Advisories
RMM Platforms: 8 Essential Controls MSPs Must Test to Protect Clients
Managed Service Providers depend on RMM software for privileged access, making it a high‑risk target. Acronis recommends eight controls—patching, privileged access, tenant isolation, and more—to harden RMM deployments. Defenders should assess, remediate gaps, and monitor activity continuously.
What happened
Managed Service Providers (MSPs) rely on Remote Monitoring & Management (RMM) platforms to administer client systems. Because RMM tools grant broad privileged access, any weakness can expose all tenant environments.
Impact
Compromise of an RMM platform can lead to lateral movement, data exfiltration, or ransomware deployment across multiple customers. Recent incidents have shown attackers exploiting misconfigurations or outdated components in RMM solutions.
Key Controls to Test
- Patch Management – Ensure the platform and all agents are updated to the latest security patches.
- Privileged Access Controls – Enforce least‑privilege, MFA, and role‑based access for RMM users.
- Audit Logging – Verify that all privileged actions are logged and monitored.
- Tenant Isolation – Confirm that customer data and agent traffic are segregated.
- Endpoint Recovery – Test backup and restore procedures for RMM agents.
- Network Segmentation – Restrict RMM traffic to dedicated VLANs or subnets.
- Secure API Access – Require API keys to be stored encrypted and rotate them regularly.
- Incident Response – Have a documented plan for RMM compromise, including notification and containment steps.
What to do now
1. Run a self‑assessment against the eight controls above. 2. Prioritize remediation of any gaps, especially in patching and privileged access. 3. Enable continuous monitoring of RMM activity and integrate alerts into your SOC. 4. Coordinate with your RMM vendor to confirm that they provide the necessary security features and timely updates.
Next Steps
Regularly review your RMM configuration and keep all components up to date. Treat RMM as a critical asset and apply the same rigor you would to any privileged system.
Related vulnerabilities
Apple Releases Xcode 27 Release Candidate Build 27A266a for Final Testing
Apple has issued the Release Candidate for Xcode 27 (build 27A266a). Developers and security teams are encouraged to test applications, audit dependencies, and ensure compatibility across Apple platforms ahead of the public launch.
Read briefing
Choosing an Incident Response Retainer: Key Questions for SecOps Teams
SecOps and sysadmins must vet incident response retainers before signing. Focus on SLA clarity, scope, hidden costs, threat profile fit, and post‑incident support. This briefing outlines the essential questions to ask and actions to take.
Read briefing
Surfshark VPN Breach: Internal Test Server Exposed, No Customer Impact
Surfshark disclosed that a misconfigured internal test server was inadvertently reachable from the internet, allowing attackers to access system binaries, code history, and build‑related credentials. No customer data or VPN traffic was compromised. The company contained the incident within 48 hours, rotated affected credentials, revoked tokens, and is tightening its test‑environment controls. Users need not take action, but remain vigilant for suspicious activity.
Read briefing
RMM Abuse Surge: Threat Actors Use Daisy‑Chain RMM Tools for Initial Access, Persistence, and Detection Evasion
Cybercriminals are increasingly exploiting remote monitoring and management (RMM) platforms to gain footholds, maintain persistence, and evade detection. Defenders should audit RMM permissions, enforce least‑privilege, monitor for anomalous RMM activity, and segment RMM traffic. Immediate action can prevent lateral movement and data exfiltration.
Read briefing