Datto RMM (now part of Kaseya) is widely deployed across MSPs. Lavawall® is a multi-tenant RMM and remote support platform for MSPs and IT teams, with patching, security monitoring, Microsoft 365 and Google Workspace breach detection, and compliance (GRC) built into the same agent and console. Technicians get browser-based remote control, a background admin workspace, and a remote shell on Windows and Mac, scripting on Linux, and ad-hoc support for computers without the agent, with end-to-end encrypted sessions available. Lavawall® can run on its own as your RMM, or be installed through Datto RMM as a component, or through NinjaOne, ConnectWise, Kaseya, Intune, or any tool that runs a script, while you move over. Patching reaches 7,400+ applications across Windows, macOS, and Linux.
Where Lavawall® wins for MSPs
Datto-native deploy: a ready-made Datto RMM component installs the Lavawall® agent, and you push it to endpoints exactly the way you push everything else. Lavawall® is its own RMM, so both agents can run side by side while you move over.
GRC compliance automation across 70+ frameworks (CMMC 2.0, NIST CSF, CIS, SOC 2, ISO 27001, HIPAA, PCI DSS, PIPEDA, BC E-Health Act, Alberta HIA, NERC CIP, CIRO, CPA Canada, Australian Essential Eight, and the Canadian privacy bundle).
Microsoft 365, Azure, Entra ID, and Google Workspace breach detection with endpoint correlation.
Administrator elevation with certificate-based rules and ringfencing, plus execution prevention for high-risk tools, with no kernel driver.
7,400+ applications patched across Windows, macOS, and Linux from a single, audited catalogue. Datto RMM's default Software Management catalogue covers roughly 25 third-party applications; broader Windows third-party coverage requires the paid Advanced Software Management add-on, which per Datto's documentation is currently only supported for Windows OS devices.
macOS update management on Datto RMM is handled by the Install Updates with SUPER [MAC] ComStore component, a third-party tool from GitHub that installs all pending macOS updates without per-update selection. Linux OS patching uses separate Apt-get and Yum/Dnf ComStore components. Lavawall® patches Windows, macOS, and Linux from one agent, one policy, and one catalogue, with no add-on, no third-party components, and no all-or-nothing trade-off.
SaaS / shadow-AI discovery against a 1,277-app catalogue using email metadata.
Replacement prioritization across battery cycles, capacity, drive SMART, TPM version, RAM, and processor age.
Remote support built into the same RMM: remote control from any modern browser with nothing to install on the technician's side, the Admin Workspace (a private workspace where the technician works with administrator rights while the user keeps working undisturbed: 19 Windows tools plus PowerShell as system, PowerShell as the logged-in user and Command Prompt as system; a root zsh shell on Mac), chat inside the session, and file transfer both ways with uploads up to 2 GB per file. Per Datto's documentation, Datto RMM Web Remote is "a browser-based HTML5 remote control, chat, and PowerShell tool", and "File uploads are limited to 1GB per file upload".
Free white-label "Scout" domain attack-surface scanner you can embed on your own site.
Month-to-month, no high-water-mark billing, no minimum for single modules.
Where Datto RMM wins
Mature MSP RMM with deep monitoring, scripting, and patch automation.
Tight integrations across the broader Kaseya/Datto/IT Complete portfolio.
Large existing footprint in MSPs and broad partner support.
Component marketplace with many third-party tools available out of the box.
Feature comparison
| Feature | Lavawall® | Datto RMM |
|---|---|---|
| Datto RMM component-based deployment | Yes. A ready-made Datto RMM component installs the Lavawall® agent; Lavawall® is a separate RMM | Native |
| Cross-platform agent (Windows, macOS, Linux) | Yes, single agent on all three | Yes |
| Windows third-party application patching | 7,400+ applications: included, single catalogue | ~25 in default Software Management; paid Advanced Software Management add-on (Windows-only) for a larger catalogue |
| macOS update management | Native, same agent and policy framework as Windows | Third-party SUPER [MAC] ComStore component; all-or-nothing pending-updates install, no granular selection |
| Linux update management | Native, Debian and RHEL families on the same agent | Separate Apt-get and Yum/Dnf ComStore components |
| GRC compliance framework coverage | 70+ frameworks including CMMC 2.0, NIST CSF, PIPEDA, NERC CIP | Check Datto's documentation |
| Microsoft 365 / Azure / Entra ID breach detection | Built-in identity threat detection and response (ITDR) with endpoint correlation | Check Datto's documentation |
| Google Workspace breach detection | Built-in | Check Datto's documentation |
| Administrator elevation and execution prevention (no kernel driver) | Yes | Check Datto's documentation |
| Replacement prioritization (battery/SMART/TPM/RAM) | Yes, built-in scoring across multiple signals | Check Datto's documentation |
| SaaS / shadow-AI discovery | Built-in (1,277 SaaS catalogue) | Check Datto's documentation |
| Free white-label sales tool (domain scanner) | Scout: embeddable, co-brandable | Check Datto's documentation |
| Helpdesk per-named-agent pricing | US$59/agent unlimited tickets | Check Datto's documentation |
| No high-water-mark billing | Yes | Check Datto's documentation |
Who should pick which?
