Will RMM augmentation eventually replace my RMM?

It can, but it does not have to. Lavawall® is an RMM itself, so it covers remote support, patching, and scripting. It can be installed through Datto RMM, NinjaOne, or any tool that runs a script, and both can run side by side while you move over. Some MSPs consolidate quickly; others take their time.

How disruptive is deploying an RMM augmentation tool?

Very little. If the tool deploys through your existing RMM, the disruption is small: nothing in your current RMM has to change. Lavawall® installs via a Datto component or a single PowerShell or bash command. The agent is silent on the endpoint and starts collecting evidence as soon as it is installed.

How is RMM augmentation different from XDR?

XDR (Extended Detection and Response) is a security-only category. It correlates endpoint, network, and cloud detection signals. RMM augmentation is broader: it covers security but also patching, GRC compliance, replacement prioritization, helpdesk, and remote support. Lavawall® includes XDR-class capabilities (M365 and Entra ITDR, ransomware indicator hunting, AV/EDR correlation), but it is an RMM, not an XDR.

Best RMM augmentation for MSPs

Best RMM augmentation tools for MSPs

RMM augmentation tools add the security, GRC, and cloud breach detection your RMM lacks, without forcing you to rip and replace on day one. Some are full RMMs, so you can augment your current RMM now and replace it when you are ready. Here is what to look for and how the major options compare.

Start free, no credit card What to look for

RMM augmentation tools install through your existing RMM (NinjaOne, Datto RMM, ConnectWise Automate, N-able N-central, Atera, Kaseya VSA, Pulseway, Syncro) and add the security, compliance, and analytics the RMM was not designed to deliver: GRC framework evidence, Microsoft 365 and Google Workspace breach detection, admin elevation, replacement analytics, and often helpdesk and remote support, from one console. Some are RMMs in their own right, so you can augment your current RMM or replace it. The best choice deploys through the RMM you already own, treats every client as a first-class tenant, and consolidates several point tools into one bill.

A traditional RMM excels at remote scripting, basic patching, and inventory. It does not, on its own, give you compliance evidence for CMMC 2.0 or NIST CSF; it does not detect Microsoft 365 or Google Workspace breaches; it does not run an indicator-of-compromise hunt for ransomware staging tools; and it does not produce co-branded posture reports for client QBRs.

Many MSPs respond by stacking five to seven separate point tools: a GRC tool, a SaaS-discovery tool, a cloud breach-detection tool, an application-control tool, an admin-elevation tool, a phishing-reporting tool, and a separate helpdesk. The result is fragmented data, friction during incidents, and a procurement bill that quietly creeps past US$1,000 per technician per month.

RMM augmentation tools take a different approach: one platform that installs through your existing RMM, adds what it lacks, and, if it is a full RMM, can replace it when you are ready.

What to look for in RMM augmentation

RMM-native deployment. The augmentation tool must deploy through your existing RMM the way you deploy everything else: as a Datto component, a NinjaOne automation, a ConnectWise script, an Atera script, a Kaseya VSA procedure, or a Microsoft Intune deployment. If you cannot push it from the RMM you already pay for, it will sit on a shelf.
Cross-platform parity. Your fleet is not Windows-only any more. Look for one agent that handles Windows, macOS, and Linux from one console: patching, configuration assessment, and security parity across all three.
GRC framework breadth. Your clients ask about CMMC 2.0, NIST CSF, CIS Controls, SOC 2, ISO 27001, HIPAA, PCI DSS, PIPEDA, BC E-Health Act, Alberta HIA, NERC CIP, CIRO, CPA Canada, and Australian Essential Eight. The augmentation tool should map your RMM's telemetry to these frameworks automatically.
Cloud breach detection. Microsoft 365, Entra ID, Azure, and Google Workspace breaches do not show up in RMM data. The augmentation tool should pull from those tenants directly and correlate the cloud signals with your endpoint data.
Replacement and reliability analytics. RMM lifecycle data is typically a static "first seen" date. Useful augmentation tools score replacement priority across battery cycles and capacity, drive SMART data, TPM version, available RAM, and processor age.
Per-named-agent helpdesk and remote support (optional). If you are already paying for Zendesk and Bomgar / BeyondTrust separately, an augmentation tool that bundles per-named-agent helpdesk and remote support can collapse three line items into one.
Multi-tenant by design. The tool should treat your client orgs as first-class tenants with isolation, white-label reporting, and per-client billing, not as tags on a single shared workspace.

Options to evaluate

Five credible approaches, with the workloads each one fits best.

Lavawall®

Multi-tenant RMM and remote support platform for MSPs and IT teams

Lavawall® is a multi-tenant RMM and remote support platform for MSPs and IT teams, with patching, security monitoring, Microsoft 365 and Google Workspace breach detection, and compliance built into the same agent and console. It can run on its own as your RMM, or be installed through Datto RMM, NinjaOne, ConnectWise, Atera, Kaseya, Intune, or any tool that runs a script, while you move over. Includes patching for 7,400+ applications, 70+ GRC frameworks, SaaS and shadow-AI discovery, replacement prioritization, administrator elevation and execution prevention (no kernel driver), and per-named-agent helpdesk. Built and used by ThreeShield, an audit firm.

