HCL BigFix

Why HCL BigFix?

Patching is the piece of IT automation whose value is measured in what does not happen, which is why it loses to visible work every quarter. The thing worth buying here is not the deployment but the evidence: proof, per machine, that the update actually landed.

The most exploited vulnerability is the one whose patch has been available for a long time and was never applied. Remote employees rarely sit on the corporate network, and a separate tool for every operating system means separate reports that someone has to stitch together by hand before every audit.

HCL BigFix is an endpoint management platform for mixed environments: Windows and macOS workstations, Linux servers and Unix systems are managed by one agent and one console. Automated patching is built on checking the state of each machine after the task has run, not on the mere fact that a package was sent — so the report shows where the patch is actually installed and where someone has to go back.

How does BigFix work?

One agent, one console

Every device runs a single agent that handles all platform functions and reports results to a shared console:

• one agent for patching, software distribution, inventory and compliance checks,
• the same console for workstations, servers and Unix systems,
• one source of truth about device state for both the operations team and the security team.

Continuous policy compliance

The agent compares the device configuration with the approved policy and flags deviations. Selected deviations can be corrected automatically, and the compliance report is built from the same data the operations team uses every day — with no separate evidence gathering before an audit.

Patching with state confirmation

Operating system and third-party application patches are deployed according to schedules and maintenance windows. Once the task has run, the agent checks the machine again, so the report shows the difference between “sent” and “installed” — and the list of devices that need another attempt.

What’s new in BigFix 11

BigFix 11 is the current version of the platform, and HCL documentation describes the changes delivered in its successive updates. The most important ones from a security and administration perspective:

• Cryptography: BigFix 11 added support for TLS 1.3, SHA-384 and OpenSSL 3.
• Regulated environments: organizations operating in regulated sectors and public administration can enable FIPS 140-3 mode, and the BigFix encryption module holds FIPS 140-3 certification.
• Console and download protection: an idle, logged-in console session can be locked automatically, and action scripts that download files support SHA-512.
• Custom content as code: custom BigFix content can be managed like code — the platform connects directly to a Git repository and treats it as a content site.
• User and device data: BigFix retrieves from Active Directory and Microsoft Entra ID the user associated with a computer and the user and computer groups it belongs to.
• Read-only users: the console supports read-only user accounts that can see the state of the environment but cannot run actions.
• New systems: the agent also runs on Linux and macOS on ARM processors — example versions are listed in the table below.
• Scale: a single relay on Windows or Red Hat Enterprise Linux supports up to 20,000 endpoints.
• Automation: the BigFix Server REST API supports token authentication, so scripts and integrations do not need to store passwords.

BigFix Platform MCP Server — AI agents within permissions

BigFix Platform MCP Server lets AI agents and clients work with BigFix through natural language commands over the Model Context Protocol (MCP). The MCP Server does not create a shared privileged identity and does not bypass BigFix permissions: every request runs under the operator identity from the forwarded token. For every MCP request, the BigFix root server validates the token, identifies the operator and applies role-based access control (RBAC).

Administrators can additionally restrict the MCP Server to read-only mode or require human approval before an operation runs. The MCP Server relies on REST API token authentication introduced in BigFix 11 updates, and incoming MCP requests can be disabled entirely on the root server.

Key Features

Patching

• operating system patches for Windows, macOS, Linux and Unix,
• third-party application patches,
• schedules, maintenance windows and restart control,
• installation confirmed on every machine.

Software distribution and inventory

• silent installation and removal of software,
• hardware and software inventory,
• visibility of installed application versions on every device.

Configuration compliance

• comparison of configuration with the security policy,
• automatic correction of selected deviations,
• audit-grade compliance reports built from operational data.

Vulnerabilities

• mapping vulnerabilities to the patches that remove them,
• tracking remediation progress across devices.

Supported Platforms

The table shows example versions from HCL documentation for BigFix 11 — the agent runs on systems including those below. The full and current list of versions, architectures and components is in the HCL support matrix (BigFix Support Matrix); before deployment we check the versions your organization actually uses against it.

