Lavawall® vs. Datto RMM: remote support, RMM, and security compared

Security questionnaires become a lookup, not a fire drill

GRC (compliance management) and RMM are tightly integrated in Lavawall®, and each can be used on its own. When a client questionnaire, a cyber-insurance renewal, or a SOC 2 or CMMC assessment asks for patch status, disk encryption, endpoint protection, and administrator rights on every computer, the RMM has been collecting that all along. The GRC module turns it into dated evidence for that company, so you look up the answer instead of gathering screenshots from several tools and rebuilding a spreadsheet.

Need compliance first? Start with GRC and turn on the RMM when you are ready.

Evidence collected from the RMM includes:

• managed device inventory;
• patch state by device;
• disk encryption state;
• endpoint protection coverage;
• administrator rights, and administrator elevation rules and decisions;
• compliance console access, access reviews, and control attestations;
• password vault collections and sharing;
• security training completion and phishing simulation results;
• published policies and their attestations.

Each file records what was collected, the filter used, when it ran (UTC), and for which company, so it still makes sense to an auditor a year later. The evidence maps to 70+ compliance frameworks, including CMMC 2.0, HIPAA, SOC 2, and ISO 27001. Lavawall® is built by ThreeShield, a CISSP and CISA cybersecurity audit firm.

Patching: Datto’s Advanced Software Management compared

Datto RMM’s broader Windows third-party catalogue is its Advanced Software Management add-on. Datto’s own documentation and published catalogue set out its limits:

• Programs can close without warning. Datto says that during Advanced Software Management updates, “certain software applications will forcibly close without warning.” Lavawall® waits until the program is closed, warns the user, or installs the update at the next reboot.
• No ARM devices. Datto says Advanced Software Management “is not currently supported for use on ARM-based devices.” Lavawall® supports ARM-based computers.
• Windows only. Datto says it is “currently only supported for Windows OS devices.” Lavawall® patches Windows, Mac, and Linux from the same agent.
• Up to 10 business days for most applications. Datto sorts applications into three tiers, updated within 1, 5, or 10 business days, with Tier 3 covering “less critical” software and everything not placed in a higher tier. By our count, most entries in the catalogue are Tier 3. Lavawall® keeps applications up to date daily.
• A smaller catalogue than the count suggests. On 18 September 2026, Datto’s catalogue listed 315 entries. By our count, 115 of them are versions of Microsoft software, such as Office, .NET, and Visual C++, which Lavawall® updates through Microsoft, leaving about 200. Dozens of those are separate 32-bit and 64-bit entries for the same product, and 16 are marked discontinued. Lavawall®’s public catalogue lists more than 7,400 applications.
• No proxy-configured agents. Datto says Advanced Software Management “does not currently support proxy-configured Datto RMM agents.”

Quotes are from Datto’s Advanced Software Management and catalogue pages, read 28 September 2026; the catalogue counts are ours, from the catalogue as published on 18 September 2026. Tell us if something has changed and we will correct it.

Remote sessions protected by FIPS 140-3 validated cryptography

Remote sessions are protected by FIPS 140-3 validated cryptography in the relay and the Windows and Mac agents (Go Cryptographic Module, NIST CMVP certificate #5247), and end-to-end encrypted sessions are available: in an end-to-end encrypted session, the relay holds no session key and cannot read the session. Technicians can be required to sign in with a YubiKey 5 FIPS hardware key (CMVP certificate #5291) before a session starts.

A useful question for any remote support vendor: who, at your company or in your cloud, can see my customer's screen? With an end-to-end encrypted Lavawall® session, the relay in the middle carries encrypted traffic and has no key for it. See FIPS 140-3 support for exactly what each validated module covers.

Administrator elevation, built in

Lavawall® includes just-in-time administrator rights for Windows users on the same agent. When a standard user hits an administrator prompt, Lavawall checks the request against the company's rules and approves it, denies it, or sends it to a technician, who can approve it from a phone notification. Nobody needs standing administrator rights.

• Rules can match a publisher's code-signing certificate, a thumbprint, a file hash or a path. Certificate rules are preferred and survive routine certificate renewals.
• An MSI installer can be approved for one specific package, not all of msiexec.
• Ringfencing: an elevated program can be blocked from starting other programs, reading files, or using the network.
• Execution prevention: a curated block list of the tools ransomware commonly uses, such as the ones that delete shadow copies or clear logs, rolled out in audit mode first. Enforcement is allowed only after the audit shows what would have been blocked.
• Offline approval with a one-time code when the computer has no connection.
• The rule set each computer follows is signed, and the computer verifies the signature before applying it.
• It installs automatically through the Lavawall® agent, with no separate enrolment code.

Administrator elevation is available for Windows. See administrator elevation for the details.

Shells at system level or as the logged-in user

On Windows, a technician can open PowerShell with system rights, PowerShell as the logged-in user, or Command Prompt with system rights. The user-level PowerShell runs inside that person's own session, profile, and environment, so per-user installs (for example with winget), mapped drives and user settings work, and nothing appears on their screen.

On a Mac, a zsh shell with root access runs in the Admin Workspace. Each shell opens in seconds as a live terminal in the browser, including from a phone, with Ctrl, Alt, and the other special keys. Linux computers run scripts.

Event logs and process history, ready before you ask

Lavawall® collects and sorts Windows event logs and per-process resource use in the background. When a technician opens a device, the important events are already sorted and each running process has a chart of its CPU and memory use over time. There is no waiting for Event Viewer or Task Manager to load on a slow computer, and it works when the computer is too busy to use comfortably.

Making the case to your team

One line for your partners or manager: We can try Lavawall® on one client in minutes through Datto RMM with the ready-made component, without changing anything in Datto RMM. There is no credit card to start, it is month-to-month after that, and if it does not earn its place we uninstall it.

Before you compare prices, list what you pay for today beside Datto RMM: a remote support tool for computers without the agent, a password manager, administrator elevation, compliance evidence, security awareness training, and Microsoft 365 configuration backup. Compare that total with Lavawall® pricing.

Email this page to a colleague

Frequently asked questions

Is Lavawall an RMM?

Yes. Lavawall® is a multi-tenant RMM and remote support platform for MSPs and IT teams. It includes monitoring, patching for more than 7,400 applications, scripting, and browser-based remote support, along with security monitoring, Microsoft 365 and Google Workspace breach detection, and compliance evidence on the same agent.

Can Lavawall replace Datto RMM?

Yes, for most MSPs and IT teams that manage Windows and Mac computers, with Linux covered by scripts, patching, and monitoring. You do not have to do it all at once: start with the Datto RMM component, use the Lavawall features you need first, and import your Datto RMM scripts with their variables detected automatically.

Is Lavawall a Datto RMM component?

No. Lavawall® is its own RMM, made by ThreeShield Information Security Corporation in Canada. It has a ready-made Datto RMM component that installs the Lavawall agent on the computers Datto RMM already manages, and it installs through NinjaOne, ConnectWise, Kaseya VSA, Intune, or any tool that runs a script. Many teams start that way, use the Lavawall features they need first, and move remote support, patching, and scripts over when they are ready.

How does Lavawall patching compare with Datto RMM Advanced Software Management?

Lavawall patches more than 7,400 applications on Windows, Mac, and Linux. Datto's documentation also says Advanced Software Management is not supported on ARM-based devices, can forcibly close some applications without warning, and takes up to 10 business days for Tier 3 applications. Lavawall keeps applications up to date daily, waits for the program to close, warns the user, or updates at reboot, and supports ARM.

Can Lavawall and Datto RMM run on the same computers?

Yes. Both agents run side by side while you move over, so there is no cut-over weekend. Lavawall installs no kernel driver, so the agent uninstalls cleanly if you decide not to keep it.

Can we bring our Datto RMM scripts?

Yes. Datto RMM scripts import into Lavawall®, and their input variables are detected automatically.

Do we pay for both while we move?

You pay for Lavawall only for what you add to it, month-to-month, with no long-term contract and no high-water-mark billing, so your Lavawall bill grows as companies move over. Modules can be bought individually if you want to start with one. Paid tiers have a starting size; the pricing page lists current rates in Canadian and US dollars.

How much will our technicians need to learn?

Less than you might expect. The console runs in a browser, including on a phone, and the Admin Workspace opens the Windows tools technicians already use, such as Task Manager, Services, the Registry Editor, and Event Viewer. Starting with one company lets them learn on real tickets while your current RMM keeps running.

What if we decide Lavawall is not for us?

There is no long-term contract and no minimum term, your data is yours to export, and the agent uninstalls cleanly because Lavawall installs no kernel driver.

How does Lavawall remote support compare with Datto RMM Web Remote?

Both run in the browser. Lavawall's remote support includes end-to-end encrypted sessions in which the relay holds no key, ad-hoc sessions for computers without the agent, an Admin Workspace with 19 Windows tools and three shells, 50 Windows admin tools one click away with administrator rights, technician access limited by country by default, and uploads of up to 2 GB. Datto's documentation says Web Remote controls Windows and macOS devices with a Managed Agent installed, allows up to four users on one device at a time, and limits uploads to 1 GB per file.

Can Lavawall be used for compliance without replacing our RMM?

Yes. GRC and RMM are tightly integrated but can be used separately. Many teams start with the RMM, and when an assessment or a client security questionnaire comes up, the evidence the RMM has been collecting is ready to use. Others start with GRC and turn on the RMM later.

Is Lavawall FIPS 140-3 validated?

Lavawall uses FIPS 140-3 validated cryptographic modules in specific components: the Go Cryptographic Module (CMVP certificate #5247) in the relay and the Windows and Mac agents, and YubiKey 5 FIPS (certificate #5291) for hardware technician authentication. The product as a whole is not a cryptographic module and has no certificate of its own.

Who makes Lavawall, and where is it hosted?

Lavawall is built in Canada by ThreeShield Information Security Corporation, a CISSP and CISA cybersecurity audit firm founded in 2006. Data can be hosted in Canada, the United States, Europe, or Australia.