A hot fix is a workaround or solution to a single customer-reported issue. Hot fixes are issue-specific, and therefore not released to all customers. Windows hot fixes include a Setup program, while non-Windows hot fixes do not (typically you need to stop the program daemons, copy the file to overwrite its counterpart in your installation, and restart the daemons).
By default, the Security Agents can install hot fixes. If you do not want Security Agents to install hot fixes, change agent update settings in the web console by going to Agents > Agent Management, click Settings > Privileges and Other Settings > Other Settings tab.
If you unsuccessfully attempt to deploy a hot fix on the Apex One server, use the Touch Tool to change the time stamp of the hot fix. This causes Apex One to interpret the hot fix file as new, which makes the server attempt to automatically deploy the hot fix again. For details about this tool, see Running the Touch Tool for Security Agent Hot Fixes.