Yes. Lavawall® is a multi-tenant RMM and remote support platform for MSPs and IT teams. It includes monitoring, patching for more than 7,400 applications, scripting, and browser-based remote support, along with security monitoring, Microsoft 365 and Google Workspace breach detection, and compliance evidence on the same agent.

Is Lavawall a Datto RMM component?

No. Lavawall® is its own RMM, made by ThreeShield Information Security Corporation in Canada. It has a ready-made Datto RMM component that installs the Lavawall agent on the computers Datto RMM already manages, and it installs through NinjaOne, ConnectWise, Kaseya VSA, Intune, or any tool that runs a script. Many teams start that way, use the Lavawall features they need first, and move remote support, patching, and scripts over when they are ready.

Can Lavawall replace Datto RMM or NinjaOne?

Yes, for most MSPs and IT teams that manage Windows and Mac computers, with Linux covered by scripts, patching, and monitoring. You do not have to do it all at once: install Lavawall through your current RMM, use the features you need first, and move over one company at a time while both agents run side by side.

Can Lavawall be used for compliance without replacing our RMM?

Yes. GRC and RMM are tightly integrated but can be used separately. Many teams start with the RMM, and when an assessment or a client security questionnaire comes up, the evidence the RMM has been collecting is ready to use. Others start with GRC and turn on the RMM later.

Can Lavawall support a computer that doesn't have the agent installed?

Yes. Ad-hoc support lets a technician connect to a computer without the Lavawall agent for a one-off session, from the same console.

Does Lavawall support Linux?

Yes, for scripts, patching, and monitoring. Remote control of the Linux desktop is not available; remote control covers Windows and Mac.

Can a technician fix a computer without interrupting the user?

Yes. The Admin Workspace lets a technician use Task Manager, Services, the Registry Editor, Event Viewer, File Explorer, Programs & Features, Disk Cleanup, and 12 other Windows tools with administrator rights, open PowerShell or Command Prompt, and move files of up to 2 GB to the computer, while the user keeps working and sees nothing on their screen. On Mac, a zsh shell with root access works the same way.

Can Lavawall run commands as the logged-in user?

Yes, on Windows. A PowerShell session can run as the logged-in user, in their own profile and environment, without appearing on their screen. PowerShell and Command Prompt with full system rights are also available, and a zsh shell with root access on Mac.

Does Lavawall include administrator elevation?

Yes, for Windows. Standard users request administrator rights when they need them; Lavawall approves, denies, or sends the request to a technician according to the company's rules, so nobody needs standing administrator rights.

Is Lavawall FIPS 140-3 validated?

Lavawall uses FIPS 140-3 validated cryptographic modules in specific components: the Go Cryptographic Module (CMVP certificate #5247) in the relay and the Windows and Mac agents, and YubiKey 5 FIPS (certificate #5291) for hardware technician authentication. The product as a whole is not a cryptographic module and has no certificate of its own.

Does Lavawall work from a phone?

Yes. The console, remote control included, is built to be used from a phone or tablet, with an on-screen keyboard and the special keys a technician needs.

Who makes Lavawall, and where is it hosted?

Lavawall is built in Canada by ThreeShield Information Security Corporation, a CISSP and CISA cybersecurity audit firm founded in 2006. Data can be hosted in Canada, the United States, Europe, or Australia.

Is Lavawall an RMM? Yes. Here is what it includes

Is Lavawall an RMM?

Yes. Lavawall® is a multi-tenant RMM and remote support platform for MSPs and IT teams, with patching, security monitoring, Microsoft 365 and Google Workspace breach detection, and compliance built into the same agent and console. Lavawall® is made in Canada by ThreeShield Information Security Corporation.

Technicians get browser-based remote control, a background admin workspace, and a remote shell on Windows and Mac, scripting on Linux, and ad-hoc support for computers without the agent, with end-to-end encrypted sessions available.

Lavawall can run on its own as your RMM, or be installed through Datto RMM, NinjaOne, ConnectWise, Kaseya, Intune, or any tool that runs a script, while you move over.

Start a 14-day free trial What it includes

14-day trial of the full platform, no credit card. Then month-to-month, with no long-term contract and no high-water-mark billing.

What makes Lavawall® an RMM

Lavawall® does the jobs people expect from an RMM, on its own agent and in its own multi-tenant console:

Monitoring of processes, performance, event logs, and battery health, with alerts and a computer-replacement priority list.
Patching for more than 7,400 applications on Windows, Mac, and Linux, and software deployment.
Scripts on Windows, Mac, and Linux, including imported Datto RMM scripts with their variables detected automatically.
Browser-based remote control of Windows and Mac computers, remote shells, and ad-hoc support for computers without the agent.
Network, LAN, WAN, and Ubiquiti/UniFi monitoring.
Event logs and per-process CPU and memory history, ready when a technician opens a device.

On the same agent and console

Microsoft 365 and Google Workspace breach detection, and Microsoft 365, Entra, and Azure configuration backup and rollback.
One view of Sophos, Huntress, and Microsoft Defender alerts, plus ransomware hunting.
Compliance evidence for 70+ frameworks, including CMMC 2.0, HIPAA, SOC 2, and ISO 27001.
Administrator elevation for Windows, with certificate-based rules and ringfencing, plus execution prevention for high-risk tools.
A password vault where the server never sees the stored passwords.
Help desk, CRM, website chat, and billing.

Pricing is month-to-month or annual, with modules bought individually, billing in Canadian or US dollars, and 50% off for not-for-profits. See pricing.

Remote support included

For the technician

Remote control from any modern browser, with nothing to install on the technician's side, including from a phone or tablet with an on-screen keyboard, Ctrl, Alt, Tab, and Esc keys, and Bluetooth keyboard support.
Full-screen mode with its toolbar, choice of monitor on multi-monitor computers, clipboard sending and fetching, and the remote computer's real cursor shape.
File transfer in both directions: uploads of up to 2 GB per file, and downloads with no fixed size limit.
Chat with the person at the computer, inside the session.
Several technicians in the same session, with hand-off of control.
Ad-hoc support: connect to a computer that does not have the Lavawall® agent installed, for a one-off session.
Scripts on Windows, Mac, and Linux, including imported Datto RMM scripts. A company can also be limited to the signed script library built into the agent, so a stolen console session cannot push an arbitrary script.
Push notifications to the technician's phone for requests that need a decision.

For the customer and the security team

The person at the computer can be asked for consent before a session, set per company, and can end sharing at any time.
Per-technician access scope: which companies each technician may reach at all.
Technician access limited by IP address and by country. Country restriction is on by default.
Sign-in with passkeys or hardware security keys, and technicians can be required to use a hardware key before a session starts.
End-to-end encrypted sessions are available. The relay carries encrypted traffic and holds no key for it. Each computer has its own key, held in the TPM on Windows and the Secure Enclave on Mac, and it cannot be exported.
Session logging: every connection and every command sent is logged, and screen captures can be attached to the ticket when the technician wants a record.
Every session and administrative action is written to a tamper-evident activity log.
Data residency in Canada, the United States, Europe, or Australia, and a US-only path for tenants that need one.

Start beside your current RMM, move over when you are ready

Lavawall® installs through Datto RMM with a ready-made component, or through NinjaOne, ConnectWise, Kaseya, Intune, or any tool that runs a script. Your first step is small. Lavawall® deploys in minutes through the RMM you already run, on one company or on all of them, and works alongside it while your staff build comfort with it, starting with the features you need most. Moving is quick when you are ready: the Datto RMM component and the install scripts for other RMMs take minutes, and Datto RMM scripts import into Lavawall® with their variables detected automatically. Most organizations that start this way end up running their RMM work in Lavawall®, one company at a time, once they have used the two side by side. If it does not earn its place, uninstall it: Lavawall® installs no kernel driver, so the agent comes off cleanly.

Start a 14-day free trial Talk to a human

14-day trial of the full platform, no credit card. Then month-to-month, with no long-term contract and no high-water-mark billing.

Security questionnaires become a lookup, not a fire drill

GRC (compliance management) and RMM are tightly integrated in Lavawall®, and each can be used on its own. When a client questionnaire, a cyber-insurance renewal, or a SOC 2 or CMMC assessment asks for patch status, disk encryption, endpoint protection, and administrator rights on every computer, the RMM has been collecting that all along. The GRC module turns it into dated evidence for that company, so you look up the answer instead of gathering screenshots from several tools and rebuilding a spreadsheet.

Need compliance first? Start with GRC and turn on the RMM when you are ready.

How Lavawall compares

Lavawall® vs. Datto RMM: both are RMMs; how remote support, patching, security, and compliance compare.
Lavawall® vs. NinjaOne: the same comparison against NinjaOne.
The full Lavawall® RMM and all Lavawall® features.

Frequently asked questions

Is Lavawall an RMM?: Yes. Lavawall® is a multi-tenant RMM and remote support platform for MSPs and IT teams. It includes monitoring, patching for more than 7,400 applications, scripting, and browser-based remote support, along with security monitoring, Microsoft 365 and Google Workspace breach detection, and compliance evidence on the same agent.
Is Lavawall a Datto RMM component?: No. Lavawall® is its own RMM, made by ThreeShield Information Security Corporation in Canada. It has a ready-made Datto RMM component that installs the Lavawall agent on the computers Datto RMM already manages, and it installs through NinjaOne, ConnectWise, Kaseya VSA, Intune, or any tool that runs a script. Many teams start that way, use the Lavawall features they need first, and move remote support, patching, and scripts over when they are ready.
Can Lavawall replace Datto RMM or NinjaOne?: Yes, for most MSPs and IT teams that manage Windows and Mac computers, with Linux covered by scripts, patching, and monitoring. You do not have to do it all at once: install Lavawall through your current RMM, use the features you need first, and move over one company at a time while both agents run side by side.
Can Lavawall be used for compliance without replacing our RMM?: Yes. GRC and RMM are tightly integrated but can be used separately. Many teams start with the RMM, and when an assessment or a client security questionnaire comes up, the evidence the RMM has been collecting is ready to use. Others start with GRC and turn on the RMM later.
Can Lavawall support a computer that doesn't have the agent installed?: Yes. Ad-hoc support lets a technician connect to a computer without the Lavawall agent for a one-off session, from the same console.
Does Lavawall support Linux?: Yes, for scripts, patching, and monitoring. Remote control of the Linux desktop is not available; remote control covers Windows and Mac.
Can a technician fix a computer without interrupting the user?: Yes. The Admin Workspace lets a technician use Task Manager, Services, the Registry Editor, Event Viewer, File Explorer, Programs & Features, Disk Cleanup, and 12 other Windows tools with administrator rights, open PowerShell or Command Prompt, and move files of up to 2 GB to the computer, while the user keeps working and sees nothing on their screen. On Mac, a zsh shell with root access works the same way.
Can Lavawall run commands as the logged-in user?: Yes, on Windows. A PowerShell session can run as the logged-in user, in their own profile and environment, without appearing on their screen. PowerShell and Command Prompt with full system rights are also available, and a zsh shell with root access on Mac.
Does Lavawall include administrator elevation?: Yes, for Windows. Standard users request administrator rights when they need them; Lavawall approves, denies, or sends the request to a technician according to the company's rules, so nobody needs standing administrator rights.
Is Lavawall FIPS 140-3 validated?: Lavawall uses FIPS 140-3 validated cryptographic modules in specific components: the Go Cryptographic Module (CMVP certificate #5247) in the relay and the Windows and Mac agents, and YubiKey 5 FIPS (certificate #5291) for hardware technician authentication. The product as a whole is not a cryptographic module and has no certificate of its own.
Does Lavawall work from a phone?: Yes. The console, remote control included, is built to be used from a phone or tablet, with an on-screen keyboard and the special keys a technician needs.
Who makes Lavawall, and where is it hosted?: Lavawall is built in Canada by ThreeShield Information Security Corporation, a CISSP and CISA cybersecurity audit firm founded in 2006. Data can be hosted in Canada, the United States, Europe, or Australia.

Datto and Datto RMM are trademarks of Kaseya. NinjaOne is a trademark of NinjaOne, LLC. Lavawall is not affiliated with either.