What is the default duration of Learning Mode for new installs of ThreatLocker?

The correct duration for Learning Mode on new installs of ThreatLocker is 21 days. Learning Mode is designed to allow the software to observe and learn the typical behavior of applications and users within the environment before enforcing strict policies. This period ensures that administrators can fine-tune application whitelisting without initially interrupting business operations.

After the Learning Mode period concludes, ThreatLocker begins to enforce the policies based on the collected data, ensuring that only trusted applications can run. The length of 21 days strikes a balance, providing enough time for the system to gather comprehensive data while helping to move toward a more secure environment without unnecessary delays.