Elevation · allowlisting · ringfencing
Take away local admin without breaking the day.
Most ransomware doesn’t need a zero-day, it needs a user with administrator rights and a moment of distraction. Lavawall® makes per-application the unit of permission, not per-user, so the QuickBooks update and the AutoCAD installer still work while everything else asks first.
Start my free trial, no credit cardSee what’s included
Sub-50ms cached decisions · 24h offline grace · no kernel driver, ever
Three controls that only work together
Application elevation
Replace UAC’s all-or-nothing prompt with a real decision. This is lightweight PAM: let a standard user perform a one-off admin action without ever giving them permanent local-admin rights. Approve a specific binary by signer, hash, or path, not the whole user. Cached rules return a decision in under 50ms with no network round-trip.
Allowlisting
An elevated process is still a process. Most tools see msiexec.exe running an MSI and approve every MSI or deny every MSI. Lavawall® decides on the actual payload, not the launcher. Pre-approve by signed installer rather than file hash, so a vendor’s update doesn’t break the allowlist on Patch Tuesday, or pin an exact SHA-256 when you want the highest fidelity.
Ringfencing
Stop an approved process from spawning child processes, reaching the network, or touching files it has no business touching, so a trusted app can’t be turned into a delivery vehicle.
Monitor first, then enforce
Start in a learning phase that watches what runs without blocking to seed the rules, allowlist the obvious things in monitor mode, then flip the switch to Enforce. No flag-day disaster. On a job site and a user hits an elevation prompt? Ctrl+Shift+L brings up a technician approval on the spot.
No kernel driver. The agent runs as LocalSystem and layers on top of Windows security primitives: no BSOD risk, no driver-signing dance, and it runs cleanly on Remote Desktop Session Hosts where kernel agents historically fail. Every decision, cached, console-approved, auto-denied, or technician-approved, lands in the audit log.
Built to replace the kernel-driver approach
Lavawall® controls execution and elevation rather than intercepting every network, registry, and file syscall, a deliberately more reliable model than the kernel-mode tools it replaces. If you are weighing it against ThreatLocker, AutoElevate, Microsoft WDAC, Microsoft AppLocker, or Airlock Digital, the difference is a single user-mode agent that enforces policy locally, without a cloud round-trip and without a driver in the boot path.
Want help designing the allowlist?
ThreeShield, the CISSP/CISA team that builds Lavawall® will baseline your environment, seed the rules that matter, and stage the move to Enforce so nothing breaks.
Common questions
- Do you install a kernel driver?
- No, never. The agent runs as LocalSystem and layers on top of Windows security primitives instead of re-implementing them in kernel space. Fewer crashes, faster boot and install, clean uninstall.
- What happens when the endpoint is offline?
- Cached signed rule bundles keep deciding for up to 24 hours by default (configurable). Decisions log locally and replay when the connection returns.
- How is this different from ThreatLocker or AutoElevate?
- One agent, no kernel driver: remove local admin, approve binaries by signer/hash/path, ringfence what runs, with sub-50ms cached decisions and a monitor-then-enforce rollout.