RMM tools as an entry point: Security checklist
RMM tools enable the remote maintenance and management of endpoints. If attackers obtain credentials or exploit a vulnerability in the management server, multiple connected environments may be at risk. The incidents involving ConnectWise ScreenConnect and SimpleHelp show how far such access can reach. A checklist helps teams control permissions, updates and activity.
Key takeaways
- Remote maintenance access is a target. Attackers misuse credentials, vulnerabilities or remote access software installed after gaining entry.
- An incident can affect customers. A compromised service provider account can give attackers access to connected environments.
- Access needs multiple layers of protection. MFA, restricted permissions, prompt updates and monitored logs all contribute to security.
Why RMM access is attractive to attackers
Remote Monitoring and Management, or RMM, helps IT teams and service providers monitor and manage remote systems. Depending on the product and configuration, it can be used to deploy updates, execute commands or start support sessions.
Attackers can take over existing access or introduce their own remote maintenance programs. The joint advisory from CISA, NSA and MS-ISAC also describes portable RMM programs that provide access in the context of a local user without full installation or administrator privileges.
A legitimate program name alone is therefore no proof of authorised use. The user account, target system, time and actions performed are among the factors that matter when assessing activity.
What ScreenConnect and SimpleHelp reveal
ConnectWise ScreenConnect: The vulnerability CVE-2024-1709, disclosed in 2024, allowed authentication to be bypassed on vulnerable servers. ConnectWise assigned it a CVSS score of 10.0 and provided a fix in version 23.9.8. The vendor also released patched versions for older installations. The vendor’s current security advisories are the authoritative reference for operation.
SimpleHelp: In 2025, CISA reported a ransomware incident involving a utility billing software provider. The attackers exploited unpatched SimpleHelp instances. The agency assessed that they likely used the path traversal vulnerability CVE-2024-57727 to gain access to downstream customers. The case shows why service providers must also understand the reach of their remote maintenance access.
Security checklist for RMM tools
The following measures are based on the CISA guide to securing remote access software and should be adapted to the product and operating model.
- 1. Take inventory. Document approved RMM products, servers, agents, accounts and connected customer systems. Remove unnecessary installations and investigate unknown remote access programs.
- 2. Secure accounts. Enable MFA for remote maintenance and administrator accounts. Use phishing-resistant methods where the product supports them. Avoid shared accounts and limit permissions to the tasks and systems required.
- 3. Restrict access. Make management interfaces accessible only to authorised users and necessary networks. Network segmentation and access controls limit which systems can be reached through an account.
- 4. Prioritise updates. Monitor vendor advisories and promptly apply security updates to servers and agents. For critical vulnerabilities, also check whether the installation has already been attacked.
- 5. Monitor activity. Log sign-ins, sessions, account changes and administrative actions. Investigate unusual source addresses and times as well as unauthorised programs.
- 6. Involve service providers. Agree responsibilities for updates, logs and incident reporting. Regularly review which customer environments a service provider account is allowed to access.
Acting on suspected misuse
The incident response team should restrict the affected access in line with its incident response plan and preserve relevant logs. It should then establish which accounts, sessions and connected systems may be affected.
An update closes a vulnerability but does not automatically remove unauthorised access already established. Accounts, configuration and affected systems must therefore also be investigated before systems are brought back online.
Frequently asked questions
Each question is closed. Tap to reveal the answer.
Which remote maintenance programs have been misused in attacks?
CISA describes the misuse of ScreenConnect and AnyDesk, among others. The agency documented an incident involving unpatched SimpleHelp instances.
How can RMM misuse be detected?
An up-to-date inventory helps identify unknown programs. Sign-in and session logs can reveal access at unusual times or from unexpected source addresses. Anomalies must be assessed in the context of the relevant environment.
Is a patch enough after an attack?
No. A patch fixes the relevant vulnerability. Accounts that have already been created, changed settings or additional access may remain and must be investigated.
Editor’s Picks
Editor’s PickIdentity Security Gap: What Zero Trust Misses and How to Close ItEditor’s PickCloud misconfigurations: 10 major AWS and Azure risksEditor’s PickAgentic AI Security: When AI Agents Become the Attack Target
More from the MBF Media Network
MyBusinessFutureCybersecurity Boom: NIS2 Drives Germany’s Security GrowthDigital ChiefsManaged Security Services: CISO Does Not Bear Sole LiabilitycloudmagazinContainer Supply Chain Security: IT Teams Secure Software Chains
More from the MBF Media network
- Cybersecurity boom: NIS2 as a driver of growth
- Managed security services: The CISO is not solely liable
- Container supply chain security: Securing IT supply chains
Image credit: AI-generated (November 2026)
Image source: AI-generated (November 2026)
Translated from the German original using artificial intelligence. The German version is authoritative.