Family	Example versions
Windows	Windows 10, Windows 11, Windows 11 ARM64
Windows Server	Windows Server 2022, Windows Server 2025
macOS (Apple silicon and Intel)	macOS Sonoma 14, macOS 15, macOS 26, macOS 27 (ARM)
Red Hat Enterprise Linux	Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 10 (also ARM)
Ubuntu	22.04 LTS, 24.04 LTS, 26.04 LTS (also ARM)
Debian	Debian 12, Debian 13 (also ARM)
SUSE Linux Enterprise Server	SUSE Linux Enterprise Server (SLES) 15, 16
Other Linux distributions	Rocky Linux 10, Alma Linux 10, Oracle Enterprise Linux 10, Amazon Linux 2023
AIX	AIX 7.2, 7.3
Solaris	Solaris 11

Beyond the agent, BigFix has cloud plugins for AWS, Azure, Google Cloud and VMware, through which BigFix actions set and remove resource tags.

Who is it for?

• Organizations with mixed environments — Windows, macOS, Linux and Unix in one console instead of several tools.
• Companies with remote employees — one view of patch status for laptops and servers.
• Security and audit teams — compliance reports and read-only accounts for people who need to see the state but not change the configuration.
• Regulated sectors and public administration — FIPS 140-3 mode and modern platform cryptography.
• IT departments automating through APIs — REST API with tokens and MCP Server for AI agents under RBAC control.

Benefits

For the IT team: one agent for all platforms, confirmed state after patching instead of a dispatch report, fewer tools to maintain.

For security: visibility of patches and configuration on every machine, correction of policy deviations, cryptography for regulated environments.

For management: a shorter list of unpatched machines and reports that can be shown to an auditor without compiling data by hand.

BigFix at nFlo

BigFix works best as part of a wider process. In our IT vulnerability management service we combine vulnerability detection and prioritization with patching, and BigFix closes the loop on the patch side. The patching process itself is explained in the patch management glossary entry. How BigFix is used in companies of different sizes and in public administration is described in the article IT Automation and Security with HCL BigFix, while this page collects the platform’s capabilities and versions.

Specifications

Platform version	BigFix 11
Agent	one agent for all functions
Systems	Windows, Windows Server, macOS, Linux, AIX, Solaris (example versions above)
Security	TLS 1.3, SHA-384, OpenSSL 3, FIPS 140-3 mode, read-only users
Integrations	REST API with tokens, cloud plugins, BigFix Platform MCP Server
Scale	up to 20,000 endpoints per relay (Windows, Red Hat Enterprise Linux)

FAQ

Can AI agents operate BigFix through the MCP Server? Yes, through BigFix Platform MCP Server, but only within the operator’s permissions. The MCP Server has no privileged identity of its own, and the root server checks every request against RBAC. Administrators can restrict the MCP Server to read-only mode or require human approval before an operation runs.

Which operating system platforms does the BigFix agent support? The Windows, Windows Server, macOS (Apple silicon and Intel), Red Hat Enterprise Linux, Ubuntu, Debian, SUSE Linux Enterprise Server and other Linux families, as well as AIX and Solaris. Example versions are in the table above, and the full list is in the HCL support matrix.

How many endpoints can BigFix handle? According to HCL documentation, a single relay on Windows or Red Hat Enterprise Linux supports up to 20,000 endpoints in BigFix 11. We size the number of servers and relays in the deployment design according to the number and distribution of devices.

Is BigFix suitable for regulated environments? BigFix 11 lets you enable FIPS 140-3 mode, and its encryption module holds FIPS 140-3 certification. On top of that come TLS 1.3 and SHA-384, automatic locking of idle consoles and read-only user accounts, for example for auditors.

Can custom BigFix content be managed like code? Yes. The platform connects directly to a Git repository and treats it as a content site, so changes to custom content can be versioned just like code.

Does BigFix use data from Active Directory? Yes. BigFix retrieves from Active Directory and Microsoft Entra ID the user associated with a computer and the user and computer groups it belongs to, which makes it possible to manage devices by user and not only by computer name.

How does BigFix connect to other tools? Through the BigFix Server REST API with token authentication, cloud plugins for AWS, Azure, Google Cloud and VMware, and the MCP Server for AI agents. We agree the specific integrations in the deployment design.

What about support? Vendor support is provided by HCL as part of the subscription. nFlo is responsible for deployment, configuration and maintenance of the platform under a contract with the client.