Best when: MSPs that want remote support, patching, security, compliance, and breach detection in one platform, either alongside their current RMM while they move over or as their only RMM.

Huntress

Managed EDR / ITDR / SIEM

Strong managed detection and response for endpoints and Microsoft 365 with a 24/7 SOC. Focused on detection and response; check Huntress's documentation for patching and GRC coverage.

Best when: MSPs that want a managed SOC layer alongside endpoint AV; complementary to Lavawall®, which integrates with Huntress.

ThreatLocker

Application control and ringfencing

Mature kernel-driver-based application allowlisting and ringfencing. Strong if you want a deep zero-trust ringfencing model. Check ThreatLocker's documentation for GRC and breach-detection coverage.

Best when: MSPs whose primary need is enterprise-grade application allowlisting and who can absorb the operational overhead of kernel-level agents.

Vanta or Drata

GRC for SaaS companies

Single-tenant GRC platforms aimed at SaaS startups chasing SOC 2 / ISO 27001. Polished UX. Check Vanta's and Drata's documentation for multi-tenant and endpoint agent support.

Best when: A SaaS company's own corporate compliance, not for delivering compliance-as-a-service across many MSP client tenants.

CASB / SaaS-discovery point tools

Shadow-IT discovery

Standalone SaaS-discovery products typically priced for enterprise. Useful if you only need shadow-IT visibility and are willing to pay an enterprise CASB price.

Best when: Large enterprises with a dedicated CASB program and the budget for a separate enterprise tool.

How Lavawall® fits

Lavawall® is a multi-tenant RMM and remote support platform for MSPs and IT teams, with patching, security monitoring, Microsoft 365 and Google Workspace breach detection, and compliance built into the same agent and console. The pricing page describes a typical 50-device, 3-technician MSP running on five to seven separate tools: RMM/patch, GRC starter (Vanta/Drata-class), application control (ThreatLocker-class), M365 monitoring add-on, helpdesk (Zendesk-class), remote support (Bomgar/BeyondTrust-class), and SaaS discovery, and shows how Lavawall® consolidates patching, security, GRC, breach detection, administrator elevation, M365 monitoring, helpdesk, and remote support into one platform.

Lavawall® can run on its own as your RMM, or run alongside your current RMM while you move over. For Datto RMM users, Lavawall® is a deployable component. For NinjaOne, ConnectWise Automate, Atera, Kaseya VSA, and Microsoft Intune users, Lavawall® provides ready-made PowerShell and bash deployment scripts. If your RMM can run a script, you can deploy Lavawall®.

For MSPs already running Huntress, Sophos MDR, or Microsoft Defender for endpoint protection, Lavawall® integrates with all three via API and surfaces incidents in the same console as Lavawall's own findings, avoiding the multi-tab swivel-chair problem.

Admin Workspace: fix things without bothering the user

Lavawall® Remote Support includes the Admin Workspace, a private workspace where the technician works with administrator rights while the user keeps working undisturbed. There is no flashing screen and no moving cursor on their side.

Every tool you launch becomes its own tab in the browser, such as Registry Editor, Services, Event Viewer, and PowerShell as system, side by side, on desktop or mobile.

19 Windows tools plus PowerShell as system, PowerShell as the logged-in user, and Command Prompt as system on Windows; a root zsh shell on Mac.
One click to any of 50 Windows admin tools with administrator rights in any session, from desktop or phone, without elevating the user.
Multi-tenant, several technicians per session with hand-off of control, and browser-based: no jump box and nothing to install on your end.
Plus full remote control, remote shells without taking the screen, file transfer both ways, clipboard send and fetch, chat, choice of monitor, and a consent prompt the user can end at any time.

Frequently asked

Will RMM augmentation eventually replace my RMM?: It can, but it does not have to. Lavawall® is an RMM itself, so it covers remote support, patching, and scripting. It can be installed through Datto RMM, NinjaOne, or any tool that runs a script, and both can run side by side while you move over. Some MSPs consolidate quickly; others take their time.
How disruptive is deploying an RMM augmentation tool?: Very little. If the tool deploys through your existing RMM, the disruption is small: nothing in your current RMM has to change. Lavawall® installs via a Datto component or a single PowerShell or bash command. The agent is silent on the endpoint and starts collecting evidence as soon as it is installed.
How is RMM augmentation different from XDR?: XDR (Extended Detection and Response) is a security-only category. It correlates endpoint, network, and cloud detection signals. RMM augmentation is broader: it covers security but also patching, GRC compliance, replacement prioritization, helpdesk, and remote support. Lavawall® includes XDR-class capabilities (M365 and Entra ITDR, ransomware indicator hunting, AV/EDR correlation), but it is an RMM, not an XDR.

Start free →

Datto and Datto RMM are trademarks of Kaseya. NinjaOne is a trademark of NinjaOne, LLC. Lavawall is not affiliated with either.