and international expansion starting with a Reading, U.K. office, adding to locations in Orlando, Dublin, Dubai and Brisbane (MSSP Alert). A source familiar with the matter put the prior round’s valuation at $1.6 billion, with the Series F lifting it significantly (SecurityWeek). The company also runs Zero Trust World, its flagship conference in Orlando, as part of a 300-plus-events-a-year presence (Orlando Economic Partnership).

What this profile does not claim

This profile does not state a Series F valuation — none was disclosed; the $1.6 billion figure describes the previous round. The 70,000-plus customer count is company-reported and was not independently audited. The founding story (threats at the founders’ children’s school) is stated as reported by the Orlando Economic Partnership; finer details of that incident were not verified. Product-capability descriptions reflect how the cited trade press describes the platform, not independent testing. No first-party ThreatLocker material was used in this profile.