ConnectWise Automate (formerly LabTech) is one of the most scriptable RMMs in the market. Mature plug-in ecosystem, deep customisation, and tight integration with ConnectWise Manage (PSA) make it a long-standing choice for mid-to-large MSPs.
Like every RMM, Automate was built for IT operations, not for cybersecurity, GRC compliance evidence, multi-cloud breach detection, or replacement-prioritization analytics. MSPs running ConnectWise Automate consistently layer additional tools on top to fill those gaps.
Lavawall® is the augmentation layer: it deploys via ConnectWise Automate as a script and runs alongside it, providing the security, GRC, and analytics layer Automate was never designed for.
Where Lavawall® wins for MSPs
Lavawall® delivers the security depth, compliance evidence, and breach-detection coverage that Automate does not address natively. For MSPs delivering CMMC 2.0, CPCSC, SOC 2, HIPAA, PCI DSS, or cyber-insurance readiness, Lavawall® is the evidence base; Automate is the operational tool.
Cross-platform parity is a particular gap in many Automate deployments: strong on Windows, thinner on macOS and Linux. Lavawall® treats Windows, macOS, and Linux as first-class platforms with one agent, one console, one set of compliance reports.
For MSPs already running Automate plus a separate Vanta / Drata-class GRC tool, a separate ThreatLocker-class app-control tool, a separate M365 monitoring add-on, a separate Zendesk-class helpdesk, and a separate Bomgar-class remote support tool, the Lavawall® / Automate combination consolidates the security, GRC, breach detection, app control, helpdesk, and remote support into one platform alongside Automate.
On remote support specifically, the contrast is sharp. ConnectWise ScreenConnect's Backstage has aged badly on Windows 11, the user's mouse still moves sometimes, many apps aren't properly supported, and the toolset is tiny. Lavawall's intelligent Backstage instead extends the real built-in Windows admin apps: a grouped Task Manager with live CPU, memory, disk, network and thread stats, per-process detail (parent, children, signature), an enriched file explorer you can run or download from, Services, Startup, and a self-classifying Event Log, plus draw-on-screen teaching, automatic cursor hand-off, and plain-language restart reasons, all in the browser, nothing to install, and without the user seeing a thing.
Where ConnectWise Automate wins
ConnectWise Automate is one of the most scriptable RMMs in the market. The plug-in ecosystem, the depth of customisation, and the native ConnectWise Manage / Sell / SiteBoss integration are differentiators no augmentation layer replaces.
For mid-to-large MSPs deeply invested in the ConnectWise stack (Manage for PSA, Automate for RMM, ScreenConnect for remote control, Sell for quoting), Automate stays the operational core. Lavawall® augments rather than replaces.
Where the customer's primary need is sophisticated scripting orchestration with custom plug-ins and bespoke ConnectWise Manage workflows, Automate is the right tool.
Feature comparison
| Feature | Lavawall® | ConnectWise Automate |
|---|---|---|
| Deep scripting and plug-in ecosystem | Standard scripting and APIs | Yes, mature scripting and plug-in ecosystem |
| Tight ConnectWise Manage (PSA) integration | Via API / standard webhooks | Native |
| Cross-platform agent (Windows, macOS, Linux) | Full security parity across all three | Windows-strong, mac/Linux limited |
| Public application patch catalog | 7,400+ applications, published openly | Patch Manager add-on, varying depth |
| Compliance framework mapping (CMMC 2.0 / NIST / SOC 2 / HIPAA) | 15+ frameworks; continuous evidence with System Security Plan (SSP) and remediation plan (POA&M) | Reports; not framework-mapped GRC platform |
| M365 / Entra ID / Azure breach detection with endpoint correlation | Native multi-tenant identity threat detection and response (ITDR) | Limited |
| Google Workspace breach detection | Native | Limited |
| Application control (allowlisting / elevation) without kernel driver | Native, kernel-free | No |
| Curated SaaS / shadow-AI discovery (1,130+ catalog) | Native with user attribution | No |
| Replacement prioritization (battery / TPM / SMART / RAM / age) | Multi-factor scoring | Lifecycle dates |
| Akira ransomware indicator hunter | Native | No |
| Built and used by an audit firm | ThreeShield (CISSP / CISA) | No |
Who should pick which?
Pick Lavawall® if…
MSPs running ConnectWise Automate that need a security, GRC, breach-detection, and analytics platform alongside it.
MSPs delivering CMMC 2.0, CPCSC, SOC 2, HIPAA, PCI DSS, ISO 27001, NIST CSF, CIS, PIPEDA, or Australian Essential Eight readiness as a service.
MSPs whose macOS / Linux fleet has grown past Automate's Windows-centric strengths.
Pick ConnectWise Automate if…
Mid-to-large MSPs deeply invested in the ConnectWise stack with the engineering bandwidth to maintain custom Automate plug-ins and orchestrations.
MSPs whose security and compliance needs are handled by separate dedicated tooling and whose RMM choice is independent of those concerns.
Frequently asked
- Does Lavawall® replace ConnectWise Automate?
- It can (Lavawall® provides patching, scripting, remote support, and inventory), but for ConnectWise-centric MSPs, the typical pattern is augmentation: keep Automate for orchestration and Manage integration, add Lavawall® for security, GRC, and analytics.
- Can Lavawall® be deployed through ConnectWise Automate?
- Yes. Single-line PowerShell / bash deployment scripts can be pushed via Automate to Windows, macOS, and Linux endpoints.
- Does Lavawall® integrate with ConnectWise Manage (PSA)?
- Yes, via API. Lavawall® has dedicated ConnectWise integration documented at /connectwise.php on lavawall.com.
- Will Lavawall® conflict with the Automate agent?
- No. Lavawall® coexists with major RMM agents without conflicts.
Security, FIPS 140-3, and zero-knowledge by design
Most RMMs hold the keys to everything they manage. Lavawall® is built the other way. The secrets that matter, vault items, server credentials, and any key pushed to an endpoint, are encrypted where you are and stored by us only as ciphertext, so an administrator with full access to our database sees encrypted blobs and nothing to open them with. See security and privacy.
Lavawall®’s agents and relay run on a FIPS 140-3 validated cryptographic module, the Go Cryptographic Module, NIST CMVP certificate #5247, and sign-in can be restricted to a FIPS 140-3 validated security key, the YubiKey 5 FIPS Series, certificate #5291. In-browser encryption uses the FIPS 140-3 approved algorithms. Full detail is on FIPS 140-3 support.
That same secret-handling powers WireGuard deployment across the fleet. Each endpoint generates its own private key locally and only the public key comes back, so the tunnel’s private key is never in a script, a log, or our database. An RMM that automates a VPN with a script carries that key through its job history and the vendor’s database instead. Weighing ConnectWise Automate for a regulated environment? This is the line worth checking against your obligation.