Pick Lavawall® if…
You already use Datto RMM and want one RMM with remote support, cybersecurity, GRC, M365 breach detection, and refresh-priority analytics built in. Lavawall® deploys as a Datto component, and both can run side by side while you move over.
You want to consolidate five-to-seven separate tools (RMM, GRC, administrator elevation, M365 monitoring, helpdesk, remote support, file-change tracking) onto one platform that bills month-to-month.
Your clients are asking whether you meet CMMC 2.0, NIST CSF, PIPEDA, BC E-Health Act, Alberta HIA, NERC CIP, or other frameworks and you want continuous evidence collection.
You operate in Canada and want native CAD billing and Canadian-resident data hosting (AWS Montréal by default, moving to a Canadian-owned hosting provider in Vancouver in Q4 2026).
Pick Datto RMM if…
You are deeply invested in Datto/Kaseya IT Complete and need feature-for-feature parity with the rest of the suite.
You need very specific Datto-only integrations that Lavawall® does not yet ship.
You prefer one Kaseya invoice for everything, on Kaseya's agreement terms.
Frequently asked
- Does Lavawall® replace Datto RMM?
- Yes. Lavawall® covers remote support, patching, and scripting itself, along with cybersecurity, GRC, M365 / Google Workspace breach detection, and replacement-prioritization analytics. MSPs can install it as a Datto RMM component and run both side by side while they move over.
- How is Lavawall® deployed via Datto RMM?
- Lavawall® provides a downloadable Datto RMM component. You upload it to Datto, target sites or filters as you would for any other component, and Lavawall® installs across the target devices.
- Does Lavawall® cover the same patch catalogue as Datto RMM?
- Lavawall® publishes a public catalogue of 7,400+ applications across Windows, macOS, and Linux. Datto RMM's default Software Management catalogue covers roughly 25 third-party applications on Windows; broader Windows coverage requires the paid Advanced Software Management add-on, which per Datto's documentation is Windows-only. macOS updates on Datto RMM are handled by the third-party Install Updates with SUPER [MAC] ComStore component (an all-or-nothing pending-updates installer); Linux updates use separate Apt-get and Yum/Dnf components. MSPs can verify Lavawall® coverage in the public application catalogue before adopting.
- How is Lavawall® priced relative to Datto RMM?
- Lavawall® is month-to-month, with no high-water-mark billing and no minimum for single modules. Pricing in USD and CAD is published on the Lavawall® pricing page. Datto RMM pricing varies by Kaseya agreement.
Security and FIPS 140-3 by design
An RMM can end up holding the keys to everything it manages. Lavawall® is built the other way. The secrets that matter (vault items, server credentials, and any key pushed to an endpoint) are encrypted where you are and stored by us only as ciphertext, so an administrator with full access to our database sees encrypted blobs and nothing to open them with. See security and privacy.
Lavawall®’s relay and Windows and Mac agents use a FIPS 140-3 validated cryptographic module, the Go Cryptographic Module, NIST CMVP certificate #5247, and sign-in can be restricted to a FIPS 140-3 validated security key, the YubiKey 5 FIPS Series, certificate #5291. In-browser encryption uses the FIPS 140-3 approved algorithms. Full detail is on FIPS 140-3 support.
That same secret-handling powers WireGuard deployment across the fleet. Each endpoint generates its own private key locally and only the public key comes back, so the tunnel’s private key is never in a script, a log, or our database. Weighing Datto RMM for a regulated environment? This is the line worth checking against your obligation.
Related Lavawall® pages
- Canadian alternative to Datto RMM
- Datto RMM integration guide
- Best RMM-augmentation tools for MSPs
- GRC compliance automation for MSPs
- Microsoft 365 / Azure / Entra ID breach detection
- Cross-platform patch coverage (7,400+ apps)
- Lavawall® pricing
Datto and Datto RMM are trademarks of Kaseya. NinjaOne is a trademark of NinjaOne, LLC. Lavawall is not affiliated with either.