Secure remote monitoring and management (RMM) software should let an MSP discover endpoints, automate patching, control privileged access, cut alert noise, contain incidents, protect recovery points, separate customer tenants and prove all of it.
Acronis, which delivers RMM as part of Acronis Cyber Platform, built this checklist from securing endpoint management across thousands of customer environments.
MSPs comparing RMM tools should test these outcomes directly rather than choosing by feature-list length.
Why RMM is part of the MSP attack surface
RMM gives technicians unattended administrative access across thousands of customer devices, which makes the management plane valuable to attackers: compromise one privileged account or server and the blast radius extends far beyond a single endpoint.
Two incidents show both sides of the problem. In September 2026, BleepingComputer reported that N-able shipped an emergency hotfix for CVE-2026-86218, a maximum-severity pre-authentication RCE flaw in its N-central RMM platform, its fourth hotfix in five weeks, with roughly 1,500 servers exposed online.
In July 2025, BleepingComputer covered the Microsoft SharePoint "ToolShell" zero-days (CVE-2025-53770 and CVE-2025-53771), exploited before a patch existed, with at least 85 on-premises servers compromised. One attack targeted the management plane; the other showed how fast customers are exposed when patching lags exploitation.
CISA has also warned that ransomware actors abuse legitimate RMM software to reach downstream customer networks. MSPs therefore need to know what happens when an account, endpoint or management workflow is compromised.
8 controls every MSP should test
1. Endpoint discovery and inventory
An MSP cannot secure devices it does not know exist. Effective RMM platforms should continuously discover and inventory endpoints, servers, network devices and software assets. During evaluation, introduce a new device into a test environment and assess how quickly it is discovered, classified and assigned the correct policy.
2. Risk-based patch management
Unpatched vulnerabilities remain one of the most common attack paths. Evaluate how the platform prioritizes updates, handles deployment failures and supports rollback when issues occur. A controlled patch deployment can reveal operational gaps that are easy to miss during a product demo.
3. Access controls and privileged administration
RMM security depends heavily on the security of technician accounts. Look for multifactor authentication, role-based access controls and separation of duties. Create restricted technician roles and verify that users cannot perform actions outside their assigned responsibilities.