If you already have a security vulnerability scanner that runs arbitrary triggers when something is detected, can't you just use ssh to run whichever command yo

If you already have a security vulnerability scanner that runs arbitrary triggers when something is detected, can't you just use ssh to run whichever command you want? i.e ssh root@machine 'systemctl halt'