A risktool is dual use software, such as a remote administration tool, that can support legitimate work or hidden control.
Security products may flag it because the same functions that help an administrator can also control a machine without consent.
How it works
Remote shells, file transfer, and screen viewing are ordinary in support contracts.
When the same program appears without a ticket, without an owner, or configured to hide, reviewers treat it as a risk rather than as approved administration.
The label is not a verdict that the file is crimeware.
Context decides: who installed it, whether the vendor is expected, and whether the user can see and stop it.
Concrete examples
- A managed service installs a known remote tool under a contract and documents the host list.
- An unexpected remote tool starts at boot on a laptop that has no support agreement.
- A lab uses a dual use utility for research and keeps it off the production image.
Protective measures
- Allow named administration tools only through your software catalog and block the rest on sensitive hosts.
- Require a ticket and a visible session for remote control, and alert when a tool runs silently.
- Remove dual use utilities from standard builds unless a team has a documented need.
- Investigate a risktool alert as context, looking for consent and ownership before you wipe a machine.