Jose Enrique Hernandez
Co-Founder & CEOFormer Director of Threat Research at Splunk. Co-founder of Zenedge, acquired by Oracle.
Open-source work: LOLBAS · Splunk Attack Range · Atomic Red Team
Built on Threat Research
Application Control for the Tools Attackers Abuse
Turn threat research into policies that control what runs. Start with curated intelligence, review your decisions in audit mode and enforce when you’re ready.
Up to 100 endpoints.Free forever. No credit card required.
Install the agent on Free, or choose agentless deployment with Enterprise. Start in audit mode. See what’s included
Who gets in?Firewall · Identity · Cloud
What can run?Make execution an explicit decision.
What needs attention?Detection · Investigation · Response
Built by the researchers behind the tools
Bring the context defenders use into the decisions your policy makes.
LOLDrivers702 driver entries
Research on vulnerable and malicious Windows drivers, with evidence you can inspect.
LOLRMM358 RMM tools
Research on remote access tools and their potential use by attackers.
TRUSTED BY SECURITY TEAMS
Close the Gap, Control What Runs
Network and identity control access. MagicSword adds the execution layer: turn intelligence about trusted tools into policy that stops their abuse.
Existing Stack
Network, Cloud & Identity
Filter what arrives. Verify who gets in.
Execution Control
MagicSword
Use threat intelligence and your policy to decide what runs.
Detection & Response
EDR & Investigation
Monitor behavior. Investigate what needs attention.
Block unapproved remote access, restricted system tools, and known vulnerable drivers before they run. Keep approved work moving.
From research to a decision
A Familiar Tool
A Policy You Can Explain
A remote access tool can support your team or give an attacker a way in. Our research gives you context. Your policy decides whether it belongs on your endpoints.
- 01 / UNDERSTAND
Threat Research
See how remote access tools are used, and how they are abused.
Explore LOLRMM - 02 / DECIDE
Preventative Policy
Start in audit mode. Review the impact, then allow the tools your team needs and restrict the rest.
- 03 / ENFORCE
Reduce Attack Surface
Enforce when you’re ready. Keep unapproved tools off your devices and make your environment harder for attackers to use.
Our research. Your head start.
Built by Threat Researchers
We build and contribute to the open-source research defenders use to understand tool abuse. MagicSword brings that knowledge into the policies you review and deploy.
Michael Haag
Co-Founder & CTOFormer Principal Threat Researcher at Splunk. A decade in threat hunting and detection engineering.
Open-source work: Atomic Red Team · LOLDrivers · LOLRMM
Add the missing layer
Application Control
Yours for Free
Our research gives you a head start. Your free account gives you a place to put it to work.
Free Forever
$0 / NO CREDIT CARD100
endpoints. One free account.
Protect up to 100 endpoints with agent-based deployment.
- 7-day event retention
- Agent-based deployment
- Standard ecosystem and curated intelligence
- Audit mode and enforcement
Join for free
Free forever. No credit card.
Set up your policy. Enforce when you’re ready.
Built to grow with you
Need More?
There’s Enterprise
For larger environments and teams that need premium intelligence, agentless deployment and integrations.
- 30-day event retention
- Agentless deployment via Intune, SCCM, and GPO
- Premium curated intelligence and enforcement
- SSO, SIEM integrations, and priority support
For Enterprise teams / MagicSword MCP
From Audit Events
to Policy Decisions
Ask your AI assistant to investigate audit events and propose policy changes. You review before anything changes.
Example prompt / You ask
Find unfamiliar remote management tools in last week’s Windows audit events. Show affected devices and propose changes to our existing audit policy using LOLRMM research. Wait for my approval.Explore MCP setup
MCP requires an existing policy, enrolled agent-managed devices and an Enterprise API key. Enforcement is a separate decision.
Choose how you control execution
Allowlisting or Blocklisting?
Start with Your Environment
Application control defines what can run. Threat intelligence helps you decide what deserves a closer look, whether you start with specific blocks or a stricter baseline.
Allowlisting
Only explicitly approved applications can run. A tighter baseline needs a maintained inventory of the software your teams rely on.
Blocklisting
Applications can run unless a rule blocks them. Focus on selected unwanted tools and known risks, then keep your policy current.
Before you begin
A Few Good
Questions
Understand what’s included and how to start with a policy you can review.
What is application allowlisting?
Application allowlisting is a way to control which software can run. You define what is approved, review the impact in audit mode, and enforce a policy when you are ready.
Application allowlisting vs blocklisting: which is better?
Allowlisting starts with approved software; blocklisting targets known unwanted software. The right choice depends on your environment and how much control you need. MagicSword helps you review policy impact before enforcement. Compare allowlisting and blocklisting.
What are the best ThreatLocker alternatives?
Compare application control products by policy workflow, deployment options, integrations, support, and pricing. MagicSword is an option for teams that want threat research alongside audit and enforcement. Explore the ThreatLocker comparison.
Is it really free forever?
Yes. Your free account includes up to 100 endpoints, agent-based deployment, standard ecosystem and curated intelligence, audit mode and enforcement, and 7-day event retention. No credit card is required.
How does application control work with my EDR?
Application control makes an explicit decision about what is allowed to run. Your EDR continues monitoring behavior, detecting threats and responding. EDR can also prevent and block threats. These layers work together.
Can application control help prevent abuse of legitimate software?
Yes. A policy can block a legitimate tool that your organization has not approved, reducing the opportunity to misuse it. Approved tools can still be abused, so keep monitoring behavior with your existing security tools. Protection depends on the policy you configure.
How do I get started without disrupting work?
Create your free account, deploy the agent and set up a policy in audit mode. Review what the policy would block, approve the software your teams need and test changes on a small group before enforcing. Creating an account alone does not apply a policy.
Do I need an agent?
The free plan uses agent-based deployment. Enterprise also offers agentless deployment through Intune, SCCM and GPO, along with premium intelligence, SSO and SIEM integrations, and priority support.
Can I deploy a policy through my AI assistant?
Enterprise customers can connect the MagicSword MCP server to a compatible assistant. It can preview assigning an existing policy to enrolled agent-managed devices, apply that assignment after your approval, and help review audit events. MCP access requires an Enterprise API key; it is not included in the free plan.
You Decide What Runs
We’ll Help You Get There
Application control built on threat research. Free for up to 100 endpoints.
MagicSword Community
Research and Live Updates in Your Inbox
Get weekly research from the blog and notifications for MagicSword Live episodes
Get Community Updates
Weekly research from the blog and Live episode notifications, together in your inbox
Unsubscribe anytime. Privacy policy · Slack access is requested separately.