A hot fix is a workaround or solution to a single customer-reported issue. Hot fixes are issue-specific, and therefore not released to all customers. Windows hot fixes include a Setup program, while non-Windows hot fixes do not (typically you need to stop the program daemons, copy the file to overwrite its counterpart in your installation, and restart the daemons).
By default, the Security Agents can install hot fixes. If you do not want Security Agents to install hot fixes, go to the Configure Policy screen on the Worry-Free Business Security Services web console and select Disable regular Security Agent upgrade and hotfix deployment on the Other Settings tab in Privileges and Other Settings.