Why RMM Software Is a Prime Target for Attackers
Remote monitoring and management (RMM) software provides managed service providers (MSPs) with unattended administrative access to thousands of customer endpoints, making the management plane a high-value target for attackers. Compromising a single privileged account or server can lead to widespread impact across multiple client networks. This risk is underscored by real-world incidents: in September 2026, BleepingComputer reported that N-able issued an emergency hotfix for CVE-2026-86218, a critical pre-authentication remote code execution flaw in its N-central RMM platform, marking its fourth hotfix in five weeks with approximately 1,500 servers exposed online. Earlier, in July 2025, BleepingComputer covered the exploitation of Microsoft SharePoint zero-days (CVE-2025-53770 and CVE-2025-53771), which were actively exploited before patches existed, resulting in at least 85 on-premises servers being compromised. These cases illustrate both the danger of unpatched vulnerabilities in management software and the speed at which attackers exploit delays in patching. Additionally, CISA has warned that ransomware groups frequently abuse legitimate RMM tools to pivot into customer networks, reinforcing the need for MSPs to rigorously evaluate RMM security before deployment.
Eight Essential Controls for MSPs to Test in RMM Platforms
Instead of selecting RMM tools based on feature lists, MSPs should validate security outcomes through practical testing. The following eight controls are critical for assessing whether a platform can reduce operational risk while scaling endpoint management.
1. Endpoint Discovery and Inventory
Effective RMM platforms must continuously discover and inventory all endpoints, servers, network devices, and software assets. During testing, MSPs should introduce a new device into a controlled environment and measure how quickly the system detects it, classifies it correctly, and applies the appropriate policy. Without accurate discovery, securing unknown assets is impossible.
2. Risk-Based Patch Management
Unpatched vulnerabilities remain a leading attack vector. MSPs should evaluate how the RMM platform prioritizes patches, handles deployment failures, and supports rollback procedures. A controlled patch rollout can expose operational blind spots that might not surface during a standard product demo, especially when patches fail or cause instability.
3. Access Controls and Privileged Administration
Since RMM security hinges on technician account integrity, platforms must enforce strong identity controls. This includes multifactor authentication (MFA), role-based access control (RBAC), and separation of duties. MSPs should create restricted technician roles and verify that users cannot exceed their assigned permissions, ensuring least-privilege access is enforced.
4. Alert Prioritization and Operational Visibility
The primary challenge with RMM alerts is not scarcity but overload — too many notifications lead to alert fatigue. A secure RMM should provide sufficient context to help technicians distinguish routine events from genuine threats. Testing duplicate and security-related alerts helps determine whether the platform reduces noise or exacerbates it.
5. Secure Automation and Scripting
While automation improves efficiency, scripts that run with elevated privileges across many devices increase risk if not governed properly. MSPs must test approval workflows, audit logging, and execution visibility by creating and modifying test scripts during evaluation. Controls such as two-step approval and secure credential storage are essential to prevent misuse.
6. Integration with Security Operations
Operational and security teams must work without friction. When a threat is detected, technicians should be able to transition smoothly from investigation to remediation and recovery without losing context. Simulating incidents is an effective way to uncover gaps in integration between RMM, EDR, XDR, or other security tools.
7. Recovery Readiness
Security includes the ability to recover safely after an incident. MSPs should test how backup, patching, remote access, and incident response processes interact post-break-in. Crucially, restored systems must return to a fully updated and secure state. Platforms like Acronis Cyber Platform enhance this by integrating RMM with backup and anti-malware scanning of recovery points, ensuring that restored systems are free of known vulnerabilities before going back online.
8. Tenant Separation and Auditability
For MSPs serving multiple clients, strong tenant isolation is non-negotiable. Policies, permissions, reports, and administrative actions must remain strictly separated between customer environments. Detailed audit trails are vital for compliance, customer reporting, and forensic investigations, enabling clear accountability across tenants.
Validating RMM Security Through Realistic Testing
MSPs should go beyond theoretical assessments and pilot deliberately challenging scenarios: introducing an unmanaged endpoint, triggering a failed patch, executing an unauthorized script, using a compromised test device, operating with a restricted technician account, and attempting a system restore that still requires updates. Successfully navigating these tests demonstrates whether a platform can maintain security and operational continuity under stress.
How Acronis Aligns with the Eight Controls
Acronis RMM is delivered as part of the Acronis Cyber Platform, sharing the same console and agent with adjacent cybersecurity and data protection services. Capabilities vary by licensing package, so MSPs must map specific features to each control rather than assuming all EDR, XDR, MDR, backup, or disaster recovery functions are included by default. The relevant Acronis capabilities include:
- Discovery and inventory: Device Sense™ for hardware and software inventories — validate discovery methods and policy assignment.
- Patch management: Automated patching with AI risk scoring and fail-safe mechanisms — confirm coverage and configuration needs.
- Identity and access: Multifactor authentication, role-based management, and granular roles — test least-privilege access and audit logs.
- Alert handling: Anomaly-based monitoring, auto-response, and shared platform context — evaluate tuning, grouping, and escalation.
- Scripting: Self-defense mechanisms, two-step approval, audit logs, and secure credential storage — assess script changes and execution history.
- Incident response: Native integration with Acronis EDR and Acronis XDR — verify entitlements and containment workflows.
- Recovery: Backup integration, anti-malware scans of recovery points, and fail-safe patching — validate storage, packaging, and recovery integrity.
- Tenant boundaries and evidence: Multitenant management, role-based access, and reporting — confirm per-client segregation and export capabilities.
Practical Guidance for MSPs Evaluating RMM Tools
When assessing RMM software, MSPs should look beyond basic monitoring and remote access. Key requirements include strong identity controls, reliable tenant separation, accurate endpoint discovery, safe automation, effective patch management, auditable technician activity, and seamless integration with security and recovery workflows. Platforms that unify these functions on shared infrastructure — like the Acronis Cyber Platform — reduce the need for complex integrations and minimize console switching.
Furthermore, RMM must integrate effectively with EDR, backup, and disaster recovery tools so that technicians can move from detection to containment and recovery without reconstructing the incident context in each console. The recovery path should remain viable even if the management workflow is compromised.
Conclusion: Security Over Feature Count
RMM security is not merely about uptime or remote access capabilities. Before scaling operations, MSPs must rigorously test the eight controls outlined above under realistic, adversarial conditions. Doing so reveals whether a platform genuinely reduces operational risk while enabling technicians to manage more endpoints securely. The decision should be based on validated outcomes, proven security controls, and alignment with service requirements — not on the sheer number of features listed in a product datasheet.
Source: BleepingComputer