Remediation
What Revo changes on customer systems, how agent fixes work, and what stays with your own tools.
Updated
Revo finds and explains problems, and fixes some of them through RevoAgent. Everything that changes a customer system is opt-in per customer, runs as a job signed by Revo and checked by the agent, and is recorded in the audit log.
What Revo changes
| What | Where | Turned on by |
|---|---|---|
| Installing approved Windows, winget, Linux package and macOS updates; restarts in maintenance windows; Windows version upgrades | Patch management | Patch management for the customer |
| Fixing security misconfigurations with a fixed catalogue of actions (Defender, firewall, SMBv1, Remote Desktop NLA, security services, unsupported applications, macOS and Linux hardening, diagnostics) | Fix with the agent | Customer settings → Remediation |
| Restarting the agent, refreshing its report, uninstalling it | Device actions | Always available to technicians |
How agent fixes stay safe
- Opt-in per customer. Off until an owner or admin with two-factor authentication turns it on.
- A fixed catalogue. The agent only runs actions compiled into it, with arguments it validates itself. It never runs scripts or commands sent from the server, and no action turns a protection off.
- See it, then run it. Whoever starts a fix sees exactly what will run (devices, maintenance window, arguments, what users will notice) and confirms it; nothing waits for anyone else's approval. High-risk and disruptive fixes are for owners and admins with two-factor authentication, who type the number of devices to confirm (see Who can run a fix).
- Signed when due. Jobs are signed only when each device is due (now, or just before its maintenance window), and checked again when the device picks them up.
- Verified. The agent reads the setting back; RevoSecure then re-checks the finding from fresh data.
- Local control. The device's own administrator can switch fixes off or allow only dry runs (see Local controls on the device).
What stays with your tools
- Microsoft 365, ThreatLocker, PSA and other integrations are read-only. Revo doesn't change tenant settings, policies or tickets' status; it creates PSA tickets when you ask.
- AI remediation plans are drafts with scripts, verification and rollback steps that you review and run yourself (see AI approvals). The AI analyst can't start agent fixes; it proposes them, explains them and links you to Fix with agent, where you start